hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Remove RegExpLiteral.getAMatch

Browse Source 
This predicate is a duplicate of getAMatchedString, which matches the
naming in the JS version.
This commit is contained in:
Harry Maclean
2022-07-27 14:30:44 +12:00
parent 6bb24f9d7c
commit 3179c60a1e
2 changed files with 5 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
ruby/ql/lib/codeql/ruby/regexp/RegExpTreeView.qll
View File

@@ -271,9 +271,6 @@ class RegExpTerm extends RegExpParent {
/** Holds if this regular expression term can match the empty string. */
predicate isNullable() { none() }
/** Gets a string matched by this regular expression. */
string getAMatch() { none() }
}
/**
@@ -458,20 +455,6 @@ class RegExpSequence extends RegExpTerm, TRegExpSequence {
override predicate isNullable() {
forall(RegExpTerm child | child = this.getAChild() | child.isNullable())
}
// Why can't we use concat(...) with language[monotonicAggregates] here instead?
override string getAMatch() { result = this.getAMatchFromChildAtIndex(0) }
private string getAMatchFromChildAtIndex(int i) {
i = this.getNumChild() and result = ""
or
exists(string substring, string rest |
substring = this.getChild(i).getAMatch() and
rest = this.getAMatchFromChildAtIndex(i + 1)
|
result = substring + rest
)
}
}
pragma[nomagic]
@@ -703,8 +686,6 @@ class RegExpCharacterClass extends RegExpTerm, TRegExpCharacterClass {
override string getAPrimaryQlClass() { result = "RegExpCharacterClass" }
override predicate isNullable() { none() }
override string getAMatch() { not this.isInverted() and result = this.getAChild().getAMatch() }
}
/**
@@ -819,8 +800,6 @@ class RegExpConstant extends RegExpTerm {
override string getAPrimaryQlClass() { result = "RegExpConstant" }
override predicate isNullable() { none() }
override string getAMatch() { result = this.getValue() }
}
/**
@@ -870,8 +849,6 @@ class RegExpGroup extends RegExpTerm, TRegExpGroup {
override string getAPrimaryQlClass() { result = "RegExpGroup" }
override predicate isNullable() { this.getAChild().isNullable() }
override string getAMatch() { result = this.getAChild().getAMatch() }
}
/**

10
ruby/ql/lib/codeql/ruby/security/IncompleteMultiCharacterSanitizationQuery.qll
View File

@@ -60,7 +60,7 @@ pragma[noinline]
private DangerousPrefixSubstring getADangerousMatchedChar(EmptyReplaceRegExpTerm t) {
t.isNullable() and result = ""
or
result = t.getAMatch()
result = t.getAMatchedString()
or
// A substring matched by some character class. This is only used to match the "word" part of a HTML tag (e.g. "iframe" in "<iframe").
exists(ReDoSUtil::CharacterClass cc |
@@ -123,14 +123,14 @@ private predicate matchesDangerousPrefix(EmptyReplaceRegExpTerm t, string prefix
kind = "path injection" and
prefix = ["/..", "../"] and
// If the regex is matching explicit path components, it is unlikely that it's being used as a sanitizer.
not t.getSuccessor*().getAMatch().regexpMatch("(?is).*[a-z0-9_-].*")
not t.getSuccessor*().getAMatchedString().regexpMatch("(?is).*[a-z0-9_-].*")
or
kind = "HTML element injection" and
(
// comments
prefix = "<!--" and
// If the regex is matching explicit textual content of an HTML comment, it is unlikely that it's being used as a sanitizer.
not t.getSuccessor*().getAMatch().regexpMatch("(?is).*[a-z0-9_].*")
not t.getSuccessor*().getAMatchedString().regexpMatch("(?is).*[a-z0-9_].*")
or
// specific tags
// the `cript|scrip` case has been observed in the wild several times
@@ -148,11 +148,11 @@ private predicate matchesDangerousPrefix(EmptyReplaceRegExpTerm t, string prefix
] and
(
// explicit matching: `onclick` and `ng-bind`
t.getAMatch().regexpMatch("(?i)" + prefix + "[a-z]+")
t.getAMatchedString().regexpMatch("(?i)" + prefix + "[a-z]+")
or
// regexp-based matching: `on[a-z]+`
exists(EmptyReplaceRegExpTerm start | start = t.getAChild() |
start.getAMatch().regexpMatch("(?i)[^a-z]*" + prefix) and
start.getAMatchedString().regexpMatch("(?i)[^a-z]*" + prefix) and
isCommonWordMatcher(start.getSuccessor())
)
)