C++: exclude printf implementation internals from uncontrolled format string sinks#21493
C++: exclude printf implementation internals from uncontrolled format string sinks#21493MarkLee131 wants to merge 7 commits intogithub:mainfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the C++ cpp/tainted-format-string query to reduce false positives that occur inside implementations of printf-like functions (and their wrappers), by excluding certain internal format-string sinks while preserving reporting at the outermost call sites.
Changes:
- Introduces a helper predicate to identify printf-like functions and wrapper functions forwarding format strings.
- Narrows the sink definition to exclude sinks occurring inside those identified functions.
You can also share your feedback on Copilot code review. Take the survey.
geoffw0
left a comment
geoffw0
left a comment
There was a problem hiding this comment.
@MarkLee131 thank you for your contribution! I'm going to start some CI and probably try this out locally.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| /** | ||
| * Holds if `f` is a printf-like function or a (possibly nested) wrapper | ||
| * that forwards a format-string parameter to one. | ||
| * | ||
| * Functions that *implement* printf-like behaviour (e.g. a custom | ||
| * `vsnprintf` variant) internally parse the caller-supplied format string | ||
| * and build small, bounded, local format strings such as `"%d"` or `"%ld"` | ||
| * for inner `sprintf` calls. Taint that reaches those inner calls via the | ||
| * parsed format specifier is not exploitable, so sinks inside such | ||
| * functions should be excluded. | ||
| */ |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
|
Hi @geoffw0, I have resolved the issues mentioned above. Could you pelase review this PR again? thanks~ |
|
Thanks for resolving the issues. We do need a change note for this - I've proposed one in MarkLee131#1 . |
C++: Change note.
|
I have merged it :) |
Fix #21492
printf(tainted_str)smsg(tainted_fmt, ...)) remainflagged