hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-20 06:24:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update metadata of Ruby SSRF query

Browse Source
This commit is contained in:
Harry Maclean
2021-11-01 11:02:56 +00:00
parent dc464879a2
commit 2bba31eb02
2 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
ruby/ql/src/queries/security/cwe-918/ServerSideRequestForgery.ql
View File

@@ -1,12 +1,11 @@
/**
* @name Server Side Request Forgery
* @description Making a request to a URL that is controlled by user input
* can allow an attacker to forge requests to internal services.
* @name Uncontrolled data used in network request
* @description Making a network request with user-controlled data allows for request forgery attacks.
* @kind path-problem
* @problem.severity error
* @security-severity TODO
* @security-severity 9.1
* @precision medium
* @id rb/server-side-request-forgery
* @id rb/request-forgery
* @tags security
* external/cwe/cwe-918
*/
@@ -20,5 +19,5 @@ import codeql.ruby.security.ServerSideRequestForgeryQuery
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Untrusted HTTP request due to $@.", source.getNode(),
select sink.getNode(), source, sink, "The URL of this request depends on $@.", source.getNode(),
"a user-provided value"