Condividi tramite


Query e suite CodeQL per il testing dei driver Windows

Il repository GitHub Di Microsoft CodeQL offre due suite di query per semplificare lo sviluppo dei driver Windows e garantire la conformità al Programma di compatibilità hardware windows (WHCP). La suite recommended.qls include tutte le query consigliate per gli sviluppatori di driver, mentre la suite mustfix.qls è incentrata sulle query "Must-Fix" necessarie per la certificazione WHCP. Entrambe le suite vengono aggiornate regolarmente.

Must-Fix richieste per la certificazione di WCHP

Il seguente sottoinsieme di query sono Must-Fix per la certificazione WHCP e sono anche inclusi nella suite Correzione consigliata.

Questo set di regole è incluso in mustfix.qls.

Documento d'identità Posizione Enumerazione punti deboli comuni
cpp/verifica-errore-di-overflow-addizione codeql/cpp-queries/<Version>/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql CWE-190, CWE-192
cpp/pointer-overflow-check codeql/cpp-queries/<Version>/Likely Bugs/Memory Management/PointerOverflow.ql Non disponibile
cpp/troppi pochi argomenti codeql/cpp-queries/<Version>/Likely Bugs/Underspecified Functions/TooFewArguments.ql Non disponibile
cpp/comparison-with-wider-type codeql/cpp-queries/<Version>/Security/CWE/CWE-190/ComparisonWithWiderType.ql CWE-190, CWE-197, CWE-835
cpp/hresult-boolean-conversion codeql/cpp-queries/<Version>/Security/CWE/CWE-253/HResultBooleanConversion.ql CWE-253

Il file mustfix.qls include le query di codice Must-Fix seguenti.

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

- description: Security queries required to fix when certifying Windows Drivers
- queries: .
  from: codeql/cpp-queries
  version: 0.9.0
- include:
    query path:
      - Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql
      - Likely Bugs/Memory Management/PointerOverflow.ql
      - Likely Bugs/Underspecified Functions/TooFewArguments.ql
      - Security/CWE/CWE-190/ComparisonWithWiderType.ql
      - Security/CWE/CWE-253/HResultBooleanConversion.ql
- import: windows-driver-suites/windows_mustfix_partial.qls
  from: microsoft/windows-drivers

Questo set di regole è incluso in windows-driver-suites/windows_mustfix_partial.qls.

Documento d'identità Posizione Enumerazione punti deboli comuni
cpp/windows/wdk/deprecated-api /microsoft/windows-drivers/<Version>/drivers/general/queries/WdkDeprecatedApis/wdk-deprecated-api.ql Non disponibile
microsoft/Security/CWE/CWE-704/WcharCharConversionLimited /microsoft/windows-drivers/<Version>/microsoft/Security/CWE/CWE-704/WcharCharConversionLimited.ql CWE-704

Il file windows_mustfix_partial.qls include le query di codice Must-Fix seguenti.

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

- description: Security queries required to fix when certifying Windows Drivers
- queries: .
  from: microsoft/windows-drivers
- include:
    query path:
      - drivers/general/queries/WdkDeprecatedApis/wdk-deprecated-api.ql
      - microsoft/Security/CWE/CWE-704/WcharCharConversionLimited.ql

Queste query fanno parte della suite di query recommended.qls nel repository CodeQL di Microsoft GitHub. La colonna "Common Weakness Enumeration" (CWE) identifica i tipi di problemi di sicurezza cercati dalla query specificata. Per altre informazioni sulle CWE , vedere la pagina di Mitre in CWE .

La colonna "Common Weakness Enumeration" (CWE) mostra i tipi di problemi di sicurezza identificati dalla query.

Migliori pratiche

Documento d'identità Posizione Enumerazione punti deboli comuni
cpp/uso-dell-offset-prima-del-controllo-del-range codeql/cpp-queries//<Version>Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql Non disponibile

Bug probabili

Documento d'identità Posizione Enumerazione punti deboli comuni
cpp/verifica-errore-di-overflow-addizione codeql/cpp-queries/<Version>/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql CWE-190, CWE-192
cpp/integer-multiplication-cast-to-long codeql/cpp-queries/<Version>/Likely Bugs/Arithmetic/IntMultToLong.ql CWE-190, CWE-192, CWE-197, CWE-681
cpp/signed-overflow-check codeql/cpp-queries/<Version>/Likely Bugs/Arithmetic/SignedOverflowCheck.ql Non disponibile
cpp/upcast-array-pointer-aritmetica-dei-puntatori codeql/cpp-queries/<Version>/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql CWE-119, CWE-843
cpp/pointer-overflow-check codeql/cpp-queries/<Version>/Likely Bugs/Memory Management/PointerOverflow.ql Non disponibile
cpp/troppi pochi argomenti codeql/cpp-queries/<Version>/Likely Bugs/Underspecified Functions/TooFewArguments.ql Non disponibile
cpp/incorrect-not-operator-usage codeql/cpp-queries/<Version>/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.ql CWE-480
cpp/suspicious-add-sizeof codeql/cpp-queries/<Version>/Likely Bugs/Memory Management/SuspiciousSizeof.ql CWE-468
cpp/uninitialized-local codeql/cpp-queries/<Version>/Likely Bugs/Memory Management/UninitializedLocal.ql CWE-457, CWE-665

Sicurezza

Documento d'identità Posizione Enumerazione punti deboli comuni
cpp/variabile-condizionalmente-non-inizializzata codeql/cpp-queries//<Version>Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql. CWE-457
cpp/unterminated-variadic-call codeql/cpp-queries//<Version>Security/CWE/CWE-121/UnterminatedVarargsCall.ql CWE-121
cpp/suspicious-pointer-scaling codeql/cpp-queries//<Version>Security/CWE/CWE-468/IncorrectPointerScaling.ql CWE-468
cpp/suspicious-pointer-scaling-void codeql/cpp-queries/<Version>/Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql CWE-468
cpp/funzione-potenzialmente-pericolosa codeql/cpp-queries/<Version>/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql CWE-676
cpp/incorrect-string-type-conversion codeql/cpp-queries/<Version>/Security/CWE/CWE-704/WcharCharConversion.ql CWE-704
cpp/comparison-with-wider-type codeql/cpp-queries/<Version>/Security/CWE/CWE-190/ComparisonWithWiderType.ql CWE-190, CWE-197, CWE-835
cpp/hresult-boolean-conversion codeql/cpp-queries/<Version>/Security/CWE/CWE-253/HResultBooleanConversion.ql CWE-253
cpp/suspicious-add-sizeof codeql/cpp-queries//<Version>Security/CWE/CWE-468/CWE-468/SuspiciousAddWithSizeof.ql CWE-468

Il file recommended.qls include le query di codice consigliate seguenti.

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

- description: Recommended and required queries for Windows Drivers.
- import: windows-driver-suites/windows_mustfix_partial.qls
  from: microsoft/windows-drivers
- import: windows-driver-suites/windows_recommended_partial.qls
  from: microsoft/windows-drivers
- queries: .
  from: codeql/cpp-queries
  version: 0.9.0
- include:
    query path:
      - Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql
      - Likely Bugs/Arithmetic/IntMultToLong.ql
      - Likely Bugs/Arithmetic/SignedOverflowCheck.ql
      - Likely Bugs/Conversion/CastArrayPointerArithmetic.ql
      - Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.ql
      - Likely Bugs/Memory Management/SuspiciousSizeof.ql
      - Likely Bugs/Memory Management/UninitializedLocal.ql
      - Security/CWE/CWE-121/UnterminatedVarargsCall.ql
      - Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
      - Security/CWE/CWE-468/IncorrectPointerScaling.ql
      - Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql
      - Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
      - Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
      - Security/CWE/CWE-704/WcharCharConversion.ql
      - Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql
      - Likely Bugs/Memory Management/PointerOverflow.ql
      - Likely Bugs/Underspecified Functions/TooFewArguments.ql
      - Security/CWE/CWE-190/ComparisonWithWiderType.ql
      - Security/CWE/CWE-253/HResultBooleanConversion.ql

Queste query fanno parte della suite di query windows_recommended_partial.qls .

Documento d'identità Posizione Enumerazione punti deboli comuni
cpp/paddingbyteinformationdisclosure microsoft/windows-drivers/<Version>/microsoft/Likely Bugs/Boundary Violations/PaddingByteInformationDisclosure.ql Non disponibile
cpp/badoverflowguard microsoft/windows-drivers/<Version>/microsoft/Likely Bugs/Conversion/BadOverflowGuard.ql Non disponibile
cpp/infiniteloop microsoft/windows-drivers/<Version>/microsoft/Likely Bugs/Conversion/InfiniteLoop.ql Non disponibile
cpp/uninitializedptrfield microsoft/windows-drivers/<Version>/microsoft/Likely Bugs/UninitializedPtrField.ql Non disponibile
cpp/use-after-free microsoft/windows-drivers/<Version>/microsoft/Likely Bugs/Memory Management/UseAfterFree/UseAfterFree.ql Non disponibile
Documento d'identità Posizione Avviso di analisi del codice
cpp/weak-crypto/cng/hardcoded-iv /microsoft/windows-drivers/<Version>/microsoft/Security/Cryptography/HardcodedIVCNG.ql Non disponibile

Driver - Generale

Documento d'identità Posizione Avviso di analisi del codice
cpp/drivers/ke-set-event-pageable /microsoft/windows-drivers/<Version>/drivers/general/queries/KeSetEventPageable/KeSetEventPageable.ql Nessun controllo CA associato
cpp/drivers/role-type-correctly-used /microsoft/windows-drivers/<Version>/drivers/general/queries/RoleTypeCorrectlyUsed/RoleTypeCorrectlyUsed.ql Nessun controllo CA associato
cpp/drivers/extended-deprecated-apis /microsoft/windows-drivers/<Version>/drivers/general/queries/ExtendedDeprecatedApis.ql Avviso C28719, avviso C28726, avviso C28735, avviso C28750
cpp/drivers/irql-not-saved /microsoft/windows-drivers/<Version>/drivers/general/queries/IrqlNotSaved/IrqlNotSaved.ql Avviso C28158
cpp/drivers/irql-not-used /microsoft/windows-drivers/<Version>/drivers/general/queries/IrqlNotUsed/IrqlNotUsed.ql Avviso C28157
cpp/drivers/irql-set-too-high /microsoft/windows-drivers/<Version>/drivers/general/queries/IrqlTooHigh/IrqlTooHigh.ql Avviso C28150
cpp/drivers/irql-too-low /microsoft/windows-drivers/<Version>/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql Avviso C28120
cpp/drivers/irql-set-too-high /microsoft/windows-drivers/<Version>/drivers/general/queries/IrqlSetTooHigh/IrqlTooHigh.ql Avviso C28121
cpp/drivers/irql-set-too-low /microsoft/windows-drivers/<Version>/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql Avviso C28124
cpp/drivers/pool-tag-integral /microsoft/windows-drivers/<Version>/drivers/general/queries/PoolTagIntegral/PoolTagIntegral.ql Avviso C28134
cpp/drivers/str-safe /microsoft/windows-drivers/<Version>/drivers/general/queries/StrSafe/StrSafe.ql Avviso C28146

Driver - WDM

Documento d'identità Posizione Avviso di analisi del codice
cpp/drivers/illegal-field-access /microsoft/windows-drivers/<Version>/drivers/wdm/queries/IllegalFieldAccess/IllegalFieldAccess.ql Avviso C28128
cpp/drivers/illegal-field-access2 /microsoft/windows-drivers/<Version>/drivers/wdm/queries/IllegalFieldAccess2/IllegalFieldAccess2.ql Avviso C28175
cpp/drivers/illegal-field-write /microsoft/windows-drivers/<Version>/drivers/wdm/queries/IllegalFieldWrite/IllegalFieldWrite.ql Avviso C28176
cpp/drivers/opaque-mdl-use /microsoft/windows-drivers/<Version>/drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlUse.ql (Nessun controllo CA associato)
cpp/drivers/opaque-mdl-write /microsoft/windows-drivers/<Version>/drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlWrite.ql Avviso C28145
cpp/drivers/pending-status-error /microsoft/windows-drivers/<Version>/drivers/wdm/queries/PendingStatusError/PendingStatusError.ql Avviso C28143
cpp/drivers/assegnazione-errata-tabella-distribuzione /microsoft/windows-drivers/<Version>/drivers/wdm/queries/WrongDispatchTableAssignment/WrongDispatchTableAssignment.ql Avviso C28169

Il file windows-driver-suites/windows_recommended_partial.qls include le query di codice consigliate seguenti.

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

- description: Recommended and required queries for Windows Drivers.
- import: windows-driver-suites/windows_mustfix_partial.qls
- queries: .
  from: microsoft/windows-drivers
- include:
    query path:
      - microsoft/Likely Bugs/Boundary Violations/PaddingByteInformationDisclosure.ql
      - microsoft/Likely Bugs/Conversion/BadOverflowGuard.ql
      - microsoft/Likely Bugs/Conversion/InfiniteLoop.ql
      - microsoft/Likely Bugs/Memory Management/UseAfterFree/UseAfterFree.ql
      - microsoft/Likely Bugs/UninitializedPtrField.ql
      - microsoft/Security/Crytpography/HardcodedIVCNG.ql
      - drivers/general/queries/KeSetEventPageable/KeSetEventPageable.ql
      - drivers/general/queries/RoleTypeCorrectlyUsed/RoleTypeCorrectlyUsed.ql
      - drivers/general/queries/DefaultPoolTag/DefaultPoolTag.ql
      - drivers/general/queries/ExaminedValue/ExaminedValue.ql
      - drivers/general/queries/ExtendedDeprecatedApis/ExtendedDeprecatedApis.ql
      - drivers/general/queries/IrqlNotSaved/IrqlNotSaved.ql
      - drivers/general/queries/IrqlNotUsed/IrqlNotUsed.ql
      - drivers/general/queries/IrqlTooHigh/IrqlTooHigh.ql
      - drivers/general/queries/IrqlTooLow/IrqlTooLow.ql
      - drivers/general/queries/IrqlSetTooHigh/IrqlTooHigh.ql
      - drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql
      - drivers/general/queries/PoolTagIntegral/PoolTagIntegral.ql
      - drivers/general/queries/StrSafe/StrSafe.ql
      - drivers/wdm/queries/IllegalFieldAccess/IllegalFieldAccess.ql
      - drivers/wdm/queries/IllegalFieldAccess2/IllegalFieldAccess2.ql
      - drivers/wdm/queries/IllegalFieldWrite/IllegalFieldWrite.ql
      - drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlUse.ql
      - drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlWrite.ql
      - drivers/wdm/queries/PendingStatusError/PendingStatusError.ql
      - drivers/wdm/queries/WrongDispatchTableAssignment/WrongDispatchTableAssignment.ql