CPP: Add query for CWE-377 Insecure Temporary File

[ihsinme]

Query

Relevant PR: github/codeql#6947

CVE ID(s)

• CVE-2012-0786
• CVE-2018-6198
• CVE-2007-5936

Report

Request is looking for situations of unsafe work with files. use validation functions in the first place without guaranteeing that the file will not be created later. in the second case, he looks for places to work with the file, when his name is predictable and there are no restrictions on access rights.

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

Result(s)

I am currently working on a fix. and I will present when it will be adopted.

[ihsinme]

I posted one result to securitylab@github.com

[ghsecuritylab]

Your submission is now in status Test run.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ihsinme]

this request has been in the same state for more than two months.
Is there anything I can do to expedite their review?
Thanks to.

[ihsinme]

Good afternoon @MathiasVP.
I'm sorry to address you, but you accompanied this PR.
this request has not changed state since November 2021.
tell me what i can do.

[MathiasVP]

Hi @ihsinme,

The results are still under review. It has not been forgotten :) Sorry it's taking so long!

[m-y-mo]

@ihsinme
Thanks for the submission. After some discussions with my colleagues, we've decided that this query suffers a similar problem with another submission, in that it mostly reports results that are legitimate uses of fopen or open . For the detailed reasons of rejections, please refer to issue 549. As a result, I'm afraid that while we acknowledged your contribution to the experimental query suite via pull request, we are unable to accept the query for bounty. Thank you very much for your submission and contribution via pull request.

[ihsinme]

@m-y-mo
Good afternoon.
respecting your right to make the final decision.
Please pay attention to my arguments.

the current request is completely different from 549. In 549, the really difficult task is to detect false positives in the usual practice of not using permissions when working with files. I still think 549 is useful for developers, but I agree with your decision.

The current request 475 is more like cwe-377 . and has a practical use. so it's hard for me to agree with your verdict

so if it still makes sense, I would ask you to provide those false positive sets that I could improve.

[m-y-mo]

Thanks. I understand that the objective of this query is quite different from the one in #549 and they are not duplicate, but the reason for rejecting this query is rather because this query is also flagging many results that are also legitimate use of fopen and open, because those calls are probably not creating new files in this case either. So for example, if you run the query on gammu/gammu, then you'll see that the results are all calls to fopen with message saying Creating a file for writing without evaluating its existence and setting permissions can be unsafe., which is the same problem we saw with #549 and this is why we decided to reject the query. Hope this clarifies the decision. Thanks.

[ihsinme]

sorry, this request was made long ago, I did not immediately realize what you mean.

you are absolutely right about the error that you showed in gammu, it is very similar to request 549 (the difference is not in the rights, but in the formation of the name).
By the way, almost all of these detections can theoretically be used as an attack vector with overwriting a file with higher rights.

but in this request, 2 parts are connected through or, and I was surprised by your refusal just on the first half of the request.

I repeat, I consider the formation of the name as a vector of influence, as well as not setting the rights, but I agree that developers often work without these restrictions, generating too wide a detection field.

Based on this, I propose to consider the request only as part of the work of the first part, if in this case it is worthy of a reward, I will correct the PR.

Finding the name of a file that does not exist does not mean that it will not be exist at the next operation

[m-y-mo]

Thanks. I am happy to consider it if you can remove the first part of the query. Let me know once you're done. Thanks.

[ihsinme]

good afternoon @m-y-mo
I fixed the PR please look github/codeql#8424

[ghsecuritylab]

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed