hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix module of Parser::Options

Browse Source
This commit is contained in:
Arthur Baars
2021-10-01 11:18:03 +02:00
parent b06bb7a789
commit c78d02d00d
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ql/lib/codeql/ruby/frameworks/XmlParsing.qll
View File

@@ -93,9 +93,10 @@ private class FeatureDTDLOAD extends Feature, TDTDLOAD {
private API::Node parseOptionsModule() {
result = API::getTopLevelMember("Nokogiri").getMember("XML").getMember("ParseOptions")
or
result = API::getTopLevelMember("LibXML").getMember("XML").getMember("Options")
result =
API::getTopLevelMember("LibXML").getMember("XML").getMember("Parser").getMember("Options")
or
result = API::getTopLevelMember("XML").getMember("Options")
result = API::getTopLevelMember("XML").getMember("Parser").getMember("Options")
}
private predicate bitWiseAndOr(CfgNodes::ExprNodes::OperationCfgNode operation) {

4
ql/test/query-tests/security/cwe-611/LibXmlRuby.rb
View File

@@ -2,8 +2,8 @@ class LibXmlRubyXXE < ApplicationController
content = params[:xml]
LibXML::XML::Document.string(content, { options: 2 | 2048, encoding: 'utf-8' })
LibXML::XML::Document.file(content, { options: LibXML::XML::Options::NOENT | 2048})
LibXML::XML::Document.io(content, { options: XML::Options::NOENT| 2048 })
LibXML::XML::Document.file(content, { options: LibXML::XML::Parser::Options::NOENT | 2048})
LibXML::XML::Document.io(content, { options: XML::Parser::Options::NOENT | 2048 })
LibXML::XML::Parser.string(content, { options: 2 | 2048 })
LibXML::XML::Parser.file(content, { options: 3 | 2048 })
LibXML::XML::Parser.io(content, { options: 2 | 2048})