hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: add stacktrace exposure query

Browse Source
This commit is contained in:
Nick Rolfe
2022-07-29 17:27:16 +01:00
parent dd525a4f9b
commit b39e2ef71c
8 changed files with 196 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.expected Normal file
View File

@@ -0,0 +1,10 @@
edges
| StackTraceExposure.rb:11:10:11:17 | call to caller : | StackTraceExposure.rb:12:12:12:13 | bt |
nodes
| StackTraceExposure.rb:6:12:6:22 | call to backtrace | semmle.label | call to backtrace |
| StackTraceExposure.rb:11:10:11:17 | call to caller : | semmle.label | call to caller : |
| StackTraceExposure.rb:12:12:12:13 | bt | semmle.label | bt |
subpaths
#select
| StackTraceExposure.rb:6:12:6:22 | call to backtrace | StackTraceExposure.rb:6:12:6:22 | call to backtrace | StackTraceExposure.rb:6:12:6:22 | call to backtrace | $@ can be exposed to an external user. | StackTraceExposure.rb:6:12:6:22 | call to backtrace | Error information |
| StackTraceExposure.rb:12:12:12:13 | bt | StackTraceExposure.rb:11:10:11:17 | call to caller : | StackTraceExposure.rb:12:12:12:13 | bt | $@ can be exposed to an external user. | StackTraceExposure.rb:11:10:11:17 | call to caller | Error information |

1
ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.qlref Normal file
View File

@@ -0,0 +1 @@
queries/security/cwe-209/StackTraceExposure.ql

15
ruby/ql/test/query-tests/security/cwe-209/StackTraceExposure.rb Normal file
View File

@@ -0,0 +1,15 @@
class FooController < ApplicationController
def show
something_that_might_fail()
rescue => e
render e.backtrace, content_type: "text/plain"
end
def show2
bt = caller()
render bt, content_type: "text/plain"
end
end