mirror of
https://git.jabber.space/devs/cproof.git
synced 2026-07-24 15:56:21 +00:00
jabber.developer2
92953099e1
Security: - Fix CWE-134 in iq.c: user-controlled string passed as format arg Annotations: - Add G_GNUC_PRINTF to variadic functions in ui.h and log.h Compiler flags (configure.ac): - Add -Wformat -Wformat-nonliteral -Wno-format-zero-length Format mismatch fixes: - chatwin.c: Jid* instead of char* for %s - connection.c: %x -> %lx for long flags - cmd_funcs.c: %d -> %zu for MB_CUR_MAX/MB_LEN_MAX (size_t) - cmd_funcs.c: cast gpointer to (char*) for %s - cmd_defs.c: %d -> %u for g_list_length() (guint) - iq.c: from_jid->barejid -> from_jid->fulljid - console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c: gpointer -> (char*) casts for %s Bug fixes: - api.c: broken log_warning() calls with extra format arg - cmd_funcs.c: remove unused arg from cons_show() Tooling: - Expand check-cwe134.sh detection patterns
239 lines
8.9 KiB
Bash
Executable File
239 lines
8.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# check-cwe134.sh - Static analysis for CWE-134 format string vulnerabilities
|
|
#
|
|
# This script detects potentially unsafe usage of format string functions
|
|
# where user-controlled data may be passed without "%s" wrapper.
|
|
#
|
|
# Checks performed:
|
|
# 1. Direct variable passed as format string: cons_show(var);
|
|
# 2. Variable passed as format arg through multi-arg wrappers:
|
|
# win_println(win, theme, ch, var); (no format specifiers in var position)
|
|
# 3. GString->str passed as format argument without "%s"
|
|
# 4. Presence of __attribute__((format)) on printf-like wrapper declarations
|
|
# 5. Format string mismatch: more arguments than format specifiers
|
|
#
|
|
# Usage: ./check-cwe134.sh [directory]
|
|
|
|
set -e
|
|
|
|
DIR="${1:-src}"
|
|
|
|
echo "=== CWE-134 Format String Vulnerability Check ==="
|
|
echo "Scanning: $DIR"
|
|
echo ""
|
|
|
|
# Functions that accept format strings (direct: first arg is format)
|
|
DIRECT_FORMAT_FUNCS="cons_show|cons_debug|cons_show_error|log_info|log_error|log_warning|log_debug"
|
|
|
|
# Functions where format string is not the first arg (multi-arg wrappers)
|
|
# win_print(win, theme, char, FORMAT, ...)
|
|
# win_println(win, theme, char, FORMAT, ...)
|
|
# win_println_indent(win, pad, FORMAT, ...)
|
|
# win_append(win, theme, FORMAT, ...)
|
|
# win_appendln(win, theme, FORMAT, ...)
|
|
# win_append_highlight(win, theme, FORMAT, ...)
|
|
# win_appendln_highlight(win, theme, FORMAT, ...)
|
|
# win_command_exec_error(win, cmd, FORMAT, ...)
|
|
MULTI_ARG_FORMAT_FUNCS="win_print|win_println|win_println_indent|win_append|win_appendln|win_append_highlight|win_appendln_highlight|win_command_exec_error"
|
|
|
|
ALL_FORMAT_FUNCS="$DIRECT_FORMAT_FUNCS|$MULTI_ARG_FORMAT_FUNCS"
|
|
|
|
ERRORS=0
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Check 1: Direct format functions called with single variable (no format string)
|
|
# ---------------------------------------------------------------------------
|
|
echo "Check 1: Direct variable as format string..."
|
|
echo ""
|
|
|
|
# Pattern: func(identifier) or func(identifier->member) or func(identifier[index])
|
|
RESULTS=$(grep -rn --include="*.c" -P "($DIRECT_FORMAT_FUNCS)\s*\(\s*[a-zA-Z_][a-zA-Z0-9_]*(\s*->\s*\w+|\s*\[\s*\w+\s*\])?\s*\)\s*;" "$DIR" 2>/dev/null || true)
|
|
|
|
# Filter out function definitions, declarations, and safe api_* wrappers
|
|
RESULTS=$(echo "$RESULTS" | grep -v "const char\|void \|^[^:]*:[0-9]*:[a-z_]*(\|api_cons_show\|api_log_" || true)
|
|
|
|
if [ -n "$RESULTS" ]; then
|
|
echo "❌ POTENTIAL CWE-134 VULNERABILITIES FOUND (direct format):"
|
|
echo ""
|
|
echo "$RESULTS"
|
|
echo ""
|
|
ERRORS=$((ERRORS + $(echo "$RESULTS" | wc -l)))
|
|
else
|
|
echo "✅ No direct format string issues found."
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Check 2: Multi-arg wrappers where format position has a variable (not a string literal)
|
|
# ---------------------------------------------------------------------------
|
|
echo ""
|
|
echo "Check 2: Multi-arg wrappers with variable as format argument..."
|
|
echo ""
|
|
|
|
# For win_print(win, theme, char, FORMAT, ...) and win_println(win, theme, char, FORMAT, ...):
|
|
# FORMAT is the 4th argument
|
|
MULTI4_RESULTS=$(grep -rn --include="*.c" -P "(win_print|win_println)\s*\(" "$DIR" 2>/dev/null | \
|
|
grep -v "win_println_indent\|win_println_va" | \
|
|
perl -ne '
|
|
if (/((win_print|win_println)\s*\()/) {
|
|
my $line = $_;
|
|
my $call_start = index($line, $1) + length($1);
|
|
my $rest = substr($line, $call_start);
|
|
my $depth = 0; my $commas = 0; my $i = 0;
|
|
for ($i = 0; $i < length($rest) && $commas < 3; $i++) {
|
|
my $c = substr($rest, $i, 1);
|
|
if ($c eq "(") { $depth++; }
|
|
elsif ($c eq ")") { $depth--; last if $depth < 0; }
|
|
elsif ($c eq "," && $depth == 0) { $commas++; }
|
|
}
|
|
if ($commas == 3) {
|
|
my $fmt_arg = substr($rest, $i);
|
|
$fmt_arg =~ s/^\s+//;
|
|
if ($fmt_arg =~ /^[a-zA-Z_]/) { print $line; }
|
|
}
|
|
}
|
|
' || true)
|
|
MULTI4_RESULTS=$(echo "$MULTI4_RESULTS" | grep -v "^$\|const char.*message\|void " || true)
|
|
|
|
# For win_command_exec_error(win, cmd, FORMAT, ...):
|
|
# FORMAT is the 3rd argument
|
|
MULTI_CMD_RESULTS=$(grep -rn --include="*.c" -P "win_command_exec_error\s*\(" "$DIR" 2>/dev/null | \
|
|
perl -ne '
|
|
if (/(win_command_exec_error\s*\()/) {
|
|
my $line = $_;
|
|
my $call_start = index($line, $1) + length($1);
|
|
my $rest = substr($line, $call_start);
|
|
my $depth = 0; my $commas = 0; my $i = 0;
|
|
for ($i = 0; $i < length($rest) && $commas < 2; $i++) {
|
|
my $c = substr($rest, $i, 1);
|
|
if ($c eq "(") { $depth++; }
|
|
elsif ($c eq ")") { $depth--; last if $depth < 0; }
|
|
elsif ($c eq "," && $depth == 0) { $commas++; }
|
|
}
|
|
if ($commas == 2) {
|
|
my $fmt_arg = substr($rest, $i);
|
|
$fmt_arg =~ s/^\s+//;
|
|
if ($fmt_arg =~ /^[a-zA-Z_]/) { print $line; }
|
|
}
|
|
}
|
|
' || true)
|
|
MULTI_CMD_RESULTS=$(echo "$MULTI_CMD_RESULTS" | grep -v "^$\|const char.*error\|void \|ProfWin\*.*const char\*.*const char\*.*\.\.\." || true)
|
|
|
|
# For 3-arg format functions: win_println_indent(win, pad, FORMAT, ...)
|
|
# win_append(win, theme, FORMAT, ...) etc.
|
|
MULTI3_RESULTS=$(grep -rn --include="*.c" -P "(win_println_indent|win_append|win_appendln|win_append_highlight|win_appendln_highlight)\s*\([^,]+,[^,]+,\s*(?!\")\s*[a-zA-Z_][a-zA-Z0-9_]*(\s*->\s*\w+|\s*\[\s*[^\]]+\])?\s*\)\s*;" "$DIR" 2>/dev/null || true)
|
|
MULTI3_RESULTS=$(echo "$MULTI3_RESULTS" | grep -v "^$\|const char.*message\|void " || true)
|
|
|
|
MULTI_RESULTS=""
|
|
if [ -n "$MULTI4_RESULTS" ]; then
|
|
MULTI_RESULTS="$MULTI4_RESULTS"
|
|
fi
|
|
if [ -n "$MULTI3_RESULTS" ]; then
|
|
if [ -n "$MULTI_RESULTS" ]; then
|
|
MULTI_RESULTS="$MULTI_RESULTS
|
|
$MULTI3_RESULTS"
|
|
else
|
|
MULTI_RESULTS="$MULTI3_RESULTS"
|
|
fi
|
|
fi
|
|
if [ -n "$MULTI_CMD_RESULTS" ]; then
|
|
if [ -n "$MULTI_RESULTS" ]; then
|
|
MULTI_RESULTS="$MULTI_RESULTS
|
|
$MULTI_CMD_RESULTS"
|
|
else
|
|
MULTI_RESULTS="$MULTI_CMD_RESULTS"
|
|
fi
|
|
fi
|
|
|
|
if [ -n "$MULTI_RESULTS" ]; then
|
|
echo "❌ POTENTIAL CWE-134 VULNERABILITIES FOUND (multi-arg wrappers):"
|
|
echo ""
|
|
echo "$MULTI_RESULTS"
|
|
echo ""
|
|
ERRORS=$((ERRORS + $(echo "$MULTI_RESULTS" | wc -l)))
|
|
else
|
|
echo "✅ No multi-arg format string issues found."
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Check 3: GString->str passed directly as format argument
|
|
# ---------------------------------------------------------------------------
|
|
echo ""
|
|
echo "Check 3: GString->str passed to format functions..."
|
|
|
|
GSTRING_RESULTS=$(grep -rn --include="*.c" -P "($ALL_FORMAT_FUNCS)\s*\([^)]*->str\s*\)" "$DIR" 2>/dev/null | grep -v '"%s"' || true)
|
|
|
|
if [ -n "$GSTRING_RESULTS" ]; then
|
|
echo "⚠️ GString->str passed without \"%s\" (review manually):"
|
|
echo ""
|
|
echo "$GSTRING_RESULTS"
|
|
echo ""
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Check 4: Verify __attribute__((format)) on printf-like wrappers
|
|
# ---------------------------------------------------------------------------
|
|
echo ""
|
|
echo "Check 4: Verifying __attribute__((format)) annotations..."
|
|
echo ""
|
|
|
|
ATTR_ERRORS=0
|
|
|
|
# Functions that MUST have format attributes (declared in headers)
|
|
REQUIRED_ATTRIBUTED=(
|
|
"cons_show"
|
|
"cons_debug"
|
|
"cons_show_error"
|
|
"cons_show_padded"
|
|
"log_debug"
|
|
"log_info"
|
|
"log_warning"
|
|
"log_error"
|
|
"win_print"
|
|
"win_println"
|
|
"win_println_indent"
|
|
"win_println_va"
|
|
"win_append"
|
|
"win_appendln"
|
|
"win_append_highlight"
|
|
"win_appendln_highlight"
|
|
"win_command_exec_error"
|
|
)
|
|
|
|
for func in "${REQUIRED_ATTRIBUTED[@]}"; do
|
|
# Check if the function declaration in headers has a preceding format attribute
|
|
HAS_ATTR=$(grep -B1 --include="*.h" -rn "void ${func}\s*(" "$DIR" 2>/dev/null | grep -E -c "format\(printf|G_GNUC_PRINTF" || true)
|
|
if [ "$HAS_ATTR" -eq 0 ]; then
|
|
echo "❌ Missing __attribute__((format(printf, ...))) for: $func"
|
|
ATTR_ERRORS=$((ATTR_ERRORS + 1))
|
|
fi
|
|
done
|
|
|
|
if [ "$ATTR_ERRORS" -eq 0 ]; then
|
|
echo "✅ All printf-like wrappers have format attributes."
|
|
else
|
|
echo ""
|
|
echo "⚠️ $ATTR_ERRORS function(s) missing format attributes."
|
|
echo " Add __attribute__((format(printf, N, M))) before the declaration."
|
|
ERRORS=$((ERRORS + ATTR_ERRORS))
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Summary
|
|
# ---------------------------------------------------------------------------
|
|
echo ""
|
|
echo "=== Summary ==="
|
|
echo "Critical issues: $ERRORS"
|
|
|
|
if [ "$ERRORS" -gt 0 ]; then
|
|
echo ""
|
|
echo "Fix by adding \"%s\" format specifier:"
|
|
echo " BAD: cons_show(variable);"
|
|
echo " GOOD: cons_show(\"%s\", variable);"
|
|
echo ""
|
|
echo " BAD: win_println(win, theme, ch, variable);"
|
|
echo " GOOD: win_println(win, theme, ch, \"%s\", variable);"
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|