hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-23 07:45:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Give regex injection extendable sources as well.

Browse Source
This commit is contained in:
Geoffrey White
2025-04-04 18:27:16 +01:00
parent 0db551032c
commit 47ee6c6b81
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
rust/ql/lib/codeql/rust/security/regex/RegexInjectionExtensions.qll
View File

@@ -15,6 +15,11 @@ private import codeql.rust.Concepts
* injection vulnerabilities, as well as extension points for adding your own.
*/
module RegexInjection {
/**
* A data flow source for regular expression injection vulnerabilities.
*/
abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for regular expression injection vulnerabilities.
*/
@@ -27,6 +32,11 @@ module RegexInjection {
*/
abstract class Barrier extends DataFlow::Node { }
/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/**
* A sink for `a` in `Regex::new(a)` when `a` is not a literal.
*/

3
rust/ql/src/queries/security/CWE-020/RegexInjection.ql
View File

@@ -17,7 +17,6 @@
private import rust
private import codeql.rust.dataflow.DataFlow
private import codeql.rust.dataflow.TaintTracking
private import codeql.rust.Concepts
private import codeql.rust.security.regex.RegexInjectionExtensions
/**
@@ -26,7 +25,7 @@ private import codeql.rust.security.regex.RegexInjectionExtensions
module RegexInjectionConfig implements DataFlow::ConfigSig {
import RegexInjection
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
predicate isSource(DataFlow::Node source) { source instanceof Source }
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }