cpp: add insecure randomness query with RNG security models - #22437
Draft
kumarak wants to merge 1 commit into
Draft
cpp: add insecure randomness query with RNG security models#22437kumarak wants to merge 1 commit into
kumarak wants to merge 1 commit into
Conversation
Add the cpp/insecure-randomness query (CWE-330/338) that flags cryptographically insecure random numbers used as security-sensitive values (keys, IVs, nonces). - shared quantum: add isCryptographicallySecure() to Crypto::RandomNumberGenerationInstance (defaults to none). - cpp quantum lib: model C stdlib, POSIX/BSD, Windows CNG, and C++ <random> generators via the new randomNumberGeneratorModel extensible predicate; classify OpenSSL RAND_bytes/RAND_priv_bytes as secure and RAND_pseudo_bytes as insecure. - MaD: populate randomNumberGeneratorModel with the generator rows.
kumarak
marked this pull request as draft
August 27, 2026 01:15
kumarak
force-pushed
the
kumarak/cpp-insecure-randomness-query
branch
from
August 27, 2026 01:15
0c867c5 to
acb1923
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a C++ insecure-randomness query using shared cryptography models to track weak RNG output into keys, IVs, and nonces.
Changes:
- Adds cryptographic-security classification for RNG models.
- Models standard, platform, C++, and OpenSSL generators.
- Adds the query, documentation, change notes, and tests.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
shared/quantum/codeql/quantum/experimental/Model.qll |
Adds RNG security classification. |
shared/quantum/change-notes/2026-08-26-random-security-classification.md |
Documents the shared API. |
cpp/ql/test/query-tests/Security/CWE/CWE-330/test.cpp |
Exercises RNG sources and sinks. |
cpp/ql/test/query-tests/Security/CWE/CWE-330/options |
Configures test stubs. |
cpp/ql/test/query-tests/Security/CWE/CWE-330/InsecureRandomness.qlref |
Registers the query test. |
cpp/ql/test/query-tests/Security/CWE/CWE-330/InsecureRandomness.expected |
Records expected results. |
cpp/ql/src/Security/CWE/CWE-330/InsecureRandomness.ql |
Implements taint tracking. |
cpp/ql/src/Security/CWE/CWE-330/InsecureRandomness.qhelp |
Documents the query. |
cpp/ql/src/Security/CWE/CWE-330/InsecureRandomness.c |
Provides usage examples. |
cpp/ql/src/change-notes/2026-08-26-insecure-randomness-query.md |
Announces the query. |
cpp/ql/lib/ext/experimental.quantum.Random.model.yml |
Defines RNG model rows. |
cpp/ql/lib/experimental/quantum/Standard/Random.qll |
Implements data-driven RNG models. |
cpp/ql/lib/experimental/quantum/OpenSSL/Random.qll |
Classifies OpenSSL RNGs. |
cpp/ql/lib/experimental/quantum/Language.qll |
Exposes standard RNG models. |
cpp/ql/lib/change-notes/2026-08-26-insecure-randomness-model.md |
Documents model additions. |
Suppressed comments (1)
cpp/ql/lib/ext/experimental.quantum.Random.model.yml:24
- In Windows headers,
RtlGenRandomis a macro alias forSystemFunction036, so preprocessing makes the call target's function nameSystemFunction036. The directRtlGenRandomdeclaration in this test masks that behavior, and this row will not model normal uses through the Windows API headers. Model the exported name as well and make the regression fixture use the real alias shape.
- ["", "", "RtlGenRandom", "0", true]
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| sink = any(Crypto::KeyGenerationOperationInstance op).getKeyValueConsumer() | ||
| } | ||
|
|
||
| predicate isBarrierIn(DataFlow::Node node) { isSource(node) } |
Comment on lines
+51
to
+60
| // A global or `std` free function, e.g. `rand` or `std::rand`. | ||
| type = "" and | ||
| f.hasGlobalOrStdName(name) and | ||
| generatorName = name | ||
| or | ||
| // A member function of a class (template), e.g. `std::mt19937::operator()`. | ||
| type != "" and | ||
| f.getName() = name and | ||
| f.getDeclaringType().getSimpleName() = type and | ||
| (if namespace = "" then generatorName = type else generatorName = namespace + "::" + type) |
| - ["std", "mersenne_twister_engine", "operator()", "", false] | ||
| - ["std", "linear_congruential_engine", "operator()", "", false] | ||
| - ["std", "subtract_with_carry_engine", "operator()", "", false] | ||
| - ["std", "discard_block_engine", "operator()", "", false] |
| - ["", "", "jrand48", "", false] | ||
| - ["", "", "rand_r", "", false] | ||
| # POSIX/BSD generators returning the value (secure). | ||
| - ["", "", "arc4random", "", true] |
| { | ||
| OpenSslRandomNumberGeneratorInstance() { | ||
| this.(Call).getTarget().getName() in ["RAND_bytes", "RAND_pseudo_bytes"] | ||
| this.(Call).getTarget().getName() in ["RAND_bytes", "RAND_priv_bytes", "RAND_pseudo_bytes"] |
| - ["", "", "arc4random_uniform", "", true] | ||
| # Generators writing to a buffer argument (secure). | ||
| - ["", "", "arc4random_buf", "0", true] | ||
| - ["", "", "getrandom", "0", true] |
jketema
reviewed
Aug 27, 2026
jketema
left a comment
jketema
left a comment
Contributor
There was a problem hiding this comment.
I see you turned this into draft after opening this PR. I just want to note that we will not accept any queries in our main line query directory that depend on query libraries from experimental directories.
Author
Thanks, @jketema, for letting me know. I will remove the use of libraries from experimental directories. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add the cpp/insecure-randomness query (CWE-330/338) that flags cryptographically insecure random numbers used as security-sensitive values (keys, IVs, nonces).