microsoft
/
Windows-Driver-Developer-Supplemental-Tools
зеркало из https://github.com/microsoft/Windows-Driver-Developer-Supplemental-Tools.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Remove accidental checked-in test file.

This commit is contained in:
NateD-MSFT 2022-12-08 18:41:33 -08:00
Родитель 2cae2a8617
Коммит 083d3db89f
1 изменённых файлов: 0 добавлений и 476 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

476
sarif-test.sarif
Просмотреть файл

@ -1,476 +0,0 @@
{
"$schema" : "https://json.schemastore.org/sarif-2.1.0.json",
"version" : "2.1.0",
"runs" : [ {
"tool" : {
"driver" : {
"name" : "CodeQL",
"organization" : "GitHub",
"semanticVersion" : "2.11.5",
"rules" : [ {
"id" : "cpp/windows/drivers/queries/extended-deprecated-apis",
"name" : "cpp/windows/drivers/queries/extended-deprecated-apis",
"shortDescription" : {
"text" : "Use of deprecated function or macro (C28719, C28726, C28735, C28750)"
},
"fullDescription" : {
"text" : "Unsafe, deprecated APIs should not be used. This is a port of Code Analysis checks C28719, C28726, and C28750."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"tags" : [ "correctness" ],
"description" : "Unsafe, deprecated APIs should not be used. This is a port of Code Analysis checks C28719, C28726, and C28750.",
"feature.area" : "Multiple",
"id" : "cpp/windows/drivers/queries/extended-deprecated-apis",
"impact" : "Attack Surface Reduction",
"kind" : "problem",
"name" : "Use of deprecated function or macro (C28719, C28726, C28735, C28750)",
"platform" : "Desktop",
"precision" : "high",
"problem.severity" : "warning",
"query-version" : "v1",
"repro.text" : "The following code locations contain calls to an unsafe, deprecated function or macro.",
"security.severity" : "Low"
}
}, {
"id" : "cpp/windows/drivers/queries/pool-tag-integral",
"name" : "cpp/windows/drivers/queries/pool-tag-integral",
"shortDescription" : {
"text" : "Use of string in pool tag instead of integral (C28134)"
},
"fullDescription" : {
"text" : "The type of a pool tag should be integral, not a string or string pointer."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"tags" : [ "correctness" ],
"description" : "The type of a pool tag should be integral, not a string or string pointer.",
"feature.area" : "Multiple",
"id" : "cpp/windows/drivers/queries/pool-tag-integral",
"impact" : "Attack Surface Reduction",
"kind" : "problem",
"name" : "Use of string in pool tag instead of integral (C28134)",
"platform" : "Desktop",
"precision" : "high",
"problem.severity" : "warning",
"query-version" : "v1",
"repro.text" : "The following code locations call a pool allocation function with a tag that is not an integral type.",
"security.severity" : "Low"
}
}, {
"id" : "cpp/windows/wdk/deprecated-api",
"name" : "cpp/windows/wdk/deprecated-api",
"shortDescription" : {
"text" : "Use of deprecated WDK API"
},
"fullDescription" : {
"text" : "Use of deprecated WDK API detected."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"description" : "Use of deprecated WDK API detected.",
"feature.area" : "Multiple",
"id" : "cpp/windows/wdk/deprecated-api",
"impact" : "Attack Surface Reduction",
"kind" : "problem",
"name" : "Use of deprecated WDK API",
"platform" : "Desktop",
"problem.severity" : "warning",
"query-version" : "1.2",
"repro.text" : "The following code locations contain calls to a deprecated WDK API",
"security.severity" : "Low"
}
}, {
"id" : "cpp/portedqueries/str-safe",
"name" : "cpp/portedqueries/str-safe",
"shortDescription" : {
"text" : "StrSafe"
},
"fullDescription" : {
"text" : "Kernel Mode drivers should use ntstrsafe.h, not strsafe.h. The header ntstrsafe.h contains versions of the functions found in strsafe.h that are suitable for use in kernel mode code. For more information please refer C28146 Code Analysis rule."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"description" : "Kernel Mode drivers should use ntstrsafe.h, not strsafe.h. The header ntstrsafe.h contains versions of the functions found in strsafe.h that are suitable for use in kernel mode code. For more information please refer C28146 Code Analysis rule.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/str-safe",
"kind" : "problem",
"name" : "StrSafe",
"platform" : "Desktop",
"problem.severity" : "warning",
"repro.text" : "The following include directive is unsafe for Kernel Mode drivers.",
"version" : "1.0"
}
}, {
"id" : "cpp/portedqueries/irq-too-high",
"name" : "cpp/portedqueries/irq-too-high",
"shortDescription" : {
"text" : "IrqTooHigh"
},
"fullDescription" : {
"text" : "The function is not permitted to be called at the current IRQ level. The current level is too high."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "error"
},
"properties" : {
"description" : "The function is not permitted to be called at the current IRQ level. The current level is too high.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/irq-too-high",
"kind" : "problem",
"name" : "IrqTooHigh",
"platform" : "Desktop",
"problem.severity" : "error",
"repro.text" : "The following line(s) potentially contains a function call that is supposed to be called at a higher Irql level.",
"version" : "1.0"
}
}, {
"id" : "cpp/portedqueries/irq-too-low",
"name" : "cpp/portedqueries/irq-too-low",
"shortDescription" : {
"text" : "IrqTooLow"
},
"fullDescription" : {
"text" : "The function is not permitted to be called at the current IRQ level. The current level is too low."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "error"
},
"properties" : {
"description" : "The function is not permitted to be called at the current IRQ level. The current level is too low.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/irq-too-low",
"kind" : "problem",
"name" : "IrqTooLow",
"platform" : "Desktop",
"problem.severity" : "error",
"repro.text" : "The following line(s) potentially contains a function call that is supposed to be called at a lower Irql level.",
"version" : "1.0"
}
}, {
"id" : "cpp/portedqueries/examined-value",
"name" : "cpp/portedqueries/examined-value",
"shortDescription" : {
"text" : "ExaminedValue"
},
"fullDescription" : {
"text" : "The returned value is annotated with the _Check_return_ or _Must_inspect_result_ annotation, but the calling function is either not using the value or is overwriting the value without examining it. For more information please refer C28193 Code Analysis rule."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"description" : "The returned value is annotated with the _Check_return_ or _Must_inspect_result_ annotation, but the calling function is either not using the value or is overwriting the value without examining it. For more information please refer C28193 Code Analysis rule.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/examined-value",
"kind" : "problem",
"name" : "ExaminedValue",
"platform" : "Desktop",
"problem.severity" : "warning",
"repro.text" : "The following code locations potentially contain function calls whose return values are not checked.",
"version" : "1.0"
}
}, {
"id" : "cpp/windows/drivers/queries/illegal-field-access",
"name" : "cpp/windows/drivers/queries/illegal-field-access",
"shortDescription" : {
"text" : "Incorrect access to protected field (C28128)"
},
"fullDescription" : {
"text" : "The driver assigned a value to a structure member that should be accessed only by using specialized functions."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"tags" : [ "correctness" ],
"description" : "The driver assigned a value to a structure member that should be accessed only by using specialized functions.",
"feature.area" : "Multiple",
"id" : "cpp/windows/drivers/queries/illegal-field-access",
"kind" : "problem",
"name" : "Incorrect access to protected field (C28128)",
"platform" : "Desktop",
"precision" : "high",
"problem.severity" : "warning",
"query-version" : "v1",
"repro.text" : "The driver assigned a value to a structure member that should be accessed only by using specialized functions.",
"security.severity" : "Low"
}
}, {
"id" : "cpp/portedqueries/ke-wait-local",
"name" : "cpp/portedqueries/ke-wait-local",
"shortDescription" : {
"text" : "KeWaitLocal"
},
"fullDescription" : {
"text" : "If the first argument to KeWaitForSingleObject is a local variable, the Mode parameter must be KernelMode"
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "error"
},
"properties" : {
"description" : "If the first argument to KeWaitForSingleObject is a local variable, the Mode parameter must be KernelMode",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/ke-wait-local",
"kind" : "problem",
"name" : "KeWaitLocal",
"platform" : "Desktop",
"problem.severity" : "error",
"repro.text" : "The following code locations potentially contain KeWaitForSingleObject where the Mode parameter is not KernelMode",
"version" : "1.0"
}
}, {
"id" : "cpp/portedqueries/multiple-paged-code",
"name" : "cpp/portedqueries/multiple-paged-code",
"shortDescription" : {
"text" : "MultiplePagedCode"
},
"fullDescription" : {
"text" : "The function has more than one instance of PAGED_CODE or PAGED_CODE_LOCKED."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"description" : "The function has more than one instance of PAGED_CODE or PAGED_CODE_LOCKED.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/multiple-paged-code",
"kind" : "problem",
"name" : "MultiplePagedCode",
"platform" : "Desktop",
"problem.severity" : "warning",
"repro.text" : "The following code locations potentially contain dupulicate PAGED_CODE() calls.",
"version" : "1.0"
}
}, {
"id" : "cpp/portedqueries/no-paged-code",
"name" : "cpp/portedqueries/no-paged-code",
"shortDescription" : {
"text" : "NoPagedCode"
},
"fullDescription" : {
"text" : "The function has been declared to be in a paged segment, but neither PAGED_CODE nor PAGED_CODE_LOCKED was found. For more information look at C28170 Code Analysis rule."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"description" : "The function has been declared to be in a paged segment, but neither PAGED_CODE nor PAGED_CODE_LOCKED was found. For more information look at C28170 Code Analysis rule.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/no-paged-code",
"kind" : "problem",
"name" : "NoPagedCode",
"platform" : "Desktop",
"problem.severity" : "warning",
"repro.text" : "The following code locations do not call PAGED_CODE() or PAGED_CODE_LOCKED even though they put the function in a paged segment.",
"version" : "1.0"
}
}, {
"id" : "cpp/portedqueries/no-paging-segment",
"name" : "cpp/portedqueries/no-paging-segment",
"shortDescription" : {
"text" : "NoPagingSegment"
},
"fullDescription" : {
"text" : "The function has PAGED_CODE or PAGED_CODE_LOCKED but is not declared to be in a paged segment. In other words, a function that contains a PAGED_CODE or PAGED_CODE_LOCKED macro has not been placed in paged memory by using #pragma alloc_text or #pragma code_seg. For more information refer to C28172 Code Analysis rule."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"description" : "The function has PAGED_CODE or PAGED_CODE_LOCKED but is not declared to be in a paged segment. In other words, a function that contains a PAGED_CODE or PAGED_CODE_LOCKED macro has not been placed in paged memory by using #pragma alloc_text or #pragma code_seg. For more information refer to C28172 Code Analysis rule.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/no-paging-segment",
"kind" : "problem",
"name" : "NoPagingSegment",
"platform" : "Desktop",
"problem.severity" : "warning",
"repro.text" : "The following code locations have PAGED_CODE() or PAGED_CODE_LOCKED() calls but they were not put in paged segments.",
"version" : "1.0"
}
}, {
"id" : "cpp/windows/drivers/queries/ob-reference-mode",
"name" : "cpp/windows/drivers/queries/ob-reference-mode",
"shortDescription" : {
"text" : "The AccessMode parameter to ObReferenceObject* should be IRP->RequestorMode (C28126)"
},
"fullDescription" : {
"text" : "In a dispatch routine call to ObReferenceObjectByHandle or ObReferenceObjectByPointer, the driver is passing UserMode or KernelMode for the AccessMode parameter, instead of using Irp->RequestorMode. This warning can be ignored or suppressed for drivers that are not the top-level driver."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"tags" : [ "correctness" ],
"description" : "In a dispatch routine call to ObReferenceObjectByHandle or ObReferenceObjectByPointer, the driver is passing UserMode or KernelMode for the AccessMode parameter, instead of using Irp->RequestorMode. This warning can be ignored or suppressed for drivers that are not the top-level driver.",
"feature.area" : "Multiple",
"id" : "cpp/windows/drivers/queries/ob-reference-mode",
"kind" : "problem",
"name" : "The AccessMode parameter to ObReferenceObject* should be IRP->RequestorMode (C28126)",
"platform" : "Desktop",
"precision" : "high",
"problem.severity" : "warning",
"query-version" : "v1",
"repro.text" : "The driver did not pass Irp->RequestorMode to a call to ObReferenceObjectByHandle or ObReferenceObjectByPointer.",
"security.severity" : "Low"
}
}, {
"id" : "cpp/windows/drivers/queries/opaquemdluse",
"name" : "cpp/windows/drivers/queries/opaquemdluse",
"shortDescription" : {
"text" : "Direct access of opaque MDL field"
},
"fullDescription" : {
"text" : "Direct access of opaque MDL fields should be avoided, as opaque struct layouts may change without warning."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"tags" : [ "correctness" ],
"description" : "Direct access of opaque MDL fields should be avoided, as opaque struct layouts may change without warning.",
"feature.area" : "Multiple",
"id" : "cpp/windows/drivers/queries/opaquemdluse",
"kind" : "problem",
"name" : "Direct access of opaque MDL field",
"platform" : "Desktop",
"precision" : "high",
"problem.severity" : "warning",
"query-version" : "v1",
"repro.text" : "The following code locations directly access an opaque MDL field."
}
}, {
"id" : "cpp/windows/drivers/queries/opaquemdlwrite",
"name" : "cpp/windows/drivers/queries/opaquemdlwrite",
"shortDescription" : {
"text" : "Write to opaque MDL field (C28145)"
},
"fullDescription" : {
"text" : "Opaque MDL fields should not be written to. This is a port of Code Analysis check C28145."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "error"
},
"properties" : {
"tags" : [ "correctness" ],
"description" : "Opaque MDL fields should not be written to. This is a port of Code Analysis check C28145.",
"feature.area" : "Multiple",
"id" : "cpp/windows/drivers/queries/opaquemdlwrite",
"kind" : "problem",
"name" : "Write to opaque MDL field (C28145)",
"platform" : "Desktop",
"precision" : "high",
"problem.severity" : "error",
"query-version" : "v1",
"repro.text" : "The following code locations directly write to an opaque MDL filed."
}
}, {
"id" : "cpp/portedqueries/pending-status-error",
"name" : "cpp/portedqueries/pending-status-error",
"shortDescription" : {
"text" : "PendingStatusError"
},
"fullDescription" : {
"text" : "A dispatch routine that calls IoMarkIrpPending includes at least one path in which the driver returns a value other than STATUS_PENDING. The IoMarkIrpPending routine marks the specified IRP, indicating that a driver's dispatch routine subsequently returned STATUS_PENDING because further processing is required by other driver routines. For more information please refer C28143 Code Analysis rule."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "error"
},
"properties" : {
"description" : "A dispatch routine that calls IoMarkIrpPending includes at least one path in which the driver returns a value other than STATUS_PENDING. The IoMarkIrpPending routine marks the specified IRP, indicating that a driver's dispatch routine subsequently returned STATUS_PENDING because further processing is required by other driver routines. For more information please refer C28143 Code Analysis rule.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/pending-status-error",
"kind" : "problem",
"name" : "PendingStatusError",
"platform" : "Desktop",
"problem.severity" : "error",
"repro.text" : "The following code locations potentially contain IoMarkIrpPending calls that do not return STATUS_PENDING",
"version" : "1.0"
}
}, {
"id" : "cpp/portedqueries/wrong-dispatch-table-assignment",
"name" : "cpp/portedqueries/wrong-dispatch-table-assignment",
"shortDescription" : {
"text" : "WrongDispatchTableAssignment"
},
"fullDescription" : {
"text" : "The dispatch table assignment satisfies either of these 3 scenarios: 1) The dispatch table assignment has a function whose type is not DRIVER_DISPATCH, or 2) The dispatch table assignment has a DRIVER_DISPATCH function at its right-hand side but the function doesn't have a driver dispatch type annotation, or 3) The dispatch function satisfies both of the above conditions but its dispatch type doesn't match the expected type for the dispatch table entry."
},
"defaultConfiguration" : {
"enabled" : true,
"level" : "warning"
},
"properties" : {
"description" : "The dispatch table assignment satisfies either of these 3 scenarios: 1) The dispatch table assignment has a function whose type is not DRIVER_DISPATCH, or 2) The dispatch table assignment has a DRIVER_DISPATCH function at its right-hand side but the function doesn't have a driver dispatch type annotation, or 3) The dispatch function satisfies both of the above conditions but its dispatch type doesn't match the expected type for the dispatch table entry.",
"feature.area" : "Multiple",
"id" : "cpp/portedqueries/wrong-dispatch-table-assignment",
"kind" : "problem",
"name" : "WrongDispatchTableAssignment",
"platform" : "Desktop",
"problem.severity" : "warning",
"repro.text" : "The following lines of code may potentially contain incorrect assignment to dispatch table entry.",
"version" : "1.0"
}
} ]
},
"extensions" : [ {
"name" : "legacy-upgrades",
"semanticVersion" : "0.0.0",
"locations" : [ {
"uri" : "file:///C:/codeql-211/codeql/legacy-upgrades/",
"description" : {
"text" : "The QL pack root directory."
}
}, {
"uri" : "file:///C:/codeql-211/codeql/legacy-upgrades/qlpack.yml",
"description" : {
"text" : "The QL pack definition file."
}
} ]
}, {
"name" : "microsoft/windows-drivers",
"semanticVersion" : "0.1.0+a80ca6714fab721c084f96e6ac910856124ae8a5",
"locations" : [ {
"uri" : "file:///C:/codeql-211/Windows-Driver-Developer-Supplemental-Tools/src/",
"description" : {
"text" : "The QL pack root directory."
}
}, {
"uri" : "file:///C:/codeql-211/Windows-Driver-Developer-Supplemental-Tools/src/qlpack.yml",
"description" : {
"text" : "The QL pack definition file."
}
} ]
} ]
},
"results" : [ ],
"columnKind" : "utf16CodeUnits",
"properties" : {
"semmle.formatSpecifier" : "sarif-latest"
}
} ]
}