hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-20 14:34:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add change note + fix qldoc

Browse Source
This commit is contained in:
Joe Farebrother
2024-03-14 15:44:53 +00:00
parent 3e61be1b6a
commit b4ed77343b
3 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ruby/ql/lib/change-notes/2024-03-14-actiondispatch-uploadedfile.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Modeled instances of `ActionDispatch::Http::UploadedFile` that can be obtained from element reads of `ActionController::Parameters`, with calls to `original_filename`, `content_type`, and `read` now propagating taint from their receiver.

8
ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
View File

@@ -597,7 +597,7 @@ private module ParamsSummaries {
/** Flow summary for various string attributes of `UploadedFile`, including `original_filename`, `content_type`, and `headers`. */
private class UploadedFileStringAttributeSummary extends SummarizedCallable {
UploadedFileStringAttributeSummary() {
this = "ActionDispatch::Http::UploadedFile::[original_filename,content_type,headers]"
this = "ActionDispatch::Http::UploadedFile#[original_filename,content_type,headers]"
}
override MethodCall getACall() {
@@ -615,11 +615,11 @@ private module ParamsSummaries {
}
/**
* Flow summary for `ActiveDispatch::Http::UploadedFile.original_filename`,
* which propagates taint from the receiver to the return value or to the second (buffer) argument
* Flow summary for `ActiveDispatch::Http::UploadedFile#read`,
* which propagates taint from the receiver to the return value or to the second (out string) argument
*/
private class UploadedFileReadSummary extends SummarizedCallable {
UploadedFileReadSummary() { this = "ActionDispatch::Http::UploadedFile::read" }
UploadedFileReadSummary() { this = "ActionDispatch::Http::UploadedFile#read" }
override MethodCall getACall() {
result = paramsFieldType().getAMethodCall("read").asExpr().getExpr() and

6
ruby/ql/test/library-tests/dataflow/local/TaintStep.expected
View File

@@ -2835,9 +2835,9 @@
| file://:0:0:0:0 | [summary param] self in ActionController::Parameters#merge | file://:0:0:0:0 | [summary] to write: ReturnValue in ActionController::Parameters#merge |
| file://:0:0:0:0 | [summary param] self in ActionController::Parameters#merge! | file://:0:0:0:0 | [summary] to write: Argument[self] in ActionController::Parameters#merge! |
| file://:0:0:0:0 | [summary param] self in ActionController::Parameters#merge! | file://:0:0:0:0 | [summary] to write: ReturnValue in ActionController::Parameters#merge! |
| file://:0:0:0:0 | [summary param] self in ActionDispatch::Http::UploadedFile::[original_filename,content_type,headers] | file://:0:0:0:0 | [summary] to write: ReturnValue in ActionDispatch::Http::UploadedFile::[original_filename,content_type,headers] |
| file://:0:0:0:0 | [summary param] self in ActionDispatch::Http::UploadedFile::read | file://:0:0:0:0 | [summary] to write: Argument[1] in ActionDispatch::Http::UploadedFile::read |
| file://:0:0:0:0 | [summary param] self in ActionDispatch::Http::UploadedFile::read | file://:0:0:0:0 | [summary] to write: ReturnValue in ActionDispatch::Http::UploadedFile::read |
| file://:0:0:0:0 | [summary param] self in ActionDispatch::Http::UploadedFile#[original_filename,content_type,headers] | file://:0:0:0:0 | [summary] to write: ReturnValue in ActionDispatch::Http::UploadedFile#[original_filename,content_type,headers] |
| file://:0:0:0:0 | [summary param] self in ActionDispatch::Http::UploadedFile#read | file://:0:0:0:0 | [summary] to write: Argument[1] in ActionDispatch::Http::UploadedFile#read |
| file://:0:0:0:0 | [summary param] self in ActionDispatch::Http::UploadedFile#read | file://:0:0:0:0 | [summary] to write: ReturnValue in ActionDispatch::Http::UploadedFile#read |
| file://:0:0:0:0 | [summary param] self in ActiveSupportStringTransform | file://:0:0:0:0 | [summary] to write: ReturnValue in ActiveSupportStringTransform |
| file://:0:0:0:0 | [summary param] self in [] | file://:0:0:0:0 | [summary] to write: ReturnValue in [] |
| file://:0:0:0:0 | [summary param] self in \| | file://:0:0:0:0 | [summary] read: Argument[self].Element[any] in \| |