GuardRails

GuardRails

  • Languages iconEnglish
    • 中文

›C/C++

Overview

  • Introduction
  • What is GuardRails
  • Getting started
  • Findings
  • Vulnerabilities
  • Configuration
  • Custom Engines
  • False Positives
  • Enforce Passing Checks
  • Build Status on Pull Requests
  • FAQ
  • Pricing
  • Glossary
  • Tools & Licenses

API

  • Usage Guide
  • Endpoints

Vulnerabilities

  • Introduction
  • General

    • Overview
    • Hard-Coded Secrets

    Apex

    • Overview
    • Insecure Access Control
    • Insecure Network Communication
    • Insecure Processing of Data
    • Insecure Use of Cryptography
    • Insecure Use of Language/Framework API
    • Insecure Use of SQL Queries

    C/C++

    • Overview
    • Insecure Access Control
    • Insecure File Management
    • Insecure Processing of Data
    • Insecure Use of Cryptography
    • Insecure Use of Dangerous Function

    Dotnet

    • Overview
    • Insecure Access Control
    • Insecure Configuration
    • Insecure File Management
    • Insecure Processing of Data
    • Insecure Use of Cryptography
    • Insecure Use of Dangerous Function
    • Insecure Use of SQL Queries
    • Using Vulnerable Libraries

    Elixir

    • Overview
    • Insecure Configuration
    • Insecure File Management
    • Insecure Processing of Data
    • Insecure Network Communication
    • Insecure Use of Dangerous Function
    • Insecure Use of Language/Framework API
    • Insecure Use of SQL Queries
    • Using Vulnerable Libraries

    Go

    • Overview
    • Insecure File Management
    • Insecure Network Communication
    • Insecure Processing of Data
    • Insecure Use of Cryptography
    • Insecure Use of Dangerous Function
    • Insecure Use of SQL Queries
    • Using Vulnerable Libraries

    Java

    • Overview
    • Using Vulnerable Libraries
    • Insecure Use of SQL Queries
    • Insecure Use of Dangerous Function
    • Insecure Use of Regular Expressions
    • Insecure Authentication
    • Insecure Configuration
    • Insecure File Management
    • Insecure Use of Cryptography
    • Insecure Use of Language/Framework API
    • Insecure Processing of Data
    • Insecure Network Communication

    Javascript/TypeScript

    • Overview
    • Insecure Authentication
    • Insecure Processing of Data
    • Insecure Use of SQL Queries
    • Insecure Use of Regular Expressions
    • Insecure Use of Language/Framework API
    • Insecure Use of Dangerous Function
    • Using Vulnerable Libraries

    Kubernetes

    • Overview
    • Insecure Access Control
    • Insecure Configuration
    • Insecure Network Communication

    PHP

    • Overview
    • Insecure Configuration
    • Insecure File Management
    • Insecure Network Communication
    • Insecure Processing of Data
    • Insecure Use of Dangerous Function
    • Insecure Use of Language/Framework API
    • Insecure Use of Regular Expressions
    • Insecure Use of SQL Queries
    • Using Vulnerable Libraries

    Python

    • Overview
    • Insecure Configuration
    • Insecure Use of Cryptography
    • Insecure Network Communication
    • Insecure Processing of Data
    • Insecure Use of Dangerous Function
    • Insecure Use of SQL Queries
    • Using Vulnerable Libraries

    Ruby

    • Overview
    • Insecure Access Control
    • Insecure Configuration
    • Insecure File Management
    • Insecure Network Communication
    • Insecure Processing of Data
    • Insecure Use of Dangerous Function
    • Insecure Use of Language/Framework API
    • Insecure Use of Regular Expressions
    • Insecure Use of SQL Queries
    • Using Vulnerable Libraries

    Rust

    • Overview
    • Using Vulnerable Libraries

    Solidity

    • Overview
    • Insecure Integer Arithmetic
    • Insecure Use of Low-Level Call
    • Reliance on Insecure Random Numbers
    • State Change After External Call
    • Transaction Order Dependence
    • Unprotected Critical Function
    • Use of Insecure Function
    • Dependence on Predictable Environment Variables
    • Write to Arbitrary Storage Location
    • Call to Untrusted Contract

    Terraform

    • Overview
    • Hard-Coded Secrets
    • Insecure Access Control
    • Insecure Configuration
    • Insecure Network Communication
    • Insecure Use of Cryptography

Insecure Processing of Data

This category covers the following issues:

  • Buffer Overflows
  • Format Strings

Buffer Overflows

Why is this important?

A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an array of integers. Writing outside the bounds of a block of allocated memory can corrupt data, crash the program, or cause the execution of malicious code.

Check out this video for a high-level explanation:

Buffer Overflow

Fixing Buffer Overflows

Option A: Use secure alternatives

The following functions are prone to buffer overflows and have to be avoided:

functionsfunctionsfunctionsfunctions
StrCat*g_get_home_dirlstrcatstrtrns
StrCpy*g_get_tmp_dircurl_getenvswprintf
StrNCat*getenvlstrcpy*vsprintf
_tccatgetopt*scanfvscanf
_tccpygetpwsprintfwcscat
_*tscanfgetssscanfwcscpy
_*stprintfgetwdstrCatBuffwscanf
_mb*cpyrealpathstrcatstreadd
_mb*catf*scanfstr*cpy_getts

Follow the steps below:

  1. Go through the issues that GuardRails identified in the PR.
  2. Look for functions like in the table above, such as this:
void manipulate_string(char* string){
  char buf[24];
  strcpy(buf, string);
}
  1. And use safe alternatives that check the buffer bounds, like:
void manipulate_string(char* string){
  char buf[24];
  strlcpy(buf, string, sizeof(buf));
}
  1. Test it
  2. Ship it 🚢 and relax 🌴

Format Strings

Why is this important?

Functions processing Format Strings can be exploited when the submitted data of an input string is evaluated as a command by the application. In this way, an attacker could execute code, read the stack, or cause a segmentation fault in the running application, causing new behaviors that could compromise the security or the stability of the system.

Check out this video for a high-level explanation:

Format String Attacks

Fixing Insecure Format Strings

Option A: Use format string functions securely

The following functions patterns are prone to format string attacks:

  • *printf*
  • syslog

Follow the steps below:

  1. Go through the issues that GuardRails identified in the PR.
  2. Look for function patterns like in above, such as this:
int main(int argc, char **argv){
  char buf[128];
  snprintf(buf,128,argv[1]);
}
  1. Ensure that all format string functions are passed a static string which cannot be controlled by the user and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings.

  2. Test it

  3. Ship it 🚢 and relax 🌴

More information

  • Common Weakness Enumeration (CWE-119)
  • Common Weakness Enumeration (CWE-120)
  • Common Weakness Enumeration (CWE-121)
  • Common Weakness Enumeration (CWE-122)
  • Common Weakness Enumeration (CWE-134)
← Insecure File ManagementInsecure Use of Cryptography →
  • Buffer Overflows
    • Why is this important?
    • Fixing Buffer Overflows
  • Format Strings
    • Why is this important?
    • Fixing Insecure Format Strings
  • More information
  • Status
  • Help
  • Security
  • Terms
  • Privacy

© 2021 GuardRails