hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: configsig rb/overly-permissive-file

Browse Source
This commit is contained in:
Alex Ford
2023-09-03 16:32:31 +01:00
parent b6d12f8b1c
commit 4d1684e37b
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql
View File

@@ -13,7 +13,6 @@
import codeql.ruby.AST
import codeql.ruby.Concepts
import codeql.ruby.DataFlow
import DataFlow::PathGraph
import codeql.ruby.ApiGraphs
bindingset[p]
@@ -47,22 +46,25 @@ class PermissivePermissionsExpr extends Expr {
}
}
class PermissivePermissionsConfig extends DataFlow::Configuration {
PermissivePermissionsConfig() { this = "PermissivePermissionsConfig" }
override predicate isSource(DataFlow::Node source) {
private module PermissivePermissionsConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr().getExpr() instanceof PermissivePermissionsExpr
}
override predicate isSink(DataFlow::Node sink) {
predicate isSink(DataFlow::Node sink) {
exists(FileSystemPermissionModification mod | mod.getAPermissionNode() = sink)
}
}
private module PermissivePermissionsFlow = DataFlow::Global<PermissivePermissionsConfig>;
private import PermissivePermissionsFlow::PathGraph
from
DataFlow::PathNode source, DataFlow::PathNode sink, PermissivePermissionsConfig conf,
PermissivePermissionsFlow::PathNode source, PermissivePermissionsFlow::PathNode sink,
FileSystemPermissionModification mod
where conf.hasFlowPath(source, sink) and mod.getAPermissionNode() = sink.getNode()
where
PermissivePermissionsFlow::flowPath(source, sink) and mod.getAPermissionNode() = sink.getNode()
select source.getNode(), source, sink,
"This overly permissive mask used in $@ allows read or write access to others.", mod,
mod.toString()