hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 00:35:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Add sinks from external models

Browse Source
This commit is contained in:
Harry Maclean
2023-11-22 15:34:14 +00:00
parent ad608341ab
commit e9277a56a9
5 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ruby/ql/lib/codeql/ruby/security/CodeInjectionCustomizations.qll
View File

@@ -4,6 +4,7 @@ private import codeql.ruby.Concepts
private import codeql.ruby.Frameworks
private import codeql.ruby.dataflow.RemoteFlowSources
private import codeql.ruby.dataflow.BarrierGuards
private import codeql.ruby.frameworks.data.internal.ApiGraphModels
/**
* Provides default sources, sinks and sanitizers for detecting
@@ -156,4 +157,8 @@ module CodeInjection {
override FlowState::State getAState() { result instanceof FlowState::Full }
}
private class ExternalCodeInjectionSink extends Sink {
ExternalCodeInjectionSink() { this = ModelOutput::getASinkNode("code-injection").asSink() }
}
}

7
ruby/ql/lib/codeql/ruby/security/CommandInjectionCustomizations.qll
View File

@@ -9,6 +9,7 @@ private import codeql.ruby.dataflow.RemoteFlowSources
private import codeql.ruby.Concepts
private import codeql.ruby.Frameworks
private import codeql.ruby.ApiGraphs
private import codeql.ruby.frameworks.data.internal.ApiGraphModels
module CommandInjection {
/**
@@ -52,4 +53,10 @@ module CommandInjection {
this.(DataFlow::CallNode).getMethodName() = "shellescape"
}
}
private class ExternalCommandInjectionSink extends Sink {
ExternalCommandInjectionSink() {
this = ModelOutput::getASinkNode("command-injection").asSink()
}
}
}

5
ruby/ql/lib/codeql/ruby/security/LogInjectionQuery.qll
View File

@@ -8,6 +8,7 @@ import codeql.ruby.DataFlow
import codeql.ruby.TaintTracking
import codeql.ruby.dataflow.RemoteFlowSources
import codeql.ruby.frameworks.Core
private import codeql.ruby.frameworks.data.internal.ApiGraphModels
/**
* A data flow source for user input used in log entries.
@@ -50,6 +51,10 @@ class LoggingSink extends Sink {
LoggingSink() { this = any(Logging logging).getAnInput() }
}
private class ExternalLogInjectionSink extends Sink {
ExternalLogInjectionSink() { this = ModelOutput::getASinkNode("log-injection").asSink() }
}
/**
* A call to `String#replace` that replaces `\n` is considered to sanitize the replaced string (reduce false positive).
*/

5
ruby/ql/lib/codeql/ruby/security/PathInjectionCustomizations.qll
View File

@@ -11,6 +11,7 @@ private import codeql.ruby.Concepts
private import codeql.ruby.DataFlow
private import codeql.ruby.dataflow.BarrierGuards
private import codeql.ruby.dataflow.RemoteFlowSources
private import codeql.ruby.frameworks.data.internal.ApiGraphModels
module PathInjection {
/**
@@ -52,4 +53,8 @@ module PathInjection {
class StringConstArrayInclusionCallAsSanitizer extends Sanitizer,
StringConstArrayInclusionCallBarrier
{ }
private class ExternalPathInjectionSink extends Sink {
ExternalPathInjectionSink() { this = ModelOutput::getASinkNode("path-injection").asSink() }
}
}

5
ruby/ql/lib/codeql/ruby/security/UrlRedirectCustomizations.qll
View File

@@ -11,6 +11,7 @@ private import codeql.ruby.dataflow.RemoteFlowSources
private import codeql.ruby.dataflow.BarrierGuards
private import codeql.ruby.dataflow.Sanitizers
private import codeql.ruby.frameworks.ActionController
private import codeql.ruby.frameworks.data.internal.ApiGraphModels
/**
* Provides default sources, sinks and sanitizers for detecting
@@ -73,6 +74,10 @@ module UrlRedirect {
}
}
private class ExternalUrlRedirectSink extends Sink {
ExternalUrlRedirectSink() { this = ModelOutput::getASinkNode("url-redirect").asSink() }
}
/**
* A comparison with a constant string, considered as a sanitizer-guard.
*/