hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: rack - request input tests

Browse Source
This commit is contained in:
Alex Ford
2023-06-26 11:07:30 +01:00
parent 175d524146
commit bf25b07c17
3 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ruby/ql/test/library-tests/frameworks/rack/Rack.expected
View File

@@ -6,6 +6,8 @@ rackRequestHandlers
| rack.rb:60:3:62:5 | call | rack.rb:60:12:60:14 | env | rack.rb:66:7:66:22 | call to [] |
| rack.rb:60:3:62:5 | call | rack.rb:60:12:60:14 | env | rack.rb:73:5:73:21 | call to [] |
| rack.rb:79:3:81:5 | call | rack.rb:79:17:79:19 | env | rack.rb:93:5:93:78 | call to finish |
| rack.rb:98:3:107:5 | call | rack.rb:98:12:98:14 | env | rack.rb:110:5:110:28 | call to [] |
| rack.rb:98:3:107:5 | call | rack.rb:98:12:98:14 | env | rack.rb:114:5:114:30 | call to [] |
| rack_apps.rb:6:3:12:5 | call | rack_apps.rb:6:12:6:14 | env | rack_apps.rb:10:12:10:34 | call to [] |
| rack_apps.rb:16:3:18:5 | call | rack_apps.rb:16:17:16:19 | env | rack_apps.rb:17:5:17:28 | call to [] |
| rack_apps.rb:21:14:21:50 | -> { ... } | rack_apps.rb:21:17:21:19 | env | rack_apps.rb:21:24:21:48 | call to [] |
@@ -16,3 +18,7 @@ rackResponseContentTypes
redirectResponses
| rack.rb:43:5:43:45 | call to [] | rack.rb:42:30:42:40 | "/foo.html" |
| rack.rb:93:5:93:78 | call to finish | rack.rb:93:60:93:70 | redirect_to |
requestInputAccesses
| rack.rb:100:18:100:28 | call to cookies |
| rack.rb:103:14:103:23 | call to params |
| rack.rb:104:18:104:32 | ...[...] |

3
ruby/ql/test/library-tests/frameworks/rack/Rack.ql
View File

@@ -1,4 +1,5 @@
private import codeql.ruby.AST
private import codeql.ruby.Concepts
private import codeql.ruby.frameworks.Rack
private import codeql.ruby.DataFlow
@@ -17,3 +18,5 @@ query predicate rackResponseContentTypes(
query predicate redirectResponses(Rack::Response::RedirectResponse resp, DataFlow::Node location) {
location = resp.getRedirectLocation()
}
query predicate requestInputAccesses(Http::Server::RequestInputAccess ria) { any() }

21
ruby/ql/test/library-tests/frameworks/rack/rack.rb
View File

@@ -93,3 +93,24 @@ class Qux
Rack::Response.new(['redirecting'], 302, 'Location' => redirect_to).finish
end
end
class UsesRequest
def call(env)
req = Rack::Request.new(env)
if session = req.cookies['session']
reuse_session(session)
else
name = req.params['name']
password = req['password']
login(name, password)
end
end
def login(name, password)
[200, {}, "new session"]
end
def reuse_session(name, password)
[200, {}, "reuse session"]
end
end