Skip to content

Commit d088e54

Browse files
geoffw0geoffw0
authored
Merge pull request #22324 from lcmangalagiri/rust-cwe-502-unsafe-deserialization
Rust: Add unsafe deserialization query (CWE-502)
2 parents 269db3b + 2399460 commit d088e54

15 files changed

Lines changed: 620 additions & 0 deletions

‎rust/ql/integration-tests/query-suite/rust-code-scanning.qls.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ ql/rust/ql/src/queries/security/CWE-312/CleartextStorageDatabase.ql
2020
ql/rust/ql/src/queries/security/CWE-319/UseOfHttp.ql
2121
ql/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.ql
2222
ql/rust/ql/src/queries/security/CWE-327/WeakSensitiveDataHashing.ql
23+
ql/rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.ql
2324
ql/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql
2425
ql/rust/ql/src/queries/security/CWE-770/UncontrolledAllocationSize.ql
2526
ql/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql

‎rust/ql/integration-tests/query-suite/rust-security-and-quality.qls.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ ql/rust/ql/src/queries/security/CWE-312/CleartextStorageDatabase.ql
2121
ql/rust/ql/src/queries/security/CWE-319/UseOfHttp.ql
2222
ql/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.ql
2323
ql/rust/ql/src/queries/security/CWE-327/WeakSensitiveDataHashing.ql
24+
ql/rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.ql
2425
ql/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql
2526
ql/rust/ql/src/queries/security/CWE-696/BadCtorInitialization.ql
2627
ql/rust/ql/src/queries/security/CWE-770/UncontrolledAllocationSize.ql

‎rust/ql/integration-tests/query-suite/rust-security-extended.qls.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ ql/rust/ql/src/queries/security/CWE-312/CleartextStorageDatabase.ql
2121
ql/rust/ql/src/queries/security/CWE-319/UseOfHttp.ql
2222
ql/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.ql
2323
ql/rust/ql/src/queries/security/CWE-327/WeakSensitiveDataHashing.ql
24+
ql/rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.ql
2425
ql/rust/ql/src/queries/security/CWE-614/InsecureCookie.ql
2526
ql/rust/ql/src/queries/security/CWE-770/UncontrolledAllocationSize.ql
2627
ql/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql

‎rust/ql/lib/codeql/rust/frameworks/serde.model.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sinkModel
5+
data:
6+
# serde_json deserialization functions
7+
- ["serde_json::de::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
8+
- ["serde_json::de::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
9+
- ["serde_json::de::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
10+
- ["serde_json::value::from_value", "Argument[0]", "unsafe-deserialization", "manual"]
11+
- ["serde_json::value::from_value", "Argument[0].Field[serde_json::value::Value::String(0)]", "unsafe-deserialization", "manual"]
12+
# bincode deserialization functions
13+
- ["bincode::deserialize", "Argument[0]", "unsafe-deserialization", "manual"]
14+
- ["bincode::deserialize_from", "Argument[0]", "unsafe-deserialization", "manual"]
15+
# rmp_serde (MessagePack) deserialization functions
16+
- ["rmp_serde::decode::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
17+
- ["rmp_serde::decode::from_read", "Argument[0]", "unsafe-deserialization", "manual"]
18+
# ciborium (CBOR) deserialization functions
19+
- ["ciborium::de::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
20+
# serde_yaml deserialization functions
21+
- ["serde_yaml::de::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
22+
- ["serde_yaml::de::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
23+
- ["serde_yaml::de::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
24+
# toml deserialization
25+
- ["toml::de::from_str", "Argument[0]", "unsafe-deserialization", "manual"]

‎rust/ql/lib/codeql/rust/security/UnsafeDeserializationExtensions.qll‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* Provides classes and predicates for reasoning about unsafe deserialization
3+
* vulnerabilities (CWE-502).
4+
*/
5+
6+
import rust
7+
private import codeql.rust.dataflow.DataFlow
8+
private import codeql.rust.dataflow.FlowSink
9+
private import codeql.rust.dataflow.FlowBarrier
10+
private import codeql.rust.Concepts
11+
private import codeql.rust.security.Barriers as Barriers
12+
13+
/**
14+
* Provides default sources, sinks and barriers for detecting unsafe deserialization
15+
* vulnerabilities, as well as extension points for adding your own.
16+
*/
17+
module UnsafeDeserialization {
18+
/**
19+
* A data flow source for unsafe deserialization vulnerabilities.
20+
*/
21+
abstract class Source extends DataFlow::Node { }
22+
23+
/**
24+
* A data flow sink for unsafe deserialization vulnerabilities.
25+
*/
26+
abstract class Sink extends QuerySink::Range {
27+
override string getSinkType() { result = "UnsafeDeserialization" }
28+
}
29+
30+
/**
31+
* A barrier for unsafe deserialization vulnerabilities.
32+
*/
33+
abstract class Barrier extends DataFlow::Node { }
34+
35+
/**
36+
* An active threat-model source, considered as a flow source.
37+
*/
38+
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
39+
40+
/**
41+
* A sink for unsafe deserialization from model data.
42+
*/
43+
private class ModelsAsDataSink extends Sink {
44+
ModelsAsDataSink() { sinkNode(this, "unsafe-deserialization") }
45+
}
46+
47+
/**
48+
* A barrier for unsafe deserialization from model data.
49+
*/
50+
private class ModelsAsDataBarrier extends Barrier {
51+
ModelsAsDataBarrier() { barrierNode(this, "unsafe-deserialization") }
52+
}
53+
54+
/**
55+
* A barrier for unsafe deserialization for nodes whose type is a numeric
56+
* type, which is unlikely to expose any vulnerability.
57+
*/
58+
private class NumericTypeBarrier extends Barrier instanceof Barriers::NumericTypeBarrier { }
59+
60+
private class BooleanTypeBarrier extends Barrier instanceof Barriers::BooleanTypeBarrier { }
61+
62+
private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier
63+
{ }
64+
}

‎rust/ql/src/change-notes/2026-08-11-unsafe-deserialization.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: newQuery
3+
---
4+
* Added a new query, `rust/unsafe-deserialization`, to detect deserialization of user-controlled data.

‎rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.qhelp‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
7+
<p>
8+
Deserializing untrusted data without validation can allow an attacker to cause denial of service, consume excessive resources, or in some cases execute arbitrary code. Rust's memory safety mitigates some risks, but deserializing untrusted data with libraries like<code>serde</code>, <code>bincode</code>, or <code>rmp-serde</code> can still lead to panics, excessive memory allocation, or logic bugs. This is especially true when trait objects or polymorphic types are involved.
9+
10+
</p>
11+
12+
</overview>
13+
<recommendation>
14+
15+
<p>
16+
17+
Avoid deserializing untrusted data with formats that allow unbounded allocation or polymorphic dispatch. Where possible, prefer formats with schema validation, such as Protocol Buffers, when processing untrusted input.
18+
If you do use <code>serde</code>, consider:
19+
20+
</p>
21+
<ul>
22+
<li>Validating input size before deserialization.</li>
23+
<li>Using <code>#[serde(deny_unknown_fields)]</code> to reject unexpected data.</li>
24+
<li>Avoiding <code>#[typetag]</code> or trait object deserialization with untrusted input.</li>
25+
<li>Using bounded containers (e.g., limiting <code>Vec</code> length via custom deserializers).</li>
26+
</ul>
27+
28+
</recommendation>
29+
<example>
30+
31+
<p>
32+
In the following example, data from an HTTP request is directly deserialized without any validation. An attacker could send a crafted payload that causes excessive memory allocation or other unintended behavior.
33+
</p>
34+
35+
<sample src="UnsafeDeserializationBad.rs" />
36+
37+
<p>
38+
A safer approach validates the input size and uses strict deserialization settings:
39+
</p>
40+
41+
<sample src="UnsafeDeserializationGood.rs" />
42+
43+
</example>
44+
<references>
45+
46+
<li>OWASP: <a href="https://community.owasp.org/vulnerabilities/Deserialization_of_untrusted_data">Deserialization of untrusted data</a>.</li>
47+
48+
</references>
49+
</qhelp>

‎rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.ql‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* @name Deserialization of user-controlled data
3+
* @description Deserializing user-controlled data without validation can cause a denial of service and, in some cases, arbitrary code execution.
4+
* code execution, denial of service, or other harmful effects.
5+
* @kind path-problem
6+
* @problem.severity error
7+
* @security-severity 9.8
8+
* @precision high
9+
* @id rust/unsafe-deserialization
10+
* @tags security
11+
* external/cwe/cwe-502
12+
*/
13+
14+
import rust
15+
import codeql.rust.dataflow.DataFlow
16+
import codeql.rust.dataflow.TaintTracking
17+
import codeql.rust.security.UnsafeDeserializationExtensions
18+
19+
/**
20+
* A taint configuration for detecting unsafe deserialization vulnerabilities.
21+
*/
22+
module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
23+
import UnsafeDeserialization
24+
25+
predicate isSource(DataFlow::Node node) { node instanceof Source }
26+
27+
predicate isSink(DataFlow::Node node) { node instanceof Sink }
28+
29+
predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }
30+
31+
predicate observeDiffInformedIncrementalMode() { any() }
32+
}
33+
34+
module UnsafeDeserializationFlow = TaintTracking::Global<UnsafeDeserializationConfig>;
35+
36+
import UnsafeDeserializationFlow::PathGraph
37+
38+
from UnsafeDeserializationFlow::PathNode sourceNode, UnsafeDeserializationFlow::PathNode sinkNode
39+
where UnsafeDeserializationFlow::flowPath(sourceNode, sinkNode)
40+
select sinkNode.getNode(), sourceNode, sinkNode,
41+
"This deserialization operation processes $@ without validation.", sourceNode.getNode(),
42+
"user-provided data"

‎rust/ql/src/queries/security/CWE-502/UnsafeDeserializationBad.rs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
use serde::Deserialize;
2+
3+
#[derive(Deserialize)]
4+
struct UserData {
5+
name: String,
6+
items: Vec<String>,
7+
}
8+
9+
fn handle_request(body: &[u8]) -> UserData {
10+
// BAD: deserializing user-controlled data without size validation
11+
serde_json::from_slice(body).unwrap()
12+
}

‎rust/ql/src/queries/security/CWE-502/UnsafeDeserializationGood.rs‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
use serde::Deserialize;
2+
3+
const MAX_BODY_SIZE: usize = 1024 * 1024; // 1 MB limit
4+
5+
#[derive(Deserialize)]
6+
#[serde(deny_unknown_fields)]
7+
struct UserData {
8+
name: String,
9+
#[serde(deserialize_with = "bounded_vec")]
10+
items: Vec<String>,
11+
}
12+
13+
fn bounded_vec<'de, D>(deserializer: D) -> Result<Vec<String>, D::Error>
14+
where
15+
D: serde::Deserializer<'de>,
16+
{
17+
let v = Vec::<String>::deserialize(deserializer)?;
18+
if v.len() > 100 {
19+
return Err(serde::de::Error::custom("too many items"));
20+
}
21+
Ok(v)
22+
}
23+
24+
fn handle_request(body: &[u8]) -> Result<UserData, String> {
25+
// GOOD: validate input size before deserialization, use bounded containers
26+
if body.len() > MAX_BODY_SIZE {
27+
return Err("payload too large".to_string());
28+
}
29+
serde_json::from_slice(body).map_err(|e| e.to_string())
30+
}

0 commit comments

Comments
 (0)