hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Using DataFlow::ConfigSig instead of TaintTracking::Configuration

Browse Source
This commit is contained in:
Maiky
2023-07-06 03:14:49 +02:00
parent a8f887e3f9
commit a3c58c66e9
3 changed files with 19 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ruby/ql/lib/codeql/ruby/security/LdapInjectionCustomizations.qll
View File

@@ -26,7 +26,7 @@ module LdapInjection {
/**
* Additional taint steps for "LDAP Injection" vulnerabilities.
*/
predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
filterTaintStep(nodeFrom, nodeTo)
}

27
ruby/ql/lib/codeql/ruby/security/LdapInjectionQuery.qll
View File

@@ -5,22 +5,25 @@
private import codeql.ruby.DataFlow
private import codeql.ruby.TaintTracking
private import LdapInjectionCustomizations
private import LdapInjectionCustomizations::LdapInjection
/**
* A taint-tracking configuration for detecting LDAP Injections vulnerabilities.
*/
class Configuration extends TaintTracking::Configuration {
Configuration() { this = "LdapInjection" }
/** Provides a taint-tracking configuration for detecting LDAP Injections vulnerabilities. */
module LdapInjection {
import LdapInjectionCustomizations::LdapInjection
override predicate isSource(DataFlow::Node source) { source instanceof Source }
/**
* A taint-tracking configuration for detecting LDAP Injections vulnerabilities.
*/
private module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof Source }
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
LdapInjection::isAdditionalTaintStep(node1, node2)
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
LdapInjection::isAdditionalFlowStep(node1, node2)
}
}
import TaintTracking::Make<Config>
}

6
ruby/ql/src/experimental/ldap-injection/LdapInjection.ql
View File

@@ -13,9 +13,9 @@
import codeql.ruby.DataFlow
import codeql.ruby.security.LdapInjectionQuery
import DataFlow::PathGraph
import LdapInjection::PathGraph
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
from LdapInjection::PathNode source, LdapInjection::PathNode sink
where LdapInjection::hasFlowPath(source, sink)
select sink.getNode(), source, sink, "This LDAP query depends on a $@.", source.getNode(),
"user-provided value"