RI Development to main

.github/workflows/publish.yml

@@ -0,0 +1,44 @@
+
+name: Build and Publish Windows CodeQL queries
+on:
+  workflow_dispatch:
+    input:
+      version:
+        description: 'CodeQL version to use'
+        required: true
+        type: string
+jobs:
+  publish:
+    runs-on: windows-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+    - name: Enable long git paths
+      shell: cmd
+      run: git config --global core.longpaths true
+
+    - name: Clone self (windows-driver-developer-supplemental-tools)
+      uses: actions/checkout@v4
+      with:
+        path: .
+        fetch-depth: 0
+
+    - name: CodeQL Download
+      run:  
+        Invoke-WebRequest -Uri "https://github.com/github/codeql-cli-binaries/releases/download/v${{ github.event.inputs.version }}/codeql-win64.zip" -OutFile codeql-win64.zip;
+        Expand-Archive -Path codeql-win64.zip -DestinationPath .\codeql-zip -Force;
+        Move-Item -Path  .\codeql-zip\codeql -Destination .\codeql-cli\
+
+    - name: Install CodeQL pack dependencies
+      shell: cmd
+      run: |
+        pushd .\src 
+        ..\codeql-cli\codeql.cmd pack install 
+        popd
+    - name: Publish New CodeQL Pack
+      shell: pwsh
+      env:
+        GITHUB_TOKEN:  ${{ secrets.GITHUB_TOKEN }}
+      run: 
+        .\codeql-cli\codeql.cmd pack publish ./src;

.gitignore

@@ -1,6 +1,8 @@
 # query compilation caches
 **/*.cache
 
+**/*.codeql/
+
 # IDE folders
 .vscode/*
 **/.vs/*
@@ -13,6 +15,11 @@ src/drivers/test/**/Debug/*
 src/drivers/test/TestDB/*
 src/drivers/test/working/*
 src/drivers/test/AnalysisFiles/*
-
+AnalysisFiles/*
+TestDB/*
+working/*
 #excel files
-**/*.xlsx
+**/*.xlsx
+
+# Log files
+**/*.log

config/codeql-config.yml

@@ -0,0 +1,9 @@
+name: "CodeQL config"
+disable-default-queries: true
+
+packs:
+  - microsoft/cpp-queries@0.0.2:codeql-suites/cpp-code-scanning.qls
+  - microsoft/windows-drivers@1.5.0-beta+5:windows-driver-suites/recommended.qls
+  - microsoft/windows-drivers@1.5.0-beta+5:drivers\general\queries\experimental\DriverIsolationZwViolation1\DriverIsolationZwViolation1.ql
+  - microsoft/windows-drivers@1.5.0-beta+5:drivers\general\queries\experimental\DriverIsolationZwViolation2\DriverIsolationZwViolation2.ql
+  - microsoft/windows-drivers@1.5.0-beta+5:drivers\general\queries\experimental\DriverIsolationRtlViolation\DriverIsolationRtlViolation.ql

src/codeql-pack.lock.yml

@@ -2,17 +2,27 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.1
+    version: 4.2.0
   codeql/dataflow:
-    version: 0.1.4
+    version: 2.0.5
+  codeql/mad:
+    version: 1.0.21
   codeql/rangeanalysis:
-    version: 0.0.3
+    version: 1.0.21
   codeql/ssa:
-    version: 0.2.4
+    version: 1.1.0
+  codeql/suite-helpers:
+    version: 1.0.21
   codeql/tutorial:
-    version: 0.2.4
+    version: 1.0.21
+  codeql/typeflow:
+    version: 1.0.21
   codeql/typetracking:
-    version: 0.2.4
+    version: 2.0.5
   codeql/util:
-    version: 0.2.4
+    version: 2.0.8
+  codeql/xml:
+    version: 1.0.21
+  microsoft/cpp-queries:
+    version: 0.0.4
 compiled: false

src/drivers/apps/queries/experimental/UnsafeCallInGlobalInit/UnsafeCallInGlobalInit.qhelp

@@ -0,0 +1,66 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+	<overview>
+		<p>
+		When using a DLL, it is frequently the case that any static construtors are called from DllMain. There are a number of constraints that apply to calling other functions from DllMain.  In particular, it is possible to create memory leaks if the DLL is loaded and unloaded dynamically. SysAllocString is an example of a function that, in this case, could cause a memory leak.
+		</p>
+	</overview>
+	<recommendation>
+		<p>
+			The ideal DllMain would be just an empty stub. However, given the complexity of many applications, this is generally too restrictive. A good rule of thumb for DllMain is to postpone as much initialization as possible. Lazy initialization increases robustness of the application because this initialization is not performed while the loader lock is held. Also, lazy initialization enables you to safely use much more of the Windows API.
+		</p>
+	</recommendation>
+	<example>
+		<p>
+			DLLMain function
+		</p>
+		<sample language="c"> <![CDATA[
+		BOOL WINAPI DllMain(
+		HINSTANCE hinstDLL,  // handle to DLL module
+		DWORD fdwReason,     // reason for calling function
+		LPVOID lpvReserved )  // reserved
+		{
+			// Perform actions based on the reason for calling.
+			switch( fdwReason ) 
+			{ 
+				case DLL_PROCESS_ATTACH:
+				// Initialize once for each new process.
+				// Return FALSE to fail DLL load.
+					break;
+
+				case DLL_THREAD_ATTACH:
+				// Do thread-specific initialization.
+					break;
+
+				case DLL_THREAD_DETACH:
+				// Do thread-specific cleanup.
+					break;
+
+				case DLL_PROCESS_DETACH:
+
+					if (lpvReserved != nullptr)
+					{
+						break; // do not do cleanup if process termination scenario
+					}
+
+				// Perform any necessary cleanup.
+					break;
+			}
+			return TRUE;  // Successful DLL_PROCESS_ATTACH.
+		}
+		}]]>
+
+	</example>
+	<semmleNotes>
+		<p>
+
+		</p>
+	</semmleNotes>
+	<references>
+		<li>
+			<a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/28637-calling-function-in-a-global-initializer-is-unsafe">
+				C28637
+			</a>
+		</li>
+	</references>
+</qhelp>

src/drivers/apps/queries/experimental/UnsafeCallInGlobalInit/UnsafeCallInGlobalInit.ql

@@ -0,0 +1,56 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+/**
+ * @id cpp/drivers/unsafe-call-in-global-init
+ * @kind problem
+ * @name UnsafeCallInGlobalInit
+ * @description When using a DLL, it is frequently the case that any
+ *  static construtors are called from DllMain.
+ *  There are a number of constraints that apply to calling
+ *  other functions from DllMain.  In particular, it is
+ *  possible to create memory leaks if the DLL is loaded
+ *  and unloaded dynamically.
+ * @platform Desktop
+ * @feature.area Multiple
+ * @impact Insecure Coding Practice
+ * @repro.text
+ * @owner.email: sdat@microsoft.com
+ * @opaqueid CQLD-C28637
+ * @problem.severity warning
+ * @precision medium
+ * @tags correctness
+ *       ca_ported
+ * @scope domainspecific
+ * @query-version v1
+ */
+
+ import cpp
+ import drivers.libraries.DriverIsolation
+
+ from Function f, string msg
+ where
+   f.getName().matches("DllMain") and
+   exists(FunctionCall fc |
+     fc.getEnclosingFunction() = f
+      and
+     (
+       fc.getTarget()
+           .getName()
+           .matches([
+               "LoadLibrary%", "LoadLibraryEx", "GetStringTypeA", "GetStringTypeEx", "GetStringTypeW",
+               "CoInitializeEx", "CreateProcess%", "ExitThread%", "CreateThread%", "ShGetFolderPathW"
+             ]) or
+       fc instanceof RegistryIsolationFunctionCall
+     )
+      and
+     msg = "Unsafe call in DllMain: " + fc.getTarget().getName() + ". "
+   )
+   or
+   exists(Initializer i |
+     f.getName().matches("DllMain") and
+     i.getExpr().getEnclosingFunction() = f and
+     not i.getDeclaration().isStatic() and
+     i.getExpr().toString().toLowerCase().matches("null") and
+     msg = "Potential unsafe initialization in DllMain. "
+   )
+ select f, msg + " Review Dynamic-Link Library Best Practices."