hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 23:35:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

use the sanitizers from ReflectedXSS in unsafe-html-construction

Browse Source
This commit is contained in:
erik-krogh
2024-03-20 10:11:07 +01:00
parent 0bb86fc087
commit db3bf0e482
2 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ruby/ql/lib/codeql/ruby/security/UnsafeHtmlConstructionCustomizations.qll
View File

@@ -7,6 +7,7 @@
private import ruby
private import codeql.ruby.ApiGraphs
private import codeql.ruby.frameworks.core.Gem::Gem as Gem
private import codeql.ruby.security.XSS::ReflectedXss as ReflectedXss
private import codeql.ruby.typetracking.TypeTracking
/**
@@ -34,7 +35,11 @@ module UnsafeHtmlConstruction {
abstract string getSinkType();
}
private import codeql.ruby.security.XSS::ReflectedXss as ReflectedXss
/** A sanitizer for HTML constructed from library input vulnerabilities. */
abstract class Sanitizer extends DataFlow::Node { }
// inherit all the sanitizers from ReflectedXss
class ReflectedXssSanitizers extends Sanitizer instanceof ReflectedXss::Sanitizer { }
/** Gets a node that eventually ends up in the XSS `sink`. */
private DataFlow::Node getANodeThatEndsInXssSink(ReflectedXss::Sink sink) {

10
ruby/ql/lib/codeql/ruby/security/UnsafeHtmlConstructionQuery.qll
View File

@@ -23,10 +23,7 @@ deprecated class Configuration extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
override predicate isSanitizer(DataFlow::Node node) {
node instanceof StringConstCompareBarrier or
node instanceof StringConstArrayInclusionCallBarrier
}
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
// override to require the path doesn't have unmatched return steps
override DataFlow::FlowFeature getAFeature() {
@@ -39,10 +36,7 @@ private module UnsafeHtmlConstructionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) {
node instanceof StringConstCompareBarrier or
node instanceof StringConstArrayInclusionCallBarrier
}
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
// override to require the path doesn't have unmatched return steps
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }