Skip to content

C++: Add taint models for boost::asio::ip::resolve #22524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MathiasVP merged 5 commits into from
Sep 9, 2026
Merged

C++: Add taint models for boost::asio::ip::resolve #22524

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
75837fc
C++: Add tests with missing flow.
MathiasVP Sep 8, 2026
d42e432
C++: Add models for boost::asio::ip's resolve function.
MathiasVP Sep 8, 2026
79d7ef2
C++: Accept test changes.
MathiasVP Sep 8, 2026
cce40cc
C++: Add change note.
MathiasVP Sep 8, 2026
ae6fb33
C++: Also add taint from the service argument.
MathiasVP Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions cpp/ql/lib/change-notes/2026-09-08-boost-asio-ip-resolve.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added taint flow models for the `boost::asio::ip::basic_resolver::resolve` function.
16 changes: 16 additions & 0 deletions cpp/ql/lib/ext/Boost.Asio.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,3 +23,19 @@ extensions:
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["boost::asio", "", False, "buffer", "", "", "Argument[*0]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const string &,const string &)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const string &,const string &,error_code &)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const string &,const string &,flags)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const string &,const string &,flags,error_code &)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(string_view,string_view)", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(string_view,string_view,error_code &)", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(string_view,string_view,flags)", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(string_view,string_view,flags,error_code &)", "", "Argument[0..1]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,const string &,const string &)", "", "Argument[*1..2]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,const string &,const string &,error_code &)", "", "Argument[*1..2]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,const string &,const string &,flags)", "", "Argument[*1..2]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,const string &,const string &,flags,error_code &)", "", "Argument[*1..2]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,string_view,string_view)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,string_view,string_view,error_code &)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,string_view,string_view,flags)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"]
- ["boost::asio::ip", "basic_resolver<InternetProtocol>", False, "resolve", "(const InternetProtocol &,string_view,string_view,flags,error_code &)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"]
110 changes: 107 additions & 3 deletions cpp/ql/test/library-tests/dataflow/external-models/asio_streams.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,11 @@ namespace std {
};

typedef basic_string<char> string;

class string_view {
public:
string_view(const char* s);
};
};

namespace boost {
Expand All @@ -29,14 +34,50 @@ namespace boost {
};

namespace asio {
template<typename Protocol/*, typename Executor*/>
class basic_stream_socket /*: public basic_socket<Protocol, Executor>*/ {
};
class any_io_executor { };

class socket_base { };

template <typename Protocol, typename Executor>
class basic_socket : public socket_base { };

template<typename Protocol, typename Executor = any_io_executor>
class basic_stream_socket : public basic_socket<Protocol, Executor> { };

namespace ip {
class resolver_base {
public:
enum flags { passive = 1 };
};

template<typename InternetProtocol, typename Executor = any_io_executor>
class basic_resolver {
public:
class results_type {
};

results_type resolve(const std::string &host, const std::string &service);
results_type resolve(const std::string &host, const std::string &service, boost::system::error_code &ec);
results_type resolve(const std::string &host, const std::string &service, resolver_base::flags resolve_flags);
results_type resolve(const std::string &host, const std::string &service, resolver_base::flags resolve_flags, boost::system::error_code &ec);
results_type resolve(std::string_view host, std::string_view service);
results_type resolve(std::string_view host, std::string_view service, boost::system::error_code &ec);
results_type resolve(std::string_view host, std::string_view service, resolver_base::flags resolve_flags);
results_type resolve(std::string_view host, std::string_view service, resolver_base::flags resolve_flags, boost::system::error_code &ec);
results_type resolve(const InternetProtocol &protocol, const std::string &host, const std::string &service);
results_type resolve(const InternetProtocol &protocol, const std::string &host, const std::string &service, boost::system::error_code &ec);
results_type resolve(const InternetProtocol &protocol, const std::string &host, const std::string &service, resolver_base::flags resolve_flags);
results_type resolve(const InternetProtocol &protocol, const std::string &host, const std::string &service, resolver_base::flags resolve_flags, boost::system::error_code &ec);
results_type resolve(const InternetProtocol &protocol, std::string_view host, std::string_view service);
results_type resolve(const InternetProtocol &protocol, std::string_view host, std::string_view service, boost::system::error_code &ec);
results_type resolve(const InternetProtocol &protocol, std::string_view host, std::string_view service, resolver_base::flags resolve_flags);
results_type resolve(const InternetProtocol &protocol, std::string_view host, std::string_view service, resolver_base::flags resolve_flags, boost::system::error_code &ec);
};

class tcp {
public:
typedef basic_stream_socket<tcp> socket;
typedef basic_resolver<tcp> resolver;
};
};

Expand Down Expand Up @@ -76,6 +117,7 @@ void sink(char *);
void sink(std::string);
void sink(boost::asio::streambuf);
void sink(boost::asio::mutable_buffer);
void sink(boost::asio::ip::tcp::resolver::results_type);

char *getenv(const char *name);
int send(int, const void*, int, int);
Expand Down Expand Up @@ -105,3 +147,65 @@ void test(boost::asio::ip::tcp::socket &socket) {
// ...
}
}

void test_resolve_host() {
boost::asio::ip::tcp::resolver resolver;
boost::asio::ip::tcp protocol;
boost::asio::ip::resolver_base::flags flags = boost::asio::ip::resolver_base::passive;
boost::system::error_code error;
std::string host(source());
std::string service("");
std::string_view host_view(source());
std::string_view service_view("");
Comment thread
MathiasVP marked this conversation as resolved.

sink(resolver.resolve(host, service)); // $ ir
sink(resolver.resolve(host, service, error)); // $ ir
sink(resolver.resolve(host, service, flags)); // $ ir
sink(resolver.resolve(host, service, flags, error)); // $ ir

sink(resolver.resolve(host_view, service_view)); // $ ir
sink(resolver.resolve(host_view, service_view, error)); // $ ir
sink(resolver.resolve(host_view, service_view, flags)); // $ ir
sink(resolver.resolve(host_view, service_view, flags, error)); // $ ir

sink(resolver.resolve(protocol, host, service)); // $ ir
sink(resolver.resolve(protocol, host, service, error)); // $ ir
sink(resolver.resolve(protocol, host, service, flags)); // $ ir
sink(resolver.resolve(protocol, host, service, flags, error)); // $ ir

sink(resolver.resolve(protocol, host_view, service_view)); // $ ir
sink(resolver.resolve(protocol, host_view, service_view, error)); // $ ir
sink(resolver.resolve(protocol, host_view, service_view, flags)); // $ ir
sink(resolver.resolve(protocol, host_view, service_view, flags, error)); // $ ir
}

void test_resolve_service() {
boost::asio::ip::tcp::resolver resolver;
boost::asio::ip::tcp protocol;
boost::asio::ip::resolver_base::flags flags = boost::asio::ip::resolver_base::passive;
boost::system::error_code error;
std::string host("");
std::string service(source());
std::string_view host_view("");
std::string_view service_view(source());

sink(resolver.resolve(host, service)); // $ ir
sink(resolver.resolve(host, service, error)); // $ ir
sink(resolver.resolve(host, service, flags)); // $ ir
sink(resolver.resolve(host, service, flags, error)); // $ ir

sink(resolver.resolve(host_view, service_view)); // $ ir
sink(resolver.resolve(host_view, service_view, error)); // $ ir
sink(resolver.resolve(host_view, service_view, flags)); // $ ir
sink(resolver.resolve(host_view, service_view, flags, error)); // $ ir

sink(resolver.resolve(protocol, host, service)); // $ ir
sink(resolver.resolve(protocol, host, service, error)); // $ ir
sink(resolver.resolve(protocol, host, service, flags)); // $ ir
sink(resolver.resolve(protocol, host, service, flags, error)); // $ ir

sink(resolver.resolve(protocol, host_view, service_view)); // $ ir
sink(resolver.resolve(protocol, host_view, service_view, error)); // $ ir
sink(resolver.resolve(protocol, host_view, service_view, flags)); // $ ir
sink(resolver.resolve(protocol, host_view, service_view, flags, error)); // $ ir
}
Loading
Loading