Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 31 additions & 9 deletions src/main.rs
Original file line number Diff line number Diff line change
Expand Up @@ -3,35 +3,57 @@
use defs::myMacro;
use reqwest;

fn my_function() {
println!("Hello from my_function.");
}

// conditional compilation
#[cfg(false)]
fn not_compiled_function() {
println!("Hello from not_compiled_function.");
my_function();
my_function();
my_function();
my_function();
my_function();
myMacro!();
myMacro!();
myMacro!();
myMacro!();
myMacro!();
}

fn main() {
// use some macros
println!("Hello, world!");
println!("Hello from main.");
my_function();
myMacro!();

Check failure

Code scanning / CodeQL

Uncontrolled allocation size High

This allocation size is derived from a
user-provided value
and could allocate arbitrary amounts of memory.

// cleartext logging
let password = "123456";
println!("logging in (password is: {password})");
let password2 = "123456";
println!("logging in (password is: {password2})");

Check failure

Code scanning / CodeQL

Cleartext logging of sensitive information High

This operation writes
password2
to a log file.

// use of HTTP
let page_data = reqwest::blocking::get("http://example.com/").unwrap().text().unwrap();
let page_data = reqwest::blocking::get("http://example.com/2/").unwrap().text().unwrap();

Check failure

Code scanning / CodeQL

Failure to use HTTPS URLs High

This URL may be constructed with the HTTP protocol, from
this HTTP URL
.
println!("web data = {page_data}");

// weak hashing
let digest = format!("{:x}", md5::compute(password));
let digest = format!("{:x}", md5::compute(password2));

Check failure

Code scanning / CodeQL

Use of a broken or weak cryptographic hashing algorithm on sensitive data High

Sensitive data (password)
is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function.
println!("digest = {digest}");

// uncontrolled allocation size
let size = page_data.parse::<usize>().unwrap_or(1024);
println!("size = {size}");
let layout = std::alloc::Layout::from_size_align(size, 1).unwrap();
let layout = std::alloc::Layout::from_size_align(size + 2, 1).unwrap();

unsafe {
let ptr = std::alloc::alloc(layout);

// access after deallocation
std::alloc::dealloc(ptr, layout);

let data = *ptr;
println!("data = {data}");
let data2 = *ptr;

Check failure

Code scanning / CodeQL

Access of invalid pointer High

This operation dereferences a pointer that may be
invalid
.
println!("data2 = {data2}");
}

println!("end.");
}