hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 21:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: convert rb/sensitive-get-query into a @kind problem

Browse Source
This commit is contained in:
Alex Ford
2023-03-24 15:56:31 +00:00
parent 329684c2b0
commit 15c9e7666a
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ruby/ql/src/queries/security/cwe-598/SensitiveGetQuery.ql
View File

@@ -2,7 +2,7 @@
* @name Sensitive data read from GET request
* @description Placing sensitive data in a GET request increases the risk of
* the data being exposed to an attacker.
* @kind path-problem
* @kind problem
* @problem.severity warning
* @security-severity 6.5
* @precision high
@@ -12,12 +12,10 @@
*/
import ruby
import DataFlow::PathGraph
import codeql.ruby.security.SensitiveGetQueryQuery
import codeql.ruby.security.SensitiveActions
from DataFlow::PathNode source, DataFlow::PathNode sink, SensitiveGetQuery::Configuration config
where config.hasFlowPath(source, sink)
select source.getNode(), source, sink,
"$@ for GET requests uses query parameter as sensitive data.",
source.getNode().(SensitiveGetQuery::Source).getHandler(), "Route handler"
from DataFlow::Node source, DataFlow::Node sink, SensitiveGetQuery::Configuration config
where config.hasFlow(source, sink)
select source, "$@ for GET requests uses query parameter as sensitive data.",
source.(SensitiveGetQuery::Source).getHandler(), "Route handler"