cpp: model BDE bdlbb::Blob byte-buffer taint flow

[anurag6569201]

Add flow summaries for the BDE segmented byte buffer BloombergLP::bdlbb::Blob so taint reaches a blob's payload bytes:

• Accessor chain: Blob::buffer taints the returned BlobBuffer, and BlobBuffer::data/buffer taint the bytes.
• bdlbb::BlobUtil::copy and getContiguousRangeOrCopy propagate taint between a blob and a flat buffer in both directions.

This unblocks blob-carried sources such as bmqa::Message::getData, whose payload was previously stranded on the opaque Blob object. Not a duplicate; the bdlbb namespace had no coverage. Verified with a BloombergLP::bdlbb-shaped stub in the dataflow external-models harness.

Source merge-base: b756a08cf59743b7e8483622202440e012a90662
Source head: 9559357bc637f7d5531aeb3152ec472fb61aa3f3

[shipwright-agent]

✅ Shipwright · Approve

Recommendation: approve PR #13 · Tier T2
Checks: 0 total · 0 needing attention

Next step: ready to merge.

Findings (6)

• HIGH The model file uses empty signatures for Blob::buffer, BlobBuffer::data, BlobBuffer::buffer, and getContiguousRangeOrCopy. · cpp/ql/lib/ext/bdlbb.model.yml:8
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The model for BlobUtil::getContiguousRangeOrCopy has two entries with the same empty signature, one mapping Argument[*1] to Argument[*0] and one mapping Argument[*1] to ReturnValue · cpp/ql/lib/ext/bdlbb.model.yml:13
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The BlobUtil::copy overload taking (char *,const Blob &,int,int) is modeled as Argument[*1] -> Argument[*0] with no length or position constraints. · cpp/ql/lib/ext/bdlbb.model.yml:12
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The model marks BlobUtil::copy(Blob *,int,const char *,int) as Argument[*2] -> Argument[*0] with no sanitization or length validation. · cpp/ql/lib/ext/bdlbb.model.yml:16
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• LOW The test stubs declare BlobBuffer::buffer() returning bsl::shared_ptr<char>&, but the model comment says the get() step comes from the built-in smart pointer model. · cpp/ql/test/library-tests/dataflow/external-models/bdlbb.cpp:70
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• LOW The validatemodels output now contains three new 'Dubious signature' warnings for the BlobUtil signatures. · cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected:373
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Fireworks usage: 18,913 input · 735 output · 19,648 total tokens · $0.0046 · 13s · 0 fix iteration(s)

Open the Shipwright check for full evidence and the audit bundle. Use /shipwright rerun to verify again.

[shipwright-agent]

Shipwright · HIGH

The model file uses empty signatures for Blob::buffer, BlobBuffer::data, BlobBuffer::buffer, and getContiguousRangeOrCopy.

Impact: The model file uses empty signatures for Blob::buffer, BlobBuffer::data, BlobBuffer::buffer, and getContiguousRangeOrCopy. This makes the model match any overload or future overload with the same name, and gives a reader no way to tell which API surface is actually covered without cross-referencing the test stubs.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · HIGH

The model for BlobUtil::getContiguousRangeOrCopy has two entries with the same empty signature, one mapping Argument[*1] to Argument[*0] and one mapping Argument[*1] to ReturnValue

Impact: The model for BlobUtil::getContiguousRangeOrCopy has two entries with the same empty signature, one mapping Argument[*1] to Argument[*0] and one mapping Argument[1] to ReturnValue[]. If the real function returns a pointer into the blob when the buffer is contiguous and copies into dstBuffer otherwise, the unconditional Argument[*1] -> Argument[*0] summary will propagate taint to dstBuffer even when the function…

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · HIGH

The BlobUtil::copy overload taking (char *,const Blob &,int,int) is modeled as Argument[*1] -> Argument[*0] with no length or position constraints.

Impact: The BlobUtil::copy overload taking (char *,const Blob &,int,int) is modeled as Argument[*1] -> Argument[*0] with no length or position constraints. A caller that copies only a zero-length or out-of-range slice will still have the entire destination buffer marked tainted, which can create misleading flows in code that partially initializes a buffer.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · HIGH

The model marks BlobUtil::copy(Blob *,int,const char *,int) as Argument[*2] -> Argument[*0] with no sanitization or length validation.

Impact: The model marks BlobUtil::copy(Blob *,int,const char *,int) as Argument[*2] -> Argument[*0] with no sanitization or length validation. This treats any caller-supplied source buffer as fully tainted into the destination blob, which is appropriate for taint tracking but will flag every write path, including internal buffer initialization, as attacker-controlled unless downstream models add sanitizers.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · LOW

The test stubs declare BlobBuffer::buffer() returning bsl::shared_ptr<char>&, but the model comment says the get() step comes from the built-in smart pointer model.

Impact: The test stubs declare BlobBuffer::buffer() returning bsl::shared_ptr<char>&, but the model comment says the get() step comes from the built-in smart pointer model. A new contributor cannot tell from the test file alone why the shared_ptr path is expected to work or whether the non-const overload is intentionally covered.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · LOW

The validatemodels output now contains three new 'Dubious signature' warnings for the BlobUtil signatures.

Impact: The validatemodels output now contains three new 'Dubious signature' warnings for the BlobUtil signatures. These are expected for abbreviated C++ signatures, but they add noise to the validation baseline and should be acknowledged or suppressed so future real signature errors are not lost among expected warnings.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.