Skip to content

Conversation

@MathiasVP
Copy link
Contributor

This PR adds remote flow sources for two C/C++ APIs:

Commit-by-commit review recommended. Most of the code is just adding stubs for various APIs.

@MathiasVP MathiasVP requested a review from a team as a code owner February 3, 2026 11:35
Copilot AI review requested due to automatic review settings February 3, 2026 11:35
@github-actions github-actions bot added the C++ label Feb 3, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request adds remote flow sources for two C/C++ APIs: the Win32 WinHTTP library and the Azure C/C++ SDK. These additions enable CodeQL to track data flowing from HTTP responses through these APIs as potential security-relevant remote data sources.

Changes:

  • Added WinHttp.qll implementation file with taint-inheriting content classes for WinHTTP data structures
  • Added model definitions for WinHTTP functions (WinHttpReadData, WinHttpQueryHeaders, WinHttpCrackUrl, etc.) and Azure SDK classes (RawResponse, Request, BodyStream, etc.)
  • Added comprehensive test coverage for both WinHTTP and Azure SDK APIs with expected results

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
cpp/ql/lib/semmle/code/cpp/models/implementations/WinHttp.qll Defines QL classes for WinHTTP structures and taint-inheriting content handling
cpp/ql/lib/semmle/code/cpp/models/Models.qll Imports the new WinHttp implementation
cpp/ql/lib/ext/Windows.model.yml Adds source and summary models for WinHTTP API functions
cpp/ql/lib/ext/azure.core.model.yml Adds source and summary models for Azure SDK HTTP and IO classes
cpp/ql/test/library-tests/dataflow/external-models/windows.cpp Adds test cases for WinHTTP functions with function declarations and test code
cpp/ql/test/library-tests/dataflow/external-models/azure.cpp Adds test cases for Azure SDK classes with stubs and test code
cpp/ql/test/library-tests/dataflow/external-models/*.expected Updates test expectations to reflect new sources, steps, and flow patterns
Comments suppressed due to low confidence (1)

cpp/ql/lib/semmle/code/cpp/models/implementations/WinHttp.qll:10

  • The comment says "classes" but should be "class" since WINHTTP_EXTENDED_HEADER is a single class/struct type.
/** The `WINHTTP_EXTENDED_HEADER` classes from `winhttp.h`. */

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant