hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-05 23:26:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Add some more command injection sinks

Browse Source
This commit is contained in:
Harry Maclean
2024-02-06 09:34:20 +00:00
parent c22cbf5b01
commit a03c06802e
2 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
View File

@@ -130,13 +130,19 @@ module Kernel {
* `Kernel.spawn` takes the same argument forms as `Kernel.system`.
* See `KernelSystemCall` for details.
* Ruby documentation: https://docs.ruby-lang.org/en/3.0.0/Kernel.html#method-i-spawn
* Methods with the same effect exist in the `Process` and `PTY` classes, so they are also modeled here.
* TODO: document and handle the env and option arguments.
* ```
* spawn([env,] command... [,options]) -> pid
* ```
*/
class KernelSpawnCall extends SystemCommandExecution::Range instanceof KernelMethodCall {
KernelSpawnCall() { this.getMethodName() = "spawn" }
class KernelSpawnCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
KernelSpawnCall() {
this.getMethodName() = "spawn" and
this instanceof KernelMethodCall
or
this = DataFlow::getConstant(["Process", "PTY"]).getAMethodCall("spawn")
}
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }

8
ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
View File

@@ -7,7 +7,7 @@ private import codeql.ruby.ApiGraphs
private import codeql.ruby.Concepts
/**
* Provides modeling for the `Open3` library.
* Provides modeling for the `Open3` and `Open4` libraries.
*/
module Open3 {
/**
@@ -18,8 +18,10 @@ module Open3 {
class Open3Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open3Call() {
this =
API::getTopLevelMember("Open3")
.getAMethodCall(["popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e"])
API::getTopLevelMember(["Open3", "Open4"])
.getAMethodCall([
"popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e", "popen4"
])
}
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }