Implement rb/sql-injection

ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb

@@ -0,0 +1,64 @@
+class UserGroup < ActiveRecord::Base
+  has_many :users
+end
+
+class User < ApplicationRecord
+  belongs_to :user_group
+end
+
+class Admin < User
+end
+
+class FooController < ActionController::Base
+
+  MAX_USER_ID = 100_000
+
+  # A string tainted by user input is inserted into an SQL query
+  def some_request_handler
+    # SELECT AVG(#{params[:column]}) FROM "users"
+    User.calculate(:average, params[:column])
+
+    # DELETE FROM "users" WHERE (id = #{params[:id]})
+    User.delete_all("id = #{params[:id]}")
+
+    # SELECT "users".* FROM "users" WHERE (id = #{params[:id]})
+    User.destroy_all(["id = #{params[:id]}"])
+
+    # SELECT "users".* FROM "users" WHERE id BETWEEN #{params[:min_id]} AND 100000
+    User.where(<<-SQL, MAX_USER_ID)
+      id BETWEEN #{params[:min_id]} AND ?
+    SQL
+
+    UserGroup.joins(:users).where("user.id = #{params[:id]}")
+  end
+end
+
+
+class BarController < ApplicationController
+
+  def some_other_request_handler
+    ps = params
+
+    uid = ps[:id]
+
+    # DELETE FROM "users" WHERE (id = #{uid})
+    User.delete_all("id = " + uid)
+  end
+
+  def sanitized_paths
+
+    dir = params[:order]
+    # barrier guard prevents taint flow
+    dir = "DESC" unless dir == "ASC"
+    User.order("name #{dir}")
+
+    name = params[:user_name]
+    # barrier guard prevents taint flow
+    if %w(alice bob charlie).include? name
+      User.find_by("username = #{name}")
+    end
+  end
+end
+
+class BazController < BarController
+end

ql/test/query-tests/security/cwe-089/SqlInjection.expected

@@ -0,0 +1,23 @@
+edges
+| ActiveRecordInjection.rb:19:30:19:35 | call to params :  | ActiveRecordInjection.rb:19:30:19:44 | ...[...] |
+| ActiveRecordInjection.rb:22:29:22:34 | call to params :  | ActiveRecordInjection.rb:22:21:22:41 | "id = #{...}" |
+| ActiveRecordInjection.rb:29:20:29:25 | call to params :  | ActiveRecordInjection.rb:28:16:28:21 | <<-SQL |
+| ActiveRecordInjection.rb:32:48:32:53 | call to params :  | ActiveRecordInjection.rb:32:35:32:60 | "user.id = #{...}" |
+| ActiveRecordInjection.rb:40:10:40:15 | call to params :  | ActiveRecordInjection.rb:45:21:45:33 | ... + ... |
+nodes
+| ActiveRecordInjection.rb:19:30:19:35 | call to params :  | semmle.label | call to params :  |
+| ActiveRecordInjection.rb:19:30:19:44 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:22:21:22:41 | "id = #{...}" | semmle.label | "id = #{...}" |
+| ActiveRecordInjection.rb:22:29:22:34 | call to params :  | semmle.label | call to params :  |
+| ActiveRecordInjection.rb:28:16:28:21 | <<-SQL | semmle.label | <<-SQL |
+| ActiveRecordInjection.rb:29:20:29:25 | call to params :  | semmle.label | call to params :  |
+| ActiveRecordInjection.rb:32:35:32:60 | "user.id = #{...}" | semmle.label | "user.id = #{...}" |
+| ActiveRecordInjection.rb:32:48:32:53 | call to params :  | semmle.label | call to params :  |
+| ActiveRecordInjection.rb:40:10:40:15 | call to params :  | semmle.label | call to params :  |
+| ActiveRecordInjection.rb:45:21:45:33 | ... + ... | semmle.label | ... + ... |
+#select
+| ActiveRecordInjection.rb:19:30:19:44 | ...[...] | ActiveRecordInjection.rb:19:30:19:35 | call to params :  | ActiveRecordInjection.rb:19:30:19:44 | ...[...] | This SQL query depends on $@. | ActiveRecordInjection.rb:19:30:19:35 | call to params | a user-provided value |
+| ActiveRecordInjection.rb:22:21:22:41 | "id = #{...}" | ActiveRecordInjection.rb:22:29:22:34 | call to params :  | ActiveRecordInjection.rb:22:21:22:41 | "id = #{...}" | This SQL query depends on $@. | ActiveRecordInjection.rb:22:29:22:34 | call to params | a user-provided value |
+| ActiveRecordInjection.rb:28:16:28:21 | <<-SQL | ActiveRecordInjection.rb:29:20:29:25 | call to params :  | ActiveRecordInjection.rb:28:16:28:21 | <<-SQL | This SQL query depends on $@. | ActiveRecordInjection.rb:29:20:29:25 | call to params | a user-provided value |
+| ActiveRecordInjection.rb:32:35:32:60 | "user.id = #{...}" | ActiveRecordInjection.rb:32:48:32:53 | call to params :  | ActiveRecordInjection.rb:32:35:32:60 | "user.id = #{...}" | This SQL query depends on $@. | ActiveRecordInjection.rb:32:48:32:53 | call to params | a user-provided value |
+| ActiveRecordInjection.rb:45:21:45:33 | ... + ... | ActiveRecordInjection.rb:40:10:40:15 | call to params :  | ActiveRecordInjection.rb:45:21:45:33 | ... + ... | This SQL query depends on $@. | ActiveRecordInjection.rb:40:10:40:15 | call to params | a user-provided value |

ql/test/query-tests/security/cwe-089/SqlInjection.qlref

@@ -0,0 +1 @@
+queries/security/cwe-089/SqlInjection.ql