hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: improve non-constant-kernel-open, no FP's on open without arguments

Browse Source
This commit is contained in:
Peter Stöckli
2023-04-18 10:10:36 +02:00
parent 99ad43b21e
commit 0a6bb3f7ce
3 changed files with 20 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ruby/ql/src/queries/security/cwe-078/NonConstantKernelOpen.ql
View File

@@ -21,6 +21,7 @@ import codeql.ruby.ApiGraphs
from AmbiguousPathCall call
where
call.getNumberOfArguments() > 0 and
not hasConstantPrefix(call.getPathArgument().getALocalSource().asExpr().getExpr()) and
not call.getPathArgument().getALocalSource() =
API::getTopLevelMember("File").getAMethodCall("join")

22
ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.expected
View File

@@ -1,11 +1,11 @@
| NonConstantKernelOpen.rb:4:5:4:14 | call to open | Call to Kernel.open with a non-constant value. Consider replacing it with File.open. |
| NonConstantKernelOpen.rb:5:5:5:17 | call to read | Call to IO.read with a non-constant value. Consider replacing it with File.read. |
| NonConstantKernelOpen.rb:6:5:6:18 | call to write | Call to IO.write with a non-constant value. Consider replacing it with File.write. |
| NonConstantKernelOpen.rb:7:5:7:20 | call to binread | Call to IO.binread with a non-constant value. Consider replacing it with File.binread. |
| NonConstantKernelOpen.rb:8:5:8:21 | call to binwrite | Call to IO.binwrite with a non-constant value. Consider replacing it with File.binwrite. |
| NonConstantKernelOpen.rb:9:5:9:20 | call to foreach | Call to IO.foreach with a non-constant value. Consider replacing it with File.foreach. |
| NonConstantKernelOpen.rb:10:5:10:22 | call to readlines | Call to IO.readlines with a non-constant value. Consider replacing it with File.readlines. |
| NonConstantKernelOpen.rb:11:5:11:18 | call to open | Call to URI.open with a non-constant value. Consider replacing it with URI(<uri>).open. |
| NonConstantKernelOpen.rb:15:5:15:21 | call to open | Call to Kernel.open with a non-constant value. Consider replacing it with File.open. |
| NonConstantKernelOpen.rb:25:5:25:33 | call to open | Call to Kernel.open with a non-constant value. Consider replacing it with File.open. |
| NonConstantKernelOpen.rb:33:5:33:14 | call to open | Call to Kernel.open with a non-constant value. Consider replacing it with File.open. |
| NonConstantKernelOpen.rb:6:5:6:14 | call to open | Call to Kernel.open with a non-constant value. Consider replacing it with File.open. |
| NonConstantKernelOpen.rb:7:5:7:17 | call to read | Call to IO.read with a non-constant value. Consider replacing it with File.read. |
| NonConstantKernelOpen.rb:8:5:8:18 | call to write | Call to IO.write with a non-constant value. Consider replacing it with File.write. |
| NonConstantKernelOpen.rb:9:5:9:20 | call to binread | Call to IO.binread with a non-constant value. Consider replacing it with File.binread. |
| NonConstantKernelOpen.rb:10:5:10:21 | call to binwrite | Call to IO.binwrite with a non-constant value. Consider replacing it with File.binwrite. |
| NonConstantKernelOpen.rb:11:5:11:20 | call to foreach | Call to IO.foreach with a non-constant value. Consider replacing it with File.foreach. |
| NonConstantKernelOpen.rb:12:5:12:22 | call to readlines | Call to IO.readlines with a non-constant value. Consider replacing it with File.readlines. |
| NonConstantKernelOpen.rb:13:5:13:18 | call to open | Call to URI.open with a non-constant value. Consider replacing it with URI(<uri>).open. |
| NonConstantKernelOpen.rb:17:5:17:21 | call to open | Call to Kernel.open with a non-constant value. Consider replacing it with File.open. |
| NonConstantKernelOpen.rb:27:5:27:33 | call to open | Call to Kernel.open with a non-constant value. Consider replacing it with File.open. |
| NonConstantKernelOpen.rb:41:5:41:14 | call to open | Call to Kernel.open with a non-constant value. Consider replacing it with File.open. |

8
ruby/ql/test/query-tests/security/cwe-078/NonConstantKernelOpen/NonConstantKernelOpen.rb
View File

@@ -1,4 +1,6 @@
class UsersController < ActionController::Base
CONSTANT = "constant"
def create
file = params[:file]
open(file) # BAD
@@ -30,6 +32,12 @@ class UsersController < ActionController::Base
IO.write(File.join("foo", "bar.txt"), "bar") # GOOD
IO.read(CONSTANT) # GOOD
IO.read(CONSTANT + file) # GOOD
open.where(external: false) # GOOD - an open method is called withoout arguments
open(file) # BAD - sanity check to verify that file was not mistakenly marked as sanitized
end
end