Merge pull request #22257 from MathiasVP/add-more-com-api-models

C++: Add more registry flow sources and `COM`-related flow summaries

Author: MathiasVP

cpp/ql/lib/ext/Windows.model.yml

@@ -35,16 +35,18 @@ extensions:
       - ["", "", False, "HttpReceiveRequestEntityBody", "", "", "Argument[*3]", "remote", "manual"]
       - ["", "", False, "HttpReceiveClientCertificate", "", "", "Argument[*3]", "remote", "manual"]
       # winreg.h
-      - ["", "", False, "RegQueryValueA", "", "", "Argument[*2]", "local", "manual"]
-      - ["", "", False, "RegQueryValueExA", "", "", "Argument[*4]", "local", "manual"]
-      - ["", "", False, "RegQueryValueW", "", "", "Argument[*2]", "local", "manual"]
-      - ["", "", False, "RegQueryValueExW", "", "", "Argument[*4]", "local", "manual"]
-      - ["", "", False, "RegGetValueA", "", "", "Argument[*5]", "local", "manual"]
-      - ["", "", False, "RegGetValueW", "", "", "Argument[*5]", "local", "manual"]
+      - ["", "", False, "RegQueryValueA", "", "", "Argument[*2]", "windows-registry", "manual"]
+      - ["", "", False, "RegQueryValueExA", "", "", "Argument[*4]", "windows-registry", "manual"]
+      - ["", "", False, "RegQueryValueW", "", "", "Argument[*2]", "windows-registry", "manual"]
+      - ["", "", False, "RegQueryValueExW", "", "", "Argument[*4]", "windows-registry", "manual"]
+      - ["", "", False, "RegGetValueA", "", "", "Argument[*5]", "windows-registry", "manual"]
+      - ["", "", False, "RegGetValueW", "", "", "Argument[*5]", "windows-registry", "manual"]
       # TODO: Once we support access paths at sources we should also mark Argument[*1].Field[*ve_valueptr]
-      - ["", "", False, "RegQueryMultipleValuesA", "", "", "Argument[*3]", "local", "manual"]
+      - ["", "", False, "RegQueryMultipleValuesA", "", "", "Argument[*3]", "windows-registry", "manual"]
       # TODO: Once we support access paths at sources we should also mark Argument[*1].Field[*ve_valueptr]
-      - ["", "", False, "RegQueryMultipleValuesW", "", "", "Argument[*3]", "local", "manual"]
+      - ["", "", False, "RegQueryMultipleValuesW", "", "", "Argument[*3]", "windows-registry", "manual"]
+      - ["", "", False, "RegEnumValueA", "", "", "Argument[*2,*6]", "windows-registry", "manual"]
+      - ["", "", False, "RegEnumValueW", "", "", "Argument[*2,*6]", "windows-registry", "manual"]
   - addsTo:
       pack: codeql/cpp-all
       extensible: summaryModel
@@ -69,4 +71,13 @@ extensions:
       # winternl.h
       - ["", "", False, "RtlInitUnicodeString", "", "", "Argument[*1]", "Argument[*0].Field[*Buffer]", "value", "manual"]
       # winhttp.h
-      - ["", "", False, "WinHttpCrackUrl", "", "", "Argument[*0]", "Argument[*3]", "taint", "manual"]
+      - ["", "", False, "WinHttpCrackUrl", "", "", "Argument[*0]", "Argument[*3]", "taint", "manual"]
+      # combaseapi.h
+      - ["", "", False, "IIDFromString", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["", "", False, "StringFromIID", "", "", "Argument[*0]", "Argument[**1]", "taint", "manual"]
+      - ["", "", False, "ProgIDFromCLSID", "", "", "Argument[*0]", "Argument[**1]", "taint", "manual"]
+      - ["", "", False, "CLSIDFromProgID", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["", "", False, "CLSIDFromString", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["", "", False, "StringFromCLSID", "", "", "Argument[*0]", "Argument[**1]", "taint", "manual"]
+      - ["", "", False, "GUIDFromString", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["", "", False, "StringFromGUID2", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]

cpp/ql/lib/semmle/code/cpp/security/FlowSources.qll

@@ -20,6 +20,9 @@ abstract class RemoteFlowSource extends FlowSource { }
 /** A data flow source of local user input. */
 abstract class LocalFlowSource extends FlowSource { }
 
+/** A data flow source that represents the access of a value from the Windows registry. */
+abstract class WindowsRegistrySource extends LocalFlowSource { }
+
 /**
  * A remote data flow source that is defined through a `RemoteFlowSourceFunction` model.
  */
@@ -101,6 +104,12 @@ private class ExternalLocalFlowSource extends LocalFlowSource {
   override string getSourceType() { result = "external" }
 }
 
+private class ExternalWindowsRegistrySource extends WindowsRegistrySource {
+  ExternalWindowsRegistrySource() { sourceNode(this, "windows-registry") }
+
+  override string getSourceType() { result = "a value from the Windows registry" }
+}
+
 /** A remote data flow sink. */
 abstract class RemoteFlowSink extends DataFlow::Node {
   /** Gets a string that describes the type of this flow sink. */