適用於 Windows 驅動程式測試的 CodeQL 查詢和套件

2025-05-14

Microsoft CodeQL GitHub 存放庫提供兩個查詢套件，以簡化 Windows 驅動程式開發，並確保符合 Windows 硬體相容性計劃（WHCP）。 windows_driver_recommended.qls 套件包含驅動程式開發人員的所有建議查詢，而 windows_driver_mustfix.qls 套件則著重於 WHCP 認證所需的「必須修正」查詢。這兩個套件都會定期更新。

Must-Fix WCHP 認證查詢

下列查詢子集是WHCP 認證的 Must-Fix ，也包含在 建議的修正 套件中。

這組規則包含在 windows_driver_mustfix.qls 中。

身份證	地點	常見弱點列舉
cpp/bad-addition-overflow-check	codeql/cpp-queries/`<Version>`/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql	CWE-190、 CWE-192
cpp/pointer-overflow-check	codeql/cpp-queries/`<Version>`/Likely Bugs/Memory Management/PointerOverflow.ql	N/A
cpp/too-few-arguments	codeql/cpp-queries/`<Version>`/Likely Bugs/Underspecified Functions/TooFewArguments.ql	N/A
cpp/comparison-with-wider-type	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-190/ComparisonWithWiderType.ql	CWE-190、 CWE-197、 CWE-835
cpp/hresult-boolean-conversion	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-253/HResultBooleanConversion.ql	CWE-253

windows_driver_mustfix.qls 檔案包含下列 Must-Fix 程式代碼查詢。

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

- description: Security queries required to fix when certifying Windows Drivers
- queries: .
  from: codeql/cpp-queries
  version: 0.9.0
- include:
    query path:
      - Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql
      - Likely Bugs/Memory Management/PointerOverflow.ql
      - Likely Bugs/Underspecified Functions/TooFewArguments.ql
      - Security/CWE/CWE-190/ComparisonWithWiderType.ql
      - Security/CWE/CWE-253/HResultBooleanConversion.ql
- import: windows-driver-suites/windows_mustfix_partial.qls
  from: microsoft/windows-drivers

這組規則包含在 windows-driver-suites/windows_mustfix_partial.qls 中。

身份證	地點	常見弱點列舉
cpp/windows/wdk/deprecated-api	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/WdkDeprecatedApis/wdk-deprecated-api.ql	N/A
microsoft/Security/CWE/CWE-704/WcharCharConversionLimited	/microsoft/windows-drivers/`<Version>`/microsoft/Security/CWE/CWE-704/WcharCharConversionLimited.ql	CWE-704

windows_mustfix_partial.qls 檔案包含下列 Must-Fix 程式代碼查詢。

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

- description: Security queries required to fix when certifying Windows Drivers
- queries: .
  from: microsoft/windows-drivers
- include:
    query path:
      - drivers/general/queries/WdkDeprecatedApis/wdk-deprecated-api.ql
      - microsoft/Security/CWE/CWE-704/WcharCharConversionLimited.ql

建議的修正查詢

這些查詢是 Microsoft GitHub CodeQL 存放庫中windows_driver_recommended.qls 查詢套件的一部分。 [常見弱點列舉] （CWE）數據行會識別指定查詢所搜尋的安全性問題種類。如需 CWE 的詳細資訊，請參閱 CWE 上的 Mitre 頁面。

[常見弱點列舉] （CWE）資料行會顯示查詢識別的安全性問題類型。

最佳做法

身份證	地點	常見弱點列舉
cpp/offset-use-before-range-check	codeql/cpp-queries/`<Version>`/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql	N/A

可能的錯誤

身份證	地點	常見弱點列舉
cpp/bad-addition-overflow-check	codeql/cpp-queries/`<Version>`/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql	CWE-190、 CWE-192
cpp/整數乘法轉換為長整型	codeql/cpp-queries/`<Version>`/Likely Bugs/Arithmetic/IntMultToLong.ql	CWE-190、 CWE-192、 CWE-197、 CWE-681
cpp/signed-overflow-check	codeql/cpp-queries/`<Version>`/Likely Bugs/Arithmetic/SignedOverflowCheck.ql	N/A
cpp/upcast-array-pointer-arithmetic	codeql/cpp-queries/`<Version>`/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql	CWE-119，CWE-843
cpp/pointer-overflow-check	codeql/cpp-queries/`<Version>`/Likely Bugs/Memory Management/PointerOverflow.ql	N/A
cpp/參數過少	codeql/cpp-queries/`<Version>`/Likely Bugs/Underspecified Functions/TooFewArguments.ql	N/A
cpp/錯誤的非運算子使用	codeql/cpp-queries/`<Version>`/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.ql	CWE-480
cpp/suspicious-add-sizeof	codeql/cpp-queries/`<Version>`/Likely Bugs/Memory Management/SuspiciousSizeof.ql	CWE-468
cpp/uninitialized-local	codeql/cpp-queries/`<Version>`/Likely Bugs/Memory Management/UninitializedLocal.ql	CWE-457、 CWE-665

安全

身份證	地點	常見弱點列舉
cpp/conditionally-uninitialized-variable	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql。	CWE-457
cpp/未結束的可變參數呼叫	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-121/UnterminatedVarargsCall.ql	CWE-121
cpp/suspicious-pointer-scaling	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-468/IncorrectPointerScaling.ql	CWE-468
cpp/suspicious-pointer-scaling-void	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql	CWE-468
cpp/潛在危險函數	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql	CWE-676
cpp/不正確的字串類型轉換	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-704/WcharCharConversion.ql	CWE-704
cpp/comparison-with-wider-type	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-190/ComparisonWithWiderType.ql	CWE-190、 CWE-197、 CWE-835
cpp/hresult-boolean-conversion	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-253/HResultBooleanConversion.ql	CWE-253
cpp/suspicious-add-sizeof	codeql/cpp-queries/`<Version>`/Security/CWE/CWE-468/CWE-468/SuspiciousAddWithSizeof.ql	CWE-468

windows_driver_recommended.qls 檔案包含下列建議的程式代碼查詢。

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

- description: Recommended and required queries for Windows Drivers.
- import: windows-driver-suites/windows_mustfix_partial.qls
  from: microsoft/windows-drivers
- import: windows-driver-suites/windows_recommended_partial.qls
  from: microsoft/windows-drivers
- queries: .
  from: codeql/cpp-queries
  version: 0.9.0
- include:
    query path:
      - Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql
      - Likely Bugs/Arithmetic/IntMultToLong.ql
      - Likely Bugs/Arithmetic/SignedOverflowCheck.ql
      - Likely Bugs/Conversion/CastArrayPointerArithmetic.ql
      - Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.ql
      - Likely Bugs/Memory Management/SuspiciousSizeof.ql
      - Likely Bugs/Memory Management/UninitializedLocal.ql
      - Security/CWE/CWE-121/UnterminatedVarargsCall.ql
      - Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
      - Security/CWE/CWE-468/IncorrectPointerScaling.ql
      - Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql
      - Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
      - Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
      - Security/CWE/CWE-704/WcharCharConversion.ql
      - Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql
      - Likely Bugs/Memory Management/PointerOverflow.ql
      - Likely Bugs/Underspecified Functions/TooFewArguments.ql
      - Security/CWE/CWE-190/ComparisonWithWiderType.ql
      - Security/CWE/CWE-253/HResultBooleanConversion.ql

這些查詢是 windows_recommended_partial.qls 查詢套件的一部分。

可能的 Bug - windows_recommended_partial.qls

身份證	地點	常見弱點列舉
cpp/paddingbyteinformationdisclosure	microsoft/windows-drivers/`<Version>`/microsoft/Likely Bugs/Boundary Violations/PaddingByteInformationDisclosure.ql	N/A
cpp/badoverflowguard	microsoft/windows-drivers/`<Version>`/microsoft/Likely Bugs/Conversion/BadOverflowGuard.ql	N/A
cpp/infiniteloop	microsoft/windows-drivers/`<Version>`/microsoft/Likely Bugs/Conversion/InfiniteLoop.ql	N/A
cpp/uninitializedptrfield	microsoft/windows-drivers/`<Version>`/microsoft/Likely Bugs/UninitializedPtrField.ql	N/A
cpp/use-after-free	microsoft/windows-drivers/`<Version>`/microsoft/Likely Bugs/Memory Management/UseAfterFree/UseAfterFree.ql	N/A

安全性 - windows_recommended_partial.qls

身份證	地點	程序代碼分析警告
cpp/weak-crypto/cng/hardcoded-iv	/microsoft/windows-drivers/`<Version>`/microsoft/Security/Crytpography/HardcodedIVCNG.ql	N/A

驅動程式 - 一般

身份證	地點	程序代碼分析警告
cpp/drivers/ke-set-event-pageable	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/KeSetEventPageable/KeSetEventPageable.ql	沒有相關聯的 CA 檢查
cpp/drivers/role-type-correctly-used	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/RoleTypeCorrectlyUsed/RoleTypeCorrectlyUsed.ql	沒有相關聯的 CA 檢查
cpp/drivers/extended-deprecated-apis	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/ExtendedDeprecatedApis.ql	C28719 警告、 C28726 警告、 C28735 警告、 C28750 警告
cpp/drivers/irql-not-saved	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/IrqlNotSaved/IrqlNotSaved.ql	C28158 警告
cpp/drivers/irql-not-used	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/IrqlNotUsed/IrqlNotUsed.ql	C28157 警告
cpp/drivers/irql-set-too-high	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/IrqlTooHigh/IrqlTooHigh.ql	C28150 警告
cpp/drivers/irql-too-low	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql	C28120 警告
cpp/drivers/irql-set-too-high	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/IrqlSetTooHigh/IrqlTooHigh.ql	C28121 警告
cpp/drivers/irql-set-too-low	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql	C28124 警告
cpp/drivers/pool-tag-integral	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/PoolTagIntegral/PoolTagIntegral.ql	C28134 警告
cpp/drivers/str-safe	/microsoft/windows-drivers/`<Version>`/drivers/general/queries/StrSafe/StrSafe.ql	C28146 警告

驅動程式 - WDM

身份證	地點	程序代碼分析警告
cpp/drivers/非法字段訪問	/microsoft/windows-drivers/`<Version>`/drivers/wdm/queries/IllegalFieldAccess/IllegalFieldAccess.ql	C28128 警告
cpp/drivers/illegal-field-access2	/microsoft/windows-drivers/`<Version>`/drivers/wdm/queries/IllegalFieldAccess2/IllegalFieldAccess2.ql	C28175 警告
cpp/驅動程序/非法欄位寫入	/microsoft/windows-drivers/`<Version>`/drivers/wdm/queries/IllegalFieldWrite/IllegalFieldWrite.ql	C28176 警告
cpp/drivers/opaque-mdl-use	/microsoft/windows-drivers/`<Version>`/drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlUse.ql	沒有相關的 CA 檢查
cpp/drivers/opaque-mdl-write	/microsoft/windows-drivers/`<Version>`/drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlWrite.ql	C28145 警告
cpp/驅動程序/待處理狀態錯誤	/microsoft/windows-drivers/`<Version>`/drivers/wdm/queries/PendingStatusError/PendingStatusError.ql	C28143 警告
cpp/驅動程式/錯誤的分派表指派	/microsoft/windows-drivers/`<Version>`/drivers/wdm/queries/WrongDispatchTableAssignment/WrongDispatchTableAssignment.ql	C28169 警告

windows-driver-suites/windows_recommended_partial.qls 檔案包含下列建議的程式碼查詢。

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

- description: Recommended and required queries for Windows Drivers.
- import: windows-driver-suites/windows_mustfix_partial.qls
- queries: .
  from: microsoft/windows-drivers
- include:
    query path:
      - microsoft/Likely Bugs/Boundary Violations/PaddingByteInformationDisclosure.ql
      - microsoft/Likely Bugs/Conversion/BadOverflowGuard.ql
      - microsoft/Likely Bugs/Conversion/InfiniteLoop.ql
      - microsoft/Likely Bugs/Memory Management/UseAfterFree/UseAfterFree.ql
      - microsoft/Likely Bugs/UninitializedPtrField.ql
      - microsoft/Security/Crytpography/HardcodedIVCNG.ql
      - drivers/general/queries/KeSetEventPageable/KeSetEventPageable.ql
      - drivers/general/queries/RoleTypeCorrectlyUsed/RoleTypeCorrectlyUsed.ql
      - drivers/general/queries/DefaultPoolTag/DefaultPoolTag.ql
      - drivers/general/queries/ExaminedValue/ExaminedValue.ql
      - drivers/general/queries/ExtendedDeprecatedApis/ExtendedDeprecatedApis.ql
      - drivers/general/queries/IrqlNotSaved/IrqlNotSaved.ql
      - drivers/general/queries/IrqlNotUsed/IrqlNotUsed.ql
      - drivers/general/queries/IrqlTooHigh/IrqlTooHigh.ql
      - drivers/general/queries/IrqlTooLow/IrqlTooLow.ql
      - drivers/general/queries/IrqlSetTooHigh/IrqlTooHigh.ql
      - drivers/general/queries/IrqlSetTooLow/IrqlSetTooLow.ql
      - drivers/general/queries/PoolTagIntegral/PoolTagIntegral.ql
      - drivers/general/queries/StrSafe/StrSafe.ql
      - drivers/wdm/queries/IllegalFieldAccess/IllegalFieldAccess.ql
      - drivers/wdm/queries/IllegalFieldAccess2/IllegalFieldAccess2.ql
      - drivers/wdm/queries/IllegalFieldWrite/IllegalFieldWrite.ql
      - drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlUse.ql
      - drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlWrite.ql
      - drivers/wdm/queries/PendingStatusError/PendingStatusError.ql
      - drivers/wdm/queries/WrongDispatchTableAssignment/WrongDispatchTableAssignment.ql