hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Increased query robustness and test coverage

Browse Source
This commit is contained in:
thiggy1342
2022-06-03 18:05:56 +00:00
committed by GitHub
parent 09f082081f
commit c5dc8779d1
3 changed files with 37 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ruby/ql/src/experimental/decompression-api/DecompressionAPI.ql
View File

@@ -22,12 +22,14 @@ class DecompressionAPIUse extends DataFlow::Node {
// this should find the first argument of Zlib::Inflate.inflate or Zip::File.extract
DecompressionAPIUse() {
this = API::getTopLevelMember("Zlib").getMember("Inflate").getAMethodCall("inflate").getArgument(0) or
this = API::getTopLevelMember("Zip").getMember("File").getAMethodCall("extract").getArgument(0)
this = API::getTopLevelMember("Zip").getMember("File").getAMethodCall("open").getArgument(0) or
this = API::getTopLevelMember("Zip").getMember("Entry").getAMethodCall("extract").getArgument(0)
}
}
class Configuration extends TaintTracking::Configuration {
Configuration() { this = "DecompressionAPI" }
Configuration() { this = "DecompressionAPIUse" }
// this predicate will be used to contstrain our query to find instances where only remote user-controlled data flows to the sink
override predicate isSource(DataFlow::Node source) {

8
ruby/ql/test/query-tests/security/decompression-api/DecompressionAPI.expected
View File

@@ -1,12 +1,20 @@
edges
| decompression_api.rb:3:31:3:36 | call to params : | decompression_api.rb:3:31:3:43 | ...[...] |
| decompression_api.rb:12:35:12:40 | call to params : | decompression_api.rb:12:35:12:47 | ...[...] |
| decompression_api.rb:17:27:17:32 | call to params : | decompression_api.rb:17:27:17:39 | ...[...] |
| decompression_api.rb:26:31:26:36 | call to params : | decompression_api.rb:26:31:26:43 | ...[...] |
nodes
| decompression_api.rb:3:31:3:36 | call to params : | semmle.label | call to params : |
| decompression_api.rb:3:31:3:43 | ...[...] | semmle.label | ...[...] |
| decompression_api.rb:12:35:12:40 | call to params : | semmle.label | call to params : |
| decompression_api.rb:12:35:12:47 | ...[...] | semmle.label | ...[...] |
| decompression_api.rb:17:27:17:32 | call to params : | semmle.label | call to params : |
| decompression_api.rb:17:27:17:39 | ...[...] | semmle.label | ...[...] |
| decompression_api.rb:26:31:26:36 | call to params : | semmle.label | call to params : |
| decompression_api.rb:26:31:26:43 | ...[...] | semmle.label | ...[...] |
subpaths
#select
| decompression_api.rb:3:31:3:43 | ...[...] | decompression_api.rb:3:31:3:36 | call to params : | decompression_api.rb:3:31:3:43 | ...[...] | This call to $@ is unsafe because user-controlled data is used to set the object being decompressed, which could lead to a denial of service attack or malicious code extracted from an unknown source. |
| decompression_api.rb:12:35:12:47 | ...[...] | decompression_api.rb:12:35:12:40 | call to params : | decompression_api.rb:12:35:12:47 | ...[...] | This call to $@ is unsafe because user-controlled data is used to set the object being decompressed, which could lead to a denial of service attack or malicious code extracted from an unknown source. |
| decompression_api.rb:17:27:17:39 | ...[...] | decompression_api.rb:17:27:17:32 | call to params : | decompression_api.rb:17:27:17:39 | ...[...] | This call to $@ is unsafe because user-controlled data is used to set the object being decompressed, which could lead to a denial of service attack or malicious code extracted from an unknown source. |
| decompression_api.rb:26:31:26:43 | ...[...] | decompression_api.rb:26:31:26:36 | call to params : | decompression_api.rb:26:31:26:43 | ...[...] | This call to $@ is unsafe because user-controlled data is used to set the object being decompressed, which could lead to a denial of service attack or malicious code extracted from an unknown source. |

26
ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb
View File

@@ -7,8 +7,32 @@ class TestController < ActionController::Base
Zlib::Inflate.inflate("testfile.gz")
end
DECOMPRESSION_LIB = Zlib
def unsafe_zlib_unzip_const
DECOMPRESSION_LIB::Inflate.inflate(params[:path])
end
def unsafe_zlib_unzip
Zip::File.open(params[:file]) do |zip_file|
zip_file.each do |entry|
entry.extract(entry.name)
end
end
end
def safe_zlib_unzip
Zip::Entry.extract("testfile.gz")
end
def sanitized_zlib_unzip
if params[:path].in ["safe_file1.gz", "safe_file2.gz"]
if "safe_file.gz" == params[:path]
Zlib::Inflate.inflate(params[:path])
end
end
def sanitized_array_zlib_unzip
if ["safe_file1.gz", "safe_file2.gz"].include? params[:path]
Zlib::Inflate.inflate(params[:path])
end
end