hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 04:06:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: stop rb/sensitive-get-query from considering ID type data as sensitive

Browse Source
This commit is contained in:
Alex Ford
2022-09-16 15:36:57 +01:00
parent 79ad7d293f
commit 08c8db8937
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ruby/ql/src/queries/security/cwe-598/SensitiveGetQuery.ql
View File

@@ -38,6 +38,7 @@ from
where where
handler.getAnHttpMethod() = "get" and handler.getAnHttpMethod() = "get" and
input.asExpr().getExpr().getEnclosingMethod() = handler and input.asExpr().getExpr().getEnclosingMethod() = handler and
localFlowWithElementReference(input, sensitive) localFlowWithElementReference(input, sensitive) and
not sensitive.getClassification() = SensitiveDataClassification::id()
select input, "$@ for GET requests uses query parameter as sensitive data.", handler, select input, "$@ for GET requests uses query parameter as sensitive data.", handler,
"Route handler" "Route handler"

1
ruby/ql/test/query-tests/security/cwe-598/SensitiveGetQuery.expected
View File

@@ -1,2 +1 @@
| app/controllers/users_controller.rb:4:16:4:21 | call to params | $@ for GET requests uses query parameter as sensitive data. | app/controllers/users_controller.rb:3:3:6:5 | login_get | Route handler | | app/controllers/users_controller.rb:4:16:4:21 | call to params | $@ for GET requests uses query parameter as sensitive data. | app/controllers/users_controller.rb:3:3:6:5 | login_get | Route handler |
| app/controllers/users_controller.rb:5:23:5:28 | call to params | $@ for GET requests uses query parameter as sensitive data. | app/controllers/users_controller.rb:3:3:6:5 | login_get | Route handler |

4
ruby/ql/test/query-tests/security/cwe-598/app/controllers/users_controller.rb
View File

@@ -2,12 +2,12 @@ class UsersController < ApplicationController
def login_get def login_get
password = params[:password] # BAD: route handler uses GET query parameters to receive sensitive data password = params[:password] # BAD: route handler uses GET query parameters to receive sensitive data
authenticate_user(params[:username], password) # BAD: route handler uses GET query parameters to receive sensitive data authenticate_user(params[:username], password)
end end
def login_post def login_post
password = params[:password] # GOOD: handler uses POST form parameters to receive sensitive data password = params[:password] # GOOD: handler uses POST form parameters to receive sensitive data
authenticate_user(params[:username], password) # GOOD: handler uses POST form parameters to receive sensitive data authenticate_user(params[:username], password)
end end
private private