mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
71 lines
2.3 KiB
Ruby
71 lines
2.3 KiB
Ruby
class FooController < ActionController::Base
|
|
|
|
def some_request_handler
|
|
# A string tainted by user input is inserted into a query
|
|
# (i.e a remote flow source)
|
|
name = params[:name]
|
|
|
|
# Establish a connection to a PostgreSQL database
|
|
conn = PG::Connection.open(:dbname => 'postgresql', :user => 'user', :password => 'pass', :host => 'localhost', :port => '5432')
|
|
|
|
# .exec() and .async_exec()
|
|
# BAD: SQL statement constructed from user input
|
|
qry1 = "SELECT * FROM users WHERE username = '#{name}';"
|
|
conn.exec(qry1)
|
|
conn.async_exec(qry1)
|
|
|
|
# .exec_params() and .async_exec_params()
|
|
# BAD: SQL statement constructed from user input
|
|
qry2 = "SELECT * FROM users WHERE username = '#{name}';"
|
|
conn.exec_params(qry2)
|
|
conn.async_exec_params(qry2)
|
|
|
|
# .exec_params() and .async_exec_params()
|
|
# GOOD: SQL statement constructed from sanitized user input
|
|
qry2 = "SELECT * FROM users WHERE username = $1;"
|
|
conn.exec_params(qry2, [name])
|
|
conn.async_exec_params(qry2, [name])
|
|
|
|
# .prepare() and .exec_prepared()
|
|
# BAD: SQL statement constructed from user input
|
|
qry3 = "SELECT * FROM users WHERE username = '#{name}';"
|
|
conn.prepare("query_1", qry3)
|
|
conn.exec_prepared('query_1')
|
|
|
|
# .prepare() and .exec_prepared()
|
|
# GOOD: SQL statement constructed from sanitized user input
|
|
qry3 = "SELECT * FROM users WHERE username = $1;"
|
|
conn.prepare("query_2", qry3)
|
|
conn.exec_prepared('query_2', [name])
|
|
|
|
# .prepare() and .exec_prepared()
|
|
# NOT EXECUTED: SQL statement constructed from user input but not executed
|
|
qry3 = "SELECT * FROM users WHERE username = '#{name}';"
|
|
conn.prepare("query_3", qry3)
|
|
end
|
|
end
|
|
|
|
class BarController < ApplicationController
|
|
def safe_paths
|
|
name1 = params["name1"]
|
|
# GOOD: barrier guard prevents taint flow
|
|
if name == "admin"
|
|
qry_bar1 = "SELECT * FROM users WHERE username = '%s';" % name
|
|
else
|
|
qry_bar1 = "SELECT * FROM users WHERE username = 'none';"
|
|
end
|
|
conn.exec_params(qry_bar1)
|
|
|
|
|
|
name2 = params["name2"]
|
|
# GOOD: barrier guard prevents taint flow
|
|
name2 = if ["admin", "guest"].include? name2
|
|
name2
|
|
else
|
|
name2 = "none"
|
|
end
|
|
qry_bar2 = "SELECT * FROM users WHERE username = '%s';" % name
|
|
conn.exec_params(qry_bar2)
|
|
end
|
|
end
|