Transitive call graph for python cryptographic operations

[nettrino]

Hello all,

I'm trying to pinpoint all locations calling a crypto library for a python project. Ideally I would be interested in two types of information:

• immediate callers of a crypto function
• transitive call graph for all crypto functions.

I am very new to CodeQL and so far I'm putting together queries like the one below, however I think there should be a cleaner way to achieve what I want here using predicates, queries, isSink specifications in the appropriate classes etc. Any feedback on how to write such a query cleanly would be most appreciated

import python
import semmle.python.Concepts
private import semmle.python.dataflow.new.DataFlow

from
  Cryptography::CryptographicOperation op, Cryptography::CryptographicAlgorithm algorithm,
  DataFlow::MethodCallNode mc, DataFlow::Node mco, CallNode callNode, Call call, Name name
where
  op.getAlgorithm() = algorithm and
  mc.getLocation() = op.getLocation() and
  mco = mc.getObject() and
  callNode = mco.getEnclosingCallable().getACall() and
  call.getFunc() = name and
  name.getId() = mco.getEnclosingCallable().getName()
select algorithm, op.getLocation(), mco.getEnclosingCallable().getName() as enclosing_callable,
  mco.toString(), callNode.toString(), call, call.getLocation(), name

[intrigus-lgtm]

I think you want something like I described here:

/**
 * @kind path-problem
 */

import java

class StartMethod extends Method {
  StartMethod() { getName() = "validateExpression" }
}

class TargetMethod extends Method {
  TargetMethod() { getName() = "findValue" }
}

query predicate edges(Method a, Method b) { a.calls(b) }

from TargetMethod end, StartMethod entryPoint
where edges+(entryPoint, end)
select end, entryPoint, end, "Found a path from start to target."

Porting this to Python is a bit tricky (to me), since I could not find an equivalent for the Method.calls(Method) predicate.
@tausbn or @RasmusWL probably know a better solution than this untested, hacky solution 🙂 :

/**
 * @kind path-problem
 */

import python

class StartMethod extends Function {
  StartMethod() { getName() = "validateExpression" }
}

class TargetMethod extends Function {
  TargetMethod() { getName() = "findValue" }
}

query predicate edges(Function a, Function b) { a.getAChildNode().(Call).getFunc().(Name).getId() = b.getName() }

from TargetMethod end, StartMethod entryPoint
where edges+(entryPoint, end)
select end, entryPoint, end, "Found a path from start to target."

[nettrino]

Thanks for the prompt reply - I had read the above post, however one difference (unless I'm misunderstanding smth) is that I don't know the source / target methods beforehand, so its not about finding all paths between a (concrete) A and B point. Instead, starting from the sinks (crypto operators --say we can get them from a predicate as returned in enclosing_callable--) I would want to then look for all potential callers to build the transitive flow graph regardless of the starting function. I know this could lead to a path explosion problem, so not sure how this is handled by CodeQL, but essentially, even if incomplete, I would like to iteratively walk upwards from the immediate callers (call.getLocation() in the above example) until we can't find other callers or run out of resources, in which case we just end up with an incomplete graph.

[RasmusWL]

Thanks for also looking into this @intrigus-lgtm 💪 here is my take on it

@nettrino can you explain why you are interested in finding all transitive calls to cryptographic operations? Are you trying to build way to build a way to do a security audit of cryptographic operations? (Sometimes the underlying reason for asking technical questions can help solve the problem in a different way)

Anyway, below is my current best solution. This relies on the points-to based call-graph, which we know isn't perfect, and we're currently working on replacing that with something better. (also notice that this will exclude cryptographic operations that happens on module level, since that isn't within a function).

import python
import semmle.python.Concepts

Function getFunctionPerformingCrypto(Cryptography::CryptographicOperation op) {
  result = op.getEnclosingCallable().getScope()
}

/** Holds if there is a call to `target` within `func`. */
predicate calls(Function func, Function target) {
  exists(PythonFunctionValue fv | fv.getScope() = target and fv.getACall().getScope() = func)
}

from Function immediateCryptoOp, Function transitiveCaller
where
  immediateCryptoOp = getFunctionPerformingCrypto(_) and
  calls+(transitiveCaller, immediateCryptoOp)
select transitiveCaller, immediateCryptoOp

[nettrino]

@intrigus-lgtm @RasmusWL thank you both for the very prompt replies. I am interested in building and open-sourcing a CodeQL pack for discovery / data tagging of interesting "hotspots" in a codebase, such as calls to cryptographic operations, unauthenticated APIs, external dependencies etc. The aim is to then combine the results of these analyses with other workflows (e.g., github actions) to enforce certain invariants (e.g., no modifications to lines of code with a given tag) or simply for information gathering.