Rust: Add command injection (CWE-078) and unsafe deserialization (CWE-502) queries

rust/ql/lib/codeql/rust/frameworks/serde.model.yml

@@ -0,0 +1,24 @@
+extensions:
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: sinkModel
+    data:
+      # serde_json deserialization functions
+      - ["crate::serde_json::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["crate::serde_json::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["crate::serde_json::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["crate::serde_json::from_value", "Argument[0]", "unsafe-deserialization", "manual"]
+      # bincode deserialization functions
+      - ["crate::bincode::deserialize", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["crate::bincode::deserialize_from", "Argument[0]", "unsafe-deserialization", "manual"]
+      # rmp_serde (MessagePack) deserialization functions
+      - ["crate::rmp_serde::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["crate::rmp_serde::from_read", "Argument[0]", "unsafe-deserialization", "manual"]
+      # ciborium (CBOR) deserialization functions
+      - ["crate::ciborium::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
+      # serde_yaml deserialization functions
+      - ["crate::serde_yaml::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["crate::serde_yaml::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
+      - ["crate::serde_yaml::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
+      # toml deserialization
+      - ["crate::toml::from_str", "Argument[0]", "unsafe-deserialization", "manual"]

rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml

@@ -0,0 +1,15 @@
+extensions:
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: sinkModel
+    data:
+      # std::process::Command - the command name itself
+      - ["<std::process::Command>::new", "Argument[0]", "command-injection", "manual"]
+      # std::process::Command - arguments passed to the command
+      - ["<std::process::Command>::arg", "Argument[0]", "command-injection", "manual"]
+      - ["<std::process::Command>::args", "Argument[0]", "command-injection", "manual"]
+      # tokio::process::Command - the command name itself
+      - ["<tokio::process::Command>::new", "Argument[0]", "command-injection", "manual"]
+      # tokio::process::Command - arguments passed to the command
+      - ["<tokio::process::Command>::arg", "Argument[0]", "command-injection", "manual"]
+      - ["<tokio::process::Command>::args", "Argument[0]", "command-injection", "manual"]

rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll

@@ -0,0 +1,64 @@
+/**
+ * Provides classes and predicates for reasoning about command injection
+ * vulnerabilities (CWE-078).
+ */
+
+import rust
+private import codeql.rust.dataflow.DataFlow
+private import codeql.rust.dataflow.FlowSink
+private import codeql.rust.dataflow.FlowBarrier
+private import codeql.rust.Concepts
+private import codeql.rust.security.Barriers as Barriers
+
+/**
+ * Provides default sources, sinks and barriers for detecting command injection
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module CommandInjection {
+  /**
+   * A data flow source for command injection vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for command injection vulnerabilities.
+   */
+  abstract class Sink extends QuerySink::Range {
+    override string getSinkType() { result = "CommandInjection" }
+  }
+
+  /**
+   * A barrier for command injection vulnerabilities.
+   */
+  abstract class Barrier extends DataFlow::Node { }
+
+  /**
+   * An active threat-model source, considered as a flow source.
+   */
+  private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
+
+  /**
+   * A sink for command injection from model data.
+   */
+  private class ModelsAsDataSink extends Sink {
+    ModelsAsDataSink() { sinkNode(this, "command-injection") }
+  }
+
+  /**
+   * A barrier for command injection from model data.
+   */
+  private class ModelsAsDataBarrier extends Barrier {
+    ModelsAsDataBarrier() { barrierNode(this, "command-injection") }
+  }
+
+  /**
+   * A barrier for command injection vulnerabilities for nodes whose type is a
+   * numeric type, which is unlikely to expose any vulnerability.
+   */
+  private class NumericTypeBarrier extends Barrier instanceof Barriers::NumericTypeBarrier { }
+
+  private class BooleanTypeBarrier extends Barrier instanceof Barriers::BooleanTypeBarrier { }
+
+  private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier
+  { }
+}

rust/ql/lib/codeql/rust/security/UnsafeDeserializationExtensions.qll

@@ -0,0 +1,64 @@
+/**
+ * Provides classes and predicates for reasoning about unsafe deserialization
+ * vulnerabilities (CWE-502).
+ */
+
+import rust
+private import codeql.rust.dataflow.DataFlow
+private import codeql.rust.dataflow.FlowSink
+private import codeql.rust.dataflow.FlowBarrier
+private import codeql.rust.Concepts
+private import codeql.rust.security.Barriers as Barriers
+
+/**
+ * Provides default sources, sinks and barriers for detecting unsafe deserialization
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module UnsafeDeserialization {
+  /**
+   * A data flow source for unsafe deserialization vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for unsafe deserialization vulnerabilities.
+   */
+  abstract class Sink extends QuerySink::Range {
+    override string getSinkType() { result = "UnsafeDeserialization" }
+  }
+
+  /**
+   * A barrier for unsafe deserialization vulnerabilities.
+   */
+  abstract class Barrier extends DataFlow::Node { }
+
+  /**
+   * An active threat-model source, considered as a flow source.
+   */
+  private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
+
+  /**
+   * A sink for unsafe deserialization from model data.
+   */
+  private class ModelsAsDataSink extends Sink {
+    ModelsAsDataSink() { sinkNode(this, "unsafe-deserialization") }
+  }
+
+  /**
+   * A barrier for unsafe deserialization from model data.
+   */
+  private class ModelsAsDataBarrier extends Barrier {
+    ModelsAsDataBarrier() { barrierNode(this, "unsafe-deserialization") }
+  }
+
+  /**
+   * A barrier for unsafe deserialization for nodes whose type is a numeric
+   * type, which is unlikely to expose any vulnerability.
+   */
+  private class NumericTypeBarrier extends Barrier instanceof Barriers::NumericTypeBarrier { }
+
+  private class BooleanTypeBarrier extends Barrier instanceof Barriers::BooleanTypeBarrier { }
+
+  private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier
+  { }
+}

rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp

@@ -0,0 +1,40 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+
+<p>
+If a system command is built from user-provided data without sufficient sanitization, a user may be able to run malicious commands. An attacker can craft input to change the meaning of the command, potentially gaining control of the system.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+If possible, use hard-coded string literals for commands. If the command must be built from user-provided data, do not pass user input directly to shell commands. Instead, use APIs that accept command arguments as separate parameters (such as <code>std::process::Command</code> with individual <code>.arg()</code> calls for each argument), which avoids shell interpretation of special characters. If shell execution is necessary, validate and sanitize user input against an allowlist of permitted values.
+</p>
+
+</recommendation>
+<example>
+
+<p>
+In the following example, a command is constructed directly from user-controlled input obtained via an HTTP request. An attacker could supply a malicious value to execute arbitrary commands.
+</p>
+
+<sample src="CommandInjectionBad.rs" />
+
+<p>
+A safer approach uses a fixed command with validated arguments, or avoids shell interpretation entirely:
+</p>
+
+<sample src="CommandInjectionGood.rs" />
+
+</example>
+<references>
+
+<li>OWASP: <a href="https://owasp.org/www-community/attacks/Command_Injection">Command Injection</a>.</li>
+<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Code_injection#Shell_injection">Shell injection</a>.</li>
+
+</references>
+</qhelp>

rust/ql/src/queries/security/CWE-078/CommandInjection.ql

@@ -0,0 +1,42 @@
+/**
+ * @name Uncontrolled command line
+ * @description Using externally controlled strings in a command line may allow a malicious
+ *              user to change the meaning of the command.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 9.8
+ * @precision high
+ * @id rust/command-line-injection
+ * @tags security
+ *       external/cwe/cwe-078
+ *       external/cwe/cwe-088
+ */
+
+import rust
+import codeql.rust.dataflow.DataFlow
+import codeql.rust.dataflow.TaintTracking
+import codeql.rust.security.CommandInjectionExtensions
+
+/**
+ * A taint configuration for detecting command injection vulnerabilities.
+ */
+module CommandInjectionConfig implements DataFlow::ConfigSig {
+  import CommandInjection
+
+  predicate isSource(DataFlow::Node node) { node instanceof Source }
+
+  predicate isSink(DataFlow::Node node) { node instanceof Sink }
+
+  predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+}
+
+module CommandInjectionFlow = TaintTracking::Global<CommandInjectionConfig>;
+
+import CommandInjectionFlow::PathGraph
+
+from CommandInjectionFlow::PathNode sourceNode, CommandInjectionFlow::PathNode sinkNode
+where CommandInjectionFlow::flowPath(sourceNode, sinkNode)
+select sinkNode.getNode(), sourceNode, sinkNode, "This command line depends on a $@.",
+  sourceNode.getNode(), "user-provided value"

rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs

@@ -0,0 +1,10 @@
+use std::process::Command;
+
+fn handle_request(user_input: &str) {
+    // BAD: user input is passed directly to a shell command
+    Command::new("sh")
+        .arg("-c")
+        .arg(user_input)
+        .output()
+        .expect("failed to execute");
+}

rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs

@@ -0,0 +1,13 @@
+use std::process::Command;
+
+fn handle_request(filename: &str) {
+    // GOOD: use a fixed command with the user input as a separate argument,
+    // avoiding shell interpretation
+    let allowed_names = ["report.pdf", "summary.txt", "data.csv"];
+    if allowed_names.contains(&filename) {
+        Command::new("cat")
+            .arg(filename)
+            .output()
+            .expect("failed to execute");
+    }
+}

rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.qhelp

@@ -0,0 +1,46 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+
+<p>
+Deserializing untrusted data without validation can allow an attacker to cause denial of service, consume excessive resources, or in some cases execute arbitrary code. In Rust, while memory safety mitigates some risks, deserializing untrusted data with libraries like <code>serde</code>, <code>bincode</code>, or <code>rmp-serde</code> can still lead to panics, excessive memory allocation, or logic bugs when trait objects or polymorphic types are involved.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+Avoid deserializing untrusted data with formats that allow unbounded allocation or polymorphic dispatch. Prefer formats with schema validation (like Protocol Buffers) when processing untrusted input. If using <code>serde</code>, consider:
+</p>
+<ul>
+<li>Validating input size before deserialization.</li>
+<li>Using <code>#[serde(deny_unknown_fields)]</code> to reject unexpected data.</li>
+<li>Avoiding <code>#[typetag]</code> or trait object deserialization with untrusted input.</li>
+<li>Using bounded containers (e.g., limiting <code>Vec</code> length via custom deserializers).</li>
+</ul>
+
+</recommendation>
+<example>
+
+<p>
+In the following example, data from an HTTP request is directly deserialized without any validation. An attacker could send a crafted payload that causes excessive memory allocation or other unintended behavior.
+</p>
+
+<sample src="UnsafeDeserializationBad.rs" />
+
+<p>
+A safer approach validates the input size and uses strict deserialization settings:
+</p>
+
+<sample src="UnsafeDeserializationGood.rs" />
+
+</example>
+<references>
+
+<li>OWASP: <a href="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/16-Testing_for_HTTP_Incoming_Requests">Deserialization of untrusted data</a>.</li>
+<li>CWE-502: <a href="https://cwe.mitre.org/data/definitions/502.html">Deserialization of Untrusted Data</a>.</li>
+
+</references>
+</qhelp>

rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.ql

@@ -0,0 +1,42 @@
+/**
+ * @name Deserialization of user-controlled data
+ * @description Deserializing user-controlled data may allow an attacker to trigger unexpected
+ *              code execution, denial of service, or other harmful effects.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 9.8
+ * @precision high
+ * @id rust/unsafe-deserialization
+ * @tags security
+ *       external/cwe/cwe-502
+ */
+
+import rust
+import codeql.rust.dataflow.DataFlow
+import codeql.rust.dataflow.TaintTracking
+import codeql.rust.security.UnsafeDeserializationExtensions
+
+/**
+ * A taint configuration for detecting unsafe deserialization vulnerabilities.
+ */
+module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
+  import UnsafeDeserialization
+
+  predicate isSource(DataFlow::Node node) { node instanceof Source }
+
+  predicate isSink(DataFlow::Node node) { node instanceof Sink }
+
+  predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+}
+
+module UnsafeDeserializationFlow = TaintTracking::Global<UnsafeDeserializationConfig>;
+
+import UnsafeDeserializationFlow::PathGraph
+
+from UnsafeDeserializationFlow::PathNode sourceNode, UnsafeDeserializationFlow::PathNode sinkNode
+where UnsafeDeserializationFlow::flowPath(sourceNode, sinkNode)
+select sinkNode.getNode(), sourceNode, sinkNode,
+  "This deserialization operation processes $@ without validation.", sourceNode.getNode(),
+  "user-provided data"

rust/ql/src/queries/security/CWE-502/UnsafeDeserializationBad.rs

@@ -0,0 +1,12 @@
+use serde::Deserialize;
+
+#[derive(Deserialize)]
+struct UserData {
+    name: String,
+    items: Vec<String>,
+}
+
+fn handle_request(body: &[u8]) -> UserData {
+    // BAD: deserializing user-controlled data without size validation
+    serde_json::from_slice(body).unwrap()
+}