8 Commits

Author	SHA1	Message	Date
Harry Maclean	739661eb10	Test that KernelMethodCall is specific enough ... Calls to `UnknownModule.system`, where `UnknownModule` is a module that we know nothing about, should not be identified as instances of `KernelMethodCall`.	2021-09-17 17:02:17 +01:00
Harry Maclean	599dc28ffa	Add another test for shell interpretation	2021-09-17 17:02:17 +01:00
Harry Maclean	f8359767bc	Exclude non-shell interpreted args ... Update the CommandInjection query to only consider sinks where the argument is interpreted by a shell. If the argument is passed directly to a subprocess then it's not vulnerable to shell injection.	2021-09-17 17:02:17 +01:00
Harry Maclean	c8e9a592f0	Update CLI injection tests ... Cover more cases, like sinks after (but not guarded by) barrier guards.	2021-09-17 17:02:17 +01:00
Harry Maclean	fb23a2e3bf	Add SubshellHeredocExecution ... This is a form of command execution: result = <<`EOF` echo foo bar #{baz} EOF	2021-09-17 17:02:17 +01:00
Harry Maclean	799ef4e4c9	Add barrier guards for CLI injection	2021-09-17 17:02:17 +01:00
Harry Maclean	8f65d78cb5	Add Shellwords.escape as CLI injection sanitizer	2021-09-17 17:02:17 +01:00
Harry Maclean	4a0d7c528a	Add top-level CLI injection query and tests	2021-09-17 17:02:17 +01:00