hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add predicate to filter out calls to File in opal

Browse Source
This commit is contained in:
Peter Stöckli
2022-11-29 09:59:40 +01:00
parent 315480824b
commit 88282ade1a
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ruby/ql/lib/codeql/ruby/security/KernelOpenQuery.qll
View File

@@ -16,23 +16,22 @@ class AmbiguousPathCall extends DataFlow::CallNode {
this.(KernelMethodCall).getMethodName() = "open" and
name = "Kernel.open"
or
this = API::getTopLevelMember("IO").getAMethodCall("read") and
not this = API::getTopLevelMember("File").getAMethodCall("read") and // needed in e.g. opal/opal, where some calls have both paths, but I'm not sure why
methodCallOnlyOnIO(this, "read") and
name = "IO.read"
or
this = API::getTopLevelMember("IO").getAMethodCall("write") and
methodCallOnlyOnIO(this, "write") and
name = "IO.write"
or
this = API::getTopLevelMember("IO").getAMethodCall("binread") and
methodCallOnlyOnIO(this, "binread") and
name = "IO.binread"
or
this = API::getTopLevelMember("IO").getAMethodCall("binwrite") and
methodCallOnlyOnIO(this, "binwrite") and
name = "IO.binwrite"
or
this = API::getTopLevelMember("IO").getAMethodCall("foreach") and
methodCallOnlyOnIO(this, "foreach") and
name = "IO.foreach"
or
this = API::getTopLevelMember("IO").getAMethodCall("readlines") and
methodCallOnlyOnIO(this, "readlines") and
name = "IO.readlines"
or
this = API::getTopLevelMember("URI").getAMethodCall("open") and
@@ -65,6 +64,11 @@ class AmbiguousPathCall extends DataFlow::CallNode {
DataFlow::Node getPathArgument() { result = this.getArgument(0) }
}
predicate methodCallOnlyOnIO(DataFlow::CallNode node, string methodName) {
node = API::getTopLevelMember("IO").getAMethodCall(methodName) and
not node = API::getTopLevelMember("File").getAMethodCall(methodName) // needed in e.g. opal/opal, where some calls have both paths (opal implements an own corelib)
}
/**
* A sanitizer for kernel open vulnerabilities.
*/