hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Put exprNodeReturnedFrom predicate in DataFlowDispatch.qll

Browse Source
This commit is contained in:
Alex Ford
2021-09-15 17:57:38 +01:00
parent e80faa017c
commit 773291e4c3
4 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
ql/lib/codeql/ruby/dataflow/internal/DataFlowDispatch.qll
View File

@@ -314,3 +314,16 @@ predicate mayBenefitFromCallContext(DataFlowCall call, Callable c) { none() }
* restricted to those `call`s for which a context might make a difference.
*/
DataFlowCallable viableImplInCallContext(DataFlowCall call, DataFlowCall ctx) { none() }
/**
* Holds if `e` is an `ExprNode` that may be returned by a call to `c`.
*/
predicate exprNodeReturnedFrom(DataFlow::ExprNode e, DataFlowCallable c) {
exists(ReturnNode r |
r.getEnclosingCallable() = c and
(
r.(ExplicitReturnNode).getReturningNode().getReturnedValueNode() = e.asExpr() or
r.(ExprReturnNode) = e
)
)
}

10
ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll
View File

@@ -4552,13 +4552,3 @@ private predicate revPartialFlow(
sink.isRevSink() and
node.getASuccessor+() = sink
}
/**
* Holds if `n` is a return node from callable `c`.
*/
predicate nodeReturnedFrom(ReturnNodeExt n, DataFlowCallable c) {
exists(RetNodeEx ret |
n = ret.asNode() and
c = ret.getReturnPosition().getCallable()
)
}

6
ql/lib/codeql/ruby/security/ReflectedXSSCustomizations.qll
View File

@@ -7,6 +7,7 @@ private import codeql.ruby.frameworks.ActionController
private import codeql.ruby.frameworks.ActionView
private import codeql.ruby.dataflow.RemoteFlowSources
private import codeql.ruby.dataflow.BarrierGuards
import codeql.ruby.dataflow.internal.DataFlowDispatch
private import codeql.ruby.typetracking.TypeTracker
/**
@@ -190,8 +191,9 @@ module ReflectedXSS {
template = node2.getLocation().getFile() and
helperMethod.getName() = helperMethodCall.getExpr().getMethodName() and
helperMethod.getControllerClass() = getAssociatedControllerClass(template) and
// `node1` is a returned value
DataFlow::nodeReturnedFrom(node1, helperMethod) and
// `node1` is an expr node that may be returned by the helper method
exprNodeReturnedFrom(node1, helperMethod) and
// `node2` is a call to the helper method
node2.asExpr() = helperMethodCall
)
}

6
ql/test/query-tests/security/cwe-079/ReflectedXSS.expected
View File

@@ -1,6 +1,6 @@
edges
| app/controllers/foo/bars_controller.rb:9:5:9:29 | return : | app/views/foo/bars/show.html.erb:47:5:47:13 | call to user_name |
| app/controllers/foo/bars_controller.rb:9:12:9:17 | call to params : | app/controllers/foo/bars_controller.rb:9:5:9:29 | return : |
| app/controllers/foo/bars_controller.rb:9:12:9:17 | call to params : | app/controllers/foo/bars_controller.rb:9:12:9:29 | ...[...] : |
| app/controllers/foo/bars_controller.rb:9:12:9:29 | ...[...] : | app/views/foo/bars/show.html.erb:47:5:47:13 | call to user_name |
| app/controllers/foo/bars_controller.rb:13:5:13:37 | ... = ... : | app/views/foo/bars/show.html.erb:51:5:51:18 | call to user_name_memo |
| app/controllers/foo/bars_controller.rb:13:20:13:25 | call to params : | app/controllers/foo/bars_controller.rb:13:5:13:37 | ... = ... : |
| app/controllers/foo/bars_controller.rb:17:21:17:26 | call to params : | app/controllers/foo/bars_controller.rb:17:21:17:36 | ...[...] : |
@@ -19,8 +19,8 @@ edges
| app/views/foo/bars/show.html.erb:54:29:54:34 | call to params : | app/views/foo/bars/show.html.erb:54:29:54:44 | ...[...] |
| app/views/foo/bars/show.html.erb:57:13:57:18 | call to params : | app/views/foo/bars/show.html.erb:57:13:57:28 | ...[...] |
nodes
| app/controllers/foo/bars_controller.rb:9:5:9:29 | return : | semmle.label | return : |
| app/controllers/foo/bars_controller.rb:9:12:9:17 | call to params : | semmle.label | call to params : |
| app/controllers/foo/bars_controller.rb:9:12:9:29 | ...[...] : | semmle.label | ...[...] : |
| app/controllers/foo/bars_controller.rb:13:5:13:37 | ... = ... : | semmle.label | ... = ... : |
| app/controllers/foo/bars_controller.rb:13:20:13:25 | call to params : | semmle.label | call to params : |
| app/controllers/foo/bars_controller.rb:17:21:17:26 | call to params : | semmle.label | call to params : |