hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Simple tests passing

Browse Source
This commit is contained in:
thiggy1342
2022-05-28 23:29:58 +00:00
committed by GitHub
parent 39baadbdd2
commit 09f082081f
2 changed files with 23 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ruby/ql/test/query-tests/security/decompression-api/DecompressionAPI.expected
View File

@@ -0,0 +1,12 @@
edges
| decompression_api.rb:3:31:3:36 | call to params : | decompression_api.rb:3:31:3:43 | ...[...] |
| decompression_api.rb:12:35:12:40 | call to params : | decompression_api.rb:12:35:12:47 | ...[...] |
nodes
| decompression_api.rb:3:31:3:36 | call to params : | semmle.label | call to params : |
| decompression_api.rb:3:31:3:43 | ...[...] | semmle.label | ...[...] |
| decompression_api.rb:12:35:12:40 | call to params : | semmle.label | call to params : |
| decompression_api.rb:12:35:12:47 | ...[...] | semmle.label | ...[...] |
subpaths
#select
| decompression_api.rb:3:31:3:43 | ...[...] | decompression_api.rb:3:31:3:36 | call to params : | decompression_api.rb:3:31:3:43 | ...[...] | This call to $@ is unsafe because user-controlled data is used to set the object being decompressed, which could lead to a denial of service attack or malicious code extracted from an unknown source. |
| decompression_api.rb:12:35:12:47 | ...[...] | decompression_api.rb:12:35:12:40 | call to params : | decompression_api.rb:12:35:12:47 | ...[...] | This call to $@ is unsafe because user-controlled data is used to set the object being decompressed, which could lead to a denial of service attack or malicious code extracted from an unknown source. |

17
ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb
View File

@@ -1,11 +1,16 @@
class TestController < ActionController::Base
def unsafe_unzip
TestModel::unzip(params[:path])
def unsafe_zlib_unzip
Zlib::Inflate.inflate(params[:path])
end
end
class TestModel
def unzip(filename)
Zlib::Inflate.inflate(filename)
def safe_zlib_unzip
Zlib::Inflate.inflate("testfile.gz")
end
def sanitized_zlib_unzip
if params[:path].in ["safe_file1.gz", "safe_file2.gz"]
Zlib::Inflate.inflate(params[:path])
end
end
end