C and C++ Binaries

IO.TAINT.CONF : 汚染された構成設定

要旨

汚染された可能性のある値が構成の設定に使われています。

プロパティ

クラス名 Tainted Configuration Setting
日本語クラス名 汚染された構成設定
クラス分類 セキュリティ (security)
ニーモニック IO.TAINT.CONF
カテゴリー
MisraC2023 MisraC2023:D.4.14 The validity of values received from external sources shall be checked
Misra2012 Misra2012:D.4.14 The validity of values received from external sources shall be checked
AUTOSARC++14 AUTOSARC++14:A27-0-1 Inputs from independent components shall be validated.
CWE CWE:15 External Control of System or Configuration Setting
DISA-6r1 DISA-6r1:V-222606 The application must validate all input.
  DISA-6r1:V-222609 The application must not be subject to input handling vulnerabilities.
DISA-5r3 DISA-5r3:V-70265 The application must validate all input.
  DISA-5r3:V-70271 The application must not be subject to input handling vulnerabilities.
DISA-4r3 DISA-4r3:V-70265 The application must validate all input.
  DISA-4r3:V-70271 The application must not be subject to input handling vulnerabilities.
DISA-3r10 DISA-3r10:V-6164 The designer will ensure the application validates all input.
対応言語 C および C++ で利用可能です。
有効/無効設定 このワーニングクラスのチェックはデフォルトで無効になっています。チェックを有効にするにはプロジェクト設定ファイル （configuration file）に以下の WARNING_FILTER ルールを追加してください。 
WARNING_FILTER += allow class="Tainted Configuration Setting"

例 

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

/* sethostid() is not present in all versions of unistd.h.
 * When present, it is only available to the superuser.
 */
int sethostid(long hostid);

int set_specified_hostid(FILE *f){
    char hostid[16];

    if (fgets(hostid, 16, f) == NULL ) return -1;
    return sethostid(atol(hostid)); /* 'Tainted Configuration Setting' warning issued here */
}

ワーニングを引き起こす関数

CodeSonar ships with library models that allow it to functions such as libc sethostid() and Win32 sethostid() that use one or more of their parameters to construct a configuration setting. If one of these functions is called with a potentially-tainted value in one of those parameter positions, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Tainted Configuration Setting warnings.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。