hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix test file

Browse Source
This commit is contained in:
amammad
2023-08-08 03:17:49 +10:00
committed by Harry Maclean
parent 464e2e4291
commit 9c5c8c8362
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.rb
View File

@@ -121,7 +121,7 @@ class UsersController < ActionController::Base
def route16
yaml_data = params[:key]
object = Psych.load yaml_data
object = Psych.load_file yaml_data2
object = Psych.load_file yaml_data
end
# GOOD
@@ -135,25 +135,25 @@ class UsersController < ActionController::Base
# BAD
def route18
yaml_data = params[:key]
object = Psych.unsafe_load(plist_data)
object = Psych.unsafe_load_file(plist_data)
object = Psych.load_stream(plist_data)
parse_output = Psych.parse_stream(plist_data)
object = Psych.unsafe_load(yaml_data)
object = Psych.unsafe_load_file(yaml_data)
object = Psych.load_stream(yaml_data)
parse_output = Psych.parse_stream(yaml_data)
object = parse_output.to_ruby
object = Psych.parse(plist_data).to_ruby
object = Psych.parse_file(plist_data).to_ruby
parsed_yaml = Psych.parse_stream(plist_data)
object = Psych.parse(yaml_data).to_ruby
object = Psych.parse_file(yaml_data).to_ruby
parsed_yaml = Psych.parse_stream(yaml_data)
parsed_yaml.children.each do |child|
object = child.to_ruby
end
Psych.parse_stream(plist_data) do |document|
Psych.parse_stream(yaml_data) do |document|
object = document.to_ruby
end
object = parsed_yaml.children.first.to_ruby
content = parsed_yaml.children[0].children[0].children
object = parsed_yaml.to_ruby[0]
object = content.to_ruby[0]
object = Psych.parse(plist_data).children[0].to_ruby
object = Psych.parse(yaml_data).children[0].to_ruby
end
# BAD