hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-11 12:41:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

add library inputs as a source to poly-redos

Browse Source
This commit is contained in:
erik-krogh
2022-10-11 21:16:46 +02:00
parent 158ea26dd1
commit 2ad28ab4db
6 changed files with 36 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSCustomizations.qll
View File

@@ -22,7 +22,13 @@ module PolynomialReDoS {
/**
* A data flow source node for polynomial regular expression denial-of-service vulnerabilities.
*/
abstract class Source extends DataFlow::Node { }
abstract class Source extends DataFlow::Node {
/**
* Gets a string that describes the source.
* For use in the alert message.
*/
string describe() { result = "user-provided value" }
}
/**
* A data flow sink node for polynomial regular expression denial-of-service vulnerabilities.
@@ -53,6 +59,15 @@ module PolynomialReDoS {
*/
class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
import codeql.ruby.frameworks.core.Gem::Gem as Gem
/** A library input, considered as a flow source. */
class LibraryInputAsSource extends Source {
LibraryInputAsSource() { this = Gem::getALibraryInput() }
override string describe() { result = "library input" }
}
/**
* Gets the AST of a regular expression object that can flow to `node`.
*/

4
ruby/ql/src/change-notes/2022-10-11-poly-redos-lib.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The `rb/polynomial-redos` query now considers the entrypoints of the API of a gem as sources.

2
ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.ql
View File

@@ -27,4 +27,4 @@ where
select sinkNode.getHighlight(), source, sink,
"This $@ that depends on a $@ may run slow on strings " + regexp.getPrefixMessage() +
"with many repetitions of '" + regexp.getPumpString() + "'.", regexp, "regular expression",
source.getNode(), "user-provided value"
source.getNode(), source.getNode().(PolynomialReDoS::Source).describe()

4
ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.expected
View File

@@ -23,6 +23,7 @@ edges
| PolynomialReDoS.rb:29:9:29:18 | ...[...] : | PolynomialReDoS.rb:30:5:30:5 | b |
| PolynomialReDoS.rb:31:9:31:14 | call to params : | PolynomialReDoS.rb:31:9:31:18 | ...[...] : |
| PolynomialReDoS.rb:31:9:31:18 | ...[...] : | PolynomialReDoS.rb:32:5:32:5 | c |
| lib/index.rb:2:11:2:11 | x : | lib/index.rb:4:13:4:13 | x |
nodes
| PolynomialReDoS.rb:4:12:4:17 | call to params : | semmle.label | call to params : |
| PolynomialReDoS.rb:4:12:4:24 | ...[...] : | semmle.label | ...[...] : |
@@ -52,6 +53,8 @@ nodes
| PolynomialReDoS.rb:32:5:32:5 | c | semmle.label | c |
| PolynomialReDoS.rb:42:10:42:13 | name | semmle.label | name |
| PolynomialReDoS.rb:47:10:47:13 | name | semmle.label | name |
| lib/index.rb:2:11:2:11 | x : | semmle.label | x : |
| lib/index.rb:4:13:4:13 | x | semmle.label | x |
subpaths
#select
| PolynomialReDoS.rb:10:5:10:17 | ... =~ ... | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:10:5:10:8 | name | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | user-provided value |
@@ -74,3 +77,4 @@ subpaths
| PolynomialReDoS.rb:32:5:32:20 | call to sub! | PolynomialReDoS.rb:31:9:31:14 | call to params : | PolynomialReDoS.rb:32:5:32:5 | c | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:31:9:31:14 | call to params | user-provided value |
| PolynomialReDoS.rb:42:5:45:7 | case ... | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:42:10:42:13 | name | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | user-provided value |
| PolynomialReDoS.rb:47:5:50:7 | case ... | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:47:10:47:13 | name | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:48:14:48:16 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | user-provided value |
| lib/index.rb:4:13:4:26 | call to match | lib/index.rb:2:11:2:11 | x : | lib/index.rb:4:13:4:13 | x | This $@ that depends on a $@ may run slow on strings with many repetitions of 'a'. | lib/index.rb:4:22:4:23 | a+ | regular expression | lib/index.rb:2:11:2:11 | x | library input |

6
ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/lib/index.rb Normal file
View File

@@ -0,0 +1,6 @@
module Foo
def bar(x)
# Run the /a+$/ regex on the input x.
match = x.match(/a+$/)
end
end

5
ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/poly-redos.gemspec Normal file
View File

@@ -0,0 +1,5 @@
Gem::Specification.new do |s|
s.name = 'poly-redos'
s.require_path = "lib"
end