Detect String Encoding type with CodeQL after String extraction

[samstack6]

Hello there!

I want to know is there any specific way to detect if a extracted string with codeql has a specific type of encoding?

For example :

We're collecting a string from a function in C/C++ :
if (strcmp(str1, "ENCODED_BASE64_STRING"))

the collected string is : "ENCODED_BASE64_STRING" .Is there anyway to detect if this string is Base64 Encoded on the fly by CodeQL and it's not of any other Encoding type?

Any support for this?

Thanks

[MathiasVP]

Hi @samstack6,

Do you mean if we have a predicate for checking whether a string looks like it's Base64 encoded? i.e., so you can write:

from string s
where /* ... */ and isBase64(s)
select s

If that's your question, then the answer is no. But it sounds like a fun challenge to try implementing such a predicate!

[samstack6]

Hi @MathiasVP .

Thanks for the reply.

The actual thing here is, while I'm extracting the strings, I should detect their encoding types on the fly to put them into their order .

For example, I should save the strings by their types, I can not formally just save every string, I should save md5, base64, XOR, different UTFs by their types and all these extracted strings are applicable by their types .

So my codeql stuff is getting hard here.

Isn't such isBase64(s) thing available by now in CodeQL ?

Thanks!

[MathiasVP]

Isn't such isBase64(s) thing available by now in CodeQL ?

As far as I know we've never had a use-case for it. I imagine you can write a regex for it. I found this one here:

^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$

You can use this in CodeQL like this:

/** Holds if `s` is a string that looks like a base64 encoding. */
bindingset[s]
predicate isBase64(string s) {
  s.regexpMatch("(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?")
}

from string s
where s = "aGVsbG8gd29ybGQ=" and isBase64(s)
select s

Note the use of bindingset because regexpMatch doesn't bind the string. You can read more about these annotations here. Does that help answer your question?

[github-actions]

This issue is stale because it has been open 14 days with no activity. Comment or remove the stale label in order to avoid having this issue closed in 7 days.