sqc 0.4.84

Software Code Quality - CERT C compliance checker
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

// SPDX-License-Identifier: Apache-2.0
// Copyright (c) 2024 Ryan Urchick

//! WIN00-C: Be specific when dynamically loading libraries
//!
//! Using LoadLibrary() without specifying search paths can allow DLL hijacking attacks.

use tree_sitter::Node;

use super::super::{CertRule, RuleViolation};
use crate::manifest::{RuleCategory, Severity};
use crate::utility::cert_c::ast_utils::get_node_text;
use lang_parsing_substrate::query;

pub struct Win00C;

impl CertRule for Win00C {
    fn rule_id(&self) -> &'static str {
        "WIN00-C"
    }

    fn description(&self) -> &'static str {
        "Be specific when dynamically loading libraries"
    }

    fn severity(&self) -> Severity {
        Severity::High
    }

    fn category(&self) -> RuleCategory {
        RuleCategory::Recommendation
    }

    fn cert_id(&self) -> &'static str {
        "WIN00-C"
    }

    fn scan(&self, node: &Node, source: &str, violations: &mut Vec<RuleViolation>) {
        self.check_node(node, source, violations);
    }
}

impl Win00C {
    fn check_node(&self, node: &Node, source: &str, violations: &mut Vec<RuleViolation>) {
        for n in query::find_descendants_of_kind(*node, "call_expression") {
            if let Some(func_node) = n.child_by_field_name("function") {
                let func_name = get_node_text(&func_node, source);
                if func_name.trim() == "LoadLibrary" {
                    violations.push(RuleViolation {
                        rule_id: self.rule_id().to_string(),
                        severity: self.severity(),
                        line: n.start_position().row + 1,
                        column: n.start_position().column + 1,
                        file_path: String::new(),
                        message:
                            "Using LoadLibrary() without specifying search paths enables DLL hijacking attacks. \
                            An attacker could place a malicious DLL on the search path."
                                .to_string(),
                        suggestion: Some(
                            "Use LoadLibraryEx() with explicit search flags like LOAD_LIBRARY_SEARCH_APPLICATION_DIR \
                            or LOAD_LIBRARY_SEARCH_SYSTEM32 to control DLL search paths.".to_string()
                        ),
                        requires_manual_review: None,
                    });
                }
            }
        }
    }
}