hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10782 from erik-krogh/rbPoly

Browse Source 
Ruby: add library input as a source for `rb/polynomial-redos`
This commit is contained in:
Erik Krogh Kristensen
2023-02-13 12:26:07 +01:00
committed by GitHub
parent 26d5fb2412 634087b417
commit 2f404df17c
7 changed files with 51 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.expected
View File

@@ -34,6 +34,8 @@ edges
| PolynomialReDoS.rb:70:12:70:24 | ...[...] : | PolynomialReDoS.rb:73:32:73:35 | name : |
| PolynomialReDoS.rb:73:32:73:35 | name : | PolynomialReDoS.rb:76:35:76:39 | input : |
| PolynomialReDoS.rb:76:35:76:39 | input : | PolynomialReDoS.rb:77:5:77:9 | input |
| lib/index.rb:2:11:2:11 | x : | lib/index.rb:4:13:4:13 | x |
| lib/index.rb:8:13:8:13 | x : | lib/index.rb:9:15:9:15 | x |
nodes
| PolynomialReDoS.rb:4:12:4:17 | call to params : | semmle.label | call to params : |
| PolynomialReDoS.rb:4:12:4:24 | ...[...] : | semmle.label | ...[...] : |
@@ -76,6 +78,10 @@ nodes
| PolynomialReDoS.rb:73:32:73:35 | name : | semmle.label | name : |
| PolynomialReDoS.rb:76:35:76:39 | input : | semmle.label | input : |
| PolynomialReDoS.rb:77:5:77:9 | input | semmle.label | input |
| lib/index.rb:2:11:2:11 | x : | semmle.label | x : |
| lib/index.rb:4:13:4:13 | x | semmle.label | x |
| lib/index.rb:8:13:8:13 | x : | semmle.label | x : |
| lib/index.rb:9:15:9:15 | x | semmle.label | x |
subpaths
#select
| PolynomialReDoS.rb:10:5:10:17 | ... =~ ... | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:10:5:10:8 | name | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | user-provided value |
@@ -101,3 +107,5 @@ subpaths
| PolynomialReDoS.rb:62:5:62:22 | call to gsub | PolynomialReDoS.rb:54:12:54:17 | call to params : | PolynomialReDoS.rb:62:5:62:9 | input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:56:31:56:33 | \\s+ | regular expression | PolynomialReDoS.rb:54:12:54:17 | call to params | user-provided value |
| PolynomialReDoS.rb:66:5:66:34 | call to match? | PolynomialReDoS.rb:54:12:54:17 | call to params : | PolynomialReDoS.rb:66:5:66:9 | input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:58:30:58:32 | \\s+ | regular expression | PolynomialReDoS.rb:54:12:54:17 | call to params | user-provided value |
| PolynomialReDoS.rb:77:5:77:22 | call to gsub | PolynomialReDoS.rb:70:12:70:17 | call to params : | PolynomialReDoS.rb:77:5:77:9 | input | This $@ that depends on a $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:72:28:72:30 | \\s+ | regular expression | PolynomialReDoS.rb:70:12:70:17 | call to params | user-provided value |
| lib/index.rb:4:13:4:26 | call to match | lib/index.rb:2:11:2:11 | x : | lib/index.rb:4:13:4:13 | x | This $@ that depends on a $@ may run slow on strings with many repetitions of 'a'. | lib/index.rb:4:22:4:23 | a+ | regular expression | lib/index.rb:2:11:2:11 | x | library input |
| lib/index.rb:9:15:9:28 | call to match | lib/index.rb:8:13:8:13 | x : | lib/index.rb:9:15:9:15 | x | This $@ that depends on a $@ may run slow on strings with many repetitions of 'a'. | lib/index.rb:9:24:9:25 | a+ | regular expression | lib/index.rb:8:13:8:13 | x | library input |

11
ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/lib/index.rb Normal file
View File

@@ -0,0 +1,11 @@
module Foo
def bar(x)
# Run the /a+$/ regex on the input x.
match = x.match(/a+$/)
end
protected
def baz(x)
match = x.match(/a+$/)
end
end

5
ruby/ql/test/query-tests/security/cwe-1333-polynomial-redos/poly-redos.gemspec Normal file
View File

@@ -0,0 +1,5 @@
Gem::Specification.new do |s|
s.name = 'poly-redos'
s.require_path = "lib"
end