diff --git a/java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.qhelp b/java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.qhelp index ea9c6ed244e..995d4caa4c1 100644 --- a/java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.qhelp +++ b/java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.qhelp @@ -5,34 +5,32 @@

- A regexp range can by accident match more than was intended. - For example, the regular expression /[a-zA-z]/ will - match every lowercase and uppercase letters, but the same regular - expression will also match the chars: [\]^_`. + It's easy to write a regular expression range that matches a wider range of characters than you intended. + For example, /[a-zA-z]/ matches all lowercase and all uppercase letters, + as you would expect, but it also matches the characters: [ \ ] ^ _ `.

- On other occasions it can happen that the dash in a regular - expression is not escaped, which will cause it to be interpreted - as part of a range. For example in the character class [a-zA-Z0-9%=.,-_] + Another common problem is failing to escape the dash character in a regular + expression. An unescaped dash is interpreted + as part of a range. For example, in the character class [a-zA-Z0-9%=.,-_] the last character range matches the 55 characters between , and _ (both included), which overlaps with the - range [0-9] and is thus clearly not intended. + range [0-9] and is clearly not intended by the writer.

- - Don't write character ranges were there might be confusion as to - which characters are included in the range. - + Avoid any confusion about which characters are included in the range by + writing unambiguous regular expressions. + Always check that character ranges match only the expected characters.

- The following example code checks whether a string is a valid 6 digit hex color. + The following example code is intended to check whether a string is a valid 6 digit hex color.

@@ -45,8 +43,8 @@ public class Tester {

- However, the A-f range matches every uppercase character, and - thus a "color" like #XYZ is considered valid. + However, the A-f range is overly large and matches every uppercase character. + It would parse a "color" like #XXYYZZ as valid.

@@ -65,10 +63,9 @@ public class Tester { -

  • Mitre.org: CWE-020
  • -
  • github.com: CVE-2021-42740
  • +
  • GitHub Advisory Database: CVE-2021-42740: Improper Neutralization of Special Elements used in a Command in Shell-quote
  • wh0.github.io: Exploiting CVE-2021-42740
  • -
  • ota-meshi.github.io: no-obscure-range
  • -
  • pboyd.io: The regex [,-.]
  • +
  • Yosuke Ota: no-obscure-range
  • +
  • Paul Boyd: The regex [,-.]
  • diff --git a/java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.ql b/java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.ql index 3ff999e20ba..d054659892c 100644 --- a/java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.ql +++ b/java/ql/src/Security/CWE/CWE-020/OverlyLargeRange.ql @@ -1,6 +1,6 @@ /** - * @name Overly large regular expression range - * @description Overly permissive regular expression ranges may cause regular expressions to match more than anticipated. + * @name Overly permissive regular expression range + * @description Overly permissive regular expression ranges match a wider range of characters than intended. * This may allow an attacker to bypass a filter or sanitizer. * @kind problem * @problem.severity warning diff --git a/javascript/ql/src/Security/CWE-020/OverlyLargeRange.qhelp b/javascript/ql/src/Security/CWE-020/OverlyLargeRange.qhelp index 41e0963e28a..c80d720df69 100644 --- a/javascript/ql/src/Security/CWE-020/OverlyLargeRange.qhelp +++ b/javascript/ql/src/Security/CWE-020/OverlyLargeRange.qhelp @@ -5,34 +5,32 @@

    - A regexp range can by accident match more than was intended. - For example, the regular expression /[a-zA-z]/ will - match every lowercase and uppercase letters, but the same regular - expression will also match the chars: [\]^_`. + It's easy to write a regular expression range that matches a wider range of characters than you intended. + For example, /[a-zA-z]/ matches all lowercase and all uppercase letters, + as you would expect, but it also matches the characters: [ \ ] ^ _ `.

    - On other occasions it can happen that the dash in a regular - expression is not escaped, which will cause it to be interpreted - as part of a range. For example in the character class [a-zA-Z0-9%=.,-_] + Another common problem is failing to escape the dash character in a regular + expression. An unescaped dash is interpreted + as part of a range. For example, in the character class [a-zA-Z0-9%=.,-_] the last character range matches the 55 characters between , and _ (both included), which overlaps with the - range [0-9] and is thus clearly not intended. + range [0-9] and is clearly not intended by the writer.

    - - Don't write character ranges were there might be confusion as to - which characters are included in the range. - + Avoid any confusion about which characters are included in the range by + writing unambiguous regular expressions. + Always check that character ranges match only the expected characters.

    - The following example code checks whether a string is a valid 6 digit hex color. + The following example code is intended to check whether a string is a valid 6 digit hex color.

    @@ -42,8 +40,8 @@ function isValidHexColor(color) {

    - However, the A-f range matches every uppercase character, and - thus a "color" like #XYZ is considered valid. + However, the A-f range is overly large and matches every uppercase character. + It would parse a "color" like #XXYYZZ as valid.

    @@ -59,10 +57,9 @@ function isValidHexColor(color) { -

  • Mitre.org: CWE-020
  • -
  • github.com: CVE-2021-42740
  • +
  • GitHub Advisory Database: CVE-2021-42740: Improper Neutralization of Special Elements used in a Command in Shell-quote
  • wh0.github.io: Exploiting CVE-2021-42740
  • -
  • ota-meshi.github.io: no-obscure-range
  • -
  • pboyd.io: The regex [,-.]
  • +
  • Yosuke Ota: no-obscure-range
  • +
  • Paul Boyd: The regex [,-.]
  • diff --git a/javascript/ql/src/Security/CWE-020/OverlyLargeRange.ql b/javascript/ql/src/Security/CWE-020/OverlyLargeRange.ql index e67ac672488..77cf0044a34 100644 --- a/javascript/ql/src/Security/CWE-020/OverlyLargeRange.ql +++ b/javascript/ql/src/Security/CWE-020/OverlyLargeRange.ql @@ -1,6 +1,6 @@ /** - * @name Overly large regular expression range - * @description Overly permissive regular expression ranges may cause regular expressions to match more than anticipated. + * @name Overly permissive regular expression range + * @description Overly permissive regular expression ranges match a wider range of characters than intended. * This may allow an attacker to bypass a filter or sanitizer. * @kind problem * @problem.severity warning diff --git a/python/ql/src/Security/CWE-020/OverlyLargeRange.qhelp b/python/ql/src/Security/CWE-020/OverlyLargeRange.qhelp index cebee9d8ba4..f63679f4119 100644 --- a/python/ql/src/Security/CWE-020/OverlyLargeRange.qhelp +++ b/python/ql/src/Security/CWE-020/OverlyLargeRange.qhelp @@ -5,34 +5,32 @@

    - A regexp range can by accident match more than was intended. - For example, the regular expression /[a-zA-z]/ will - match every lowercase and uppercase letters, but the same regular - expression will also match the chars: [\]^_`. + It's easy to write a regular expression range that matches a wider range of characters than you intended. + For example, /[a-zA-z]/ matches all lowercase and all uppercase letters, + as you would expect, but it also matches the characters: [ \ ] ^ _ `.

    - On other occasions it can happen that the dash in a regular - expression is not escaped, which will cause it to be interpreted - as part of a range. For example in the character class [a-zA-Z0-9%=.,-_] + Another common problem is failing to escape the dash character in a regular + expression. An unescaped dash is interpreted + as part of a range. For example, in the character class [a-zA-Z0-9%=.,-_] the last character range matches the 55 characters between , and _ (both included), which overlaps with the - range [0-9] and is thus clearly not intended. + range [0-9] and is clearly not intended by the writer.

    - - Don't write character ranges were there might be confusion as to - which characters are included in the range. - + Avoid any confusion about which characters are included in the range by + writing unambiguous regular expressions. + Always check that character ranges match only the expected characters.

    - The following example code checks whether a string is a valid 6 digit hex color. + The following example code is intended to check whether a string is a valid 6 digit hex color.

    @@ -42,8 +40,8 @@ def is_valid_hex_color(color):

    - However, the A-f range matches every uppercase character, and - thus a "color" like #XYZ is considered valid. + However, the A-f range is overly large and matches every uppercase character. + It would parse a "color" like #XXYYZZ as valid.

    @@ -59,10 +57,9 @@ def is_valid_hex_color(color): -

  • Mitre.org: CWE-020
  • -
  • github.com: CVE-2021-42740
  • +
  • GitHub Advisory Database: CVE-2021-42740: Improper Neutralization of Special Elements used in a Command in Shell-quote
  • wh0.github.io: Exploiting CVE-2021-42740
  • -
  • ota-meshi.github.io: no-obscure-range
  • -
  • pboyd.io: The regex [,-.]
  • +
  • Yosuke Ota: no-obscure-range
  • +
  • Paul Boyd: The regex [,-.]
  • diff --git a/python/ql/src/Security/CWE-020/OverlyLargeRange.ql b/python/ql/src/Security/CWE-020/OverlyLargeRange.ql index 2535999d4bc..b4d2caf5e80 100644 --- a/python/ql/src/Security/CWE-020/OverlyLargeRange.ql +++ b/python/ql/src/Security/CWE-020/OverlyLargeRange.ql @@ -1,6 +1,6 @@ /** - * @name Overly large regular expression range - * @description Overly permissive regular expression ranges may cause regular expressions to match more than anticipated. + * @name Overly permissive regular expression range + * @description Overly permissive regular expression ranges match a wider range of characters than intended. * This may allow an attacker to bypass a filter or sanitizer. * @kind problem * @problem.severity warning diff --git a/ruby/ql/src/queries/security/cwe-020/OverlyLargeRange.qhelp b/ruby/ql/src/queries/security/cwe-020/OverlyLargeRange.qhelp index 9ea2871ff04..ba5d4b95532 100644 --- a/ruby/ql/src/queries/security/cwe-020/OverlyLargeRange.qhelp +++ b/ruby/ql/src/queries/security/cwe-020/OverlyLargeRange.qhelp @@ -5,34 +5,32 @@

    - A regexp range can by accident match more than was intended. - For example, the regular expression /[a-zA-z]/ will - match every lowercase and uppercase letters, but the same regular - expression will also match the chars: [\]^_`. + It's easy to write a regular expression range that matches a wider range of characters than you intended. + For example, /[a-zA-z]/ matches all lowercase and all uppercase letters, + as you would expect, but it also matches the characters: [ \ ] ^ _ `.

    - On other occasions it can happen that the dash in a regular - expression is not escaped, which will cause it to be interpreted - as part of a range. For example in the character class [a-zA-Z0-9%=.,-_] + Another common problem is failing to escape the dash character in a regular + expression. An unescaped dash is interpreted + as part of a range. For example, in the character class [a-zA-Z0-9%=.,-_] the last character range matches the 55 characters between , and _ (both included), which overlaps with the - range [0-9] and is thus clearly not intended. + range [0-9] and is clearly not intended by the writer.

    - - Don't write character ranges were there might be confusion as to - which characters are included in the range. - + Avoid any confusion about which characters are included in the range by + writing unambiguous regular expressions. + Always check that character ranges match only the expected characters.

    - The following example code checks whether a string is a valid 6 digit hex color. + The following example code is intended to check whether a string is a valid 6 digit hex color.

    @@ -42,8 +40,8 @@ end

    - However, the A-f range matches every uppercase character, and - thus a "color" like #XYZ is considered valid. + However, the A-f range is overly large and matches every uppercase character. + It would parse a "color" like #XXYYZZ as valid.

    @@ -59,10 +57,9 @@ end -

  • Mitre.org: CWE-020
  • -
  • github.com: CVE-2021-42740
  • +
  • GitHub Advisory Database: CVE-2021-42740: Improper Neutralization of Special Elements used in a Command in Shell-quote
  • wh0.github.io: Exploiting CVE-2021-42740
  • -
  • ota-meshi.github.io: no-obscure-range
  • -
  • pboyd.io: The regex [,-.]
  • +
  • Yosuke Ota: no-obscure-range
  • +
  • Paul Boyd: The regex [,-.]
  • diff --git a/ruby/ql/src/queries/security/cwe-020/OverlyLargeRange.ql b/ruby/ql/src/queries/security/cwe-020/OverlyLargeRange.ql index feebc0591f8..4258ddeda5e 100644 --- a/ruby/ql/src/queries/security/cwe-020/OverlyLargeRange.ql +++ b/ruby/ql/src/queries/security/cwe-020/OverlyLargeRange.ql @@ -1,6 +1,6 @@ /** - * @name Overly large regular expression range - * @description Overly permissive regular expression ranges may cause regular expressions to match more than anticipated. + * @name Overly permissive regular expression range + * @description Overly permissive regular expression ranges match a wider range of characters than intended. * This may allow an attacker to bypass a filter or sanitizer. * @kind problem * @problem.severity warning