Files
codeql/ruby/ql/test/query-tests/security/cwe-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.rb
2026-06-16 10:40:39 +01:00

82 lines
2.8 KiB
Ruby

def foo
/^http:\/\/example.com/; # OK
/^http:\/\/test.example.com/; # $ Alert // NOT OK
/^http:\/\/test\.example.com/; # OK
/^http:\/\/test.example.net/; # $ Alert // NOT OK
/^http:\/\/test.(example-a|example-b).com/; # $ Alert // NOT OK
/^http:\/\/(.+).example.com\//; # $ Alert // NOT OK
/^http:\/\/(\.+)\.example.com/; # OK
/^http:\/\/(?:.+)\.test\.example.com\//; # $ Alert // NOT OK
/^http:\/\/test.example.com\/(?:.*)/; # $ Alert // OK
Regexp.new("^http://test.example.com"); # $ Alert // NOT OK
if (s.match("^http://test.example.com")); end # $ Alert // NOT OK
Regexp.new(id(id(id("^http://test.example.com")))); # $ Alert // NOT OK
Regexp.new(`test.example.com$`); # $ Alert // NOT OK
hostname = '^test.example.com'; # $ Alert // NOT OK
Regexp.new("#{hostname}$"); # $ Alert
domain = { hostname: 'test.example.com$' }; # $ Alert // NOT OK
Regexp.new(domain[:hostname]);
convert1({ hostname: 'test.example.com$' }); # $ Alert // NOT OK
domains = [ { hostname: 'test.example.com$' } ]; # $ MISSING: Alert # NOT OK - but not flagged due to limitations of TypeTracking.
domains.map{ |d| convert2(d) };
/^(.+\.(?:example-a|example-b)\.com)\//; # NOT OK
/^(https?:)?\/\/((service|www).)?example.com(?=$|\/)/; # $ Alert // NOT OK
/^(http|https):\/\/www.example.com\/p\/f\//; # $ Alert // NOT OK
/^(http:\/\/sub.example.com\/)/i; # $ Alert // NOT OK
/^https?:\/\/api.example.com/; # $ Alert // NOT OK
Regexp.new('^http://localhost:8000|' + "^https?://.+\\.example\\.com/"); # $ Alert // NOT OK
Regexp.new("^http[s]?:\/\/?sub1\\.sub2\\.example\\.com\/f\/(.+)"); # $ MISSING: Alert # NOT OK
/^https:\/\/[a-z]*.example.com$/; # $ Alert // NOT OK
Regexp.compile('^protos?://(localhost|.+.example.net|.+.example-a.com|.+.example-b.com|.+.example.internal)'); # $ Alert // NOT OK
/^(example.dev|example.com)/; # OK
Regexp.new('^http://localhost:8000|' + "^https?://.+.example\\.com/"); # $ Alert // NOT OK
primary = 'example.com$';
Regexp.new('test.' + primary); # $ MISSING: Alert # NOT OK, but not detected
Regexp.new('test.' + 'example.com$'); # $ MISSING: Alert # NOT OK
Regexp.new('^http://test\.example.com'); # $ MISSING: Alert # NOT OK
/^http:\/\/(..|...)\.example\.com\/index\.html/; # OK, wildcards are intentional
/^http:\/\/.\.example\.com\/index\.html/; # OK, the wildcard is intentional
/^(foo.example\.com|whatever)$/; # $ Alert // kinda OK - one disjunction doesn't even look like a hostname
end
def id(e); return e; end
def convert1(domain)
return Regexp.new(domain[:hostname]);
end
def convert2(domain)
return Regexp.new(domain[:hostname]);
end
class A
def self.match?(x) = true
end
A.match?("^http://test.example.com") # OK
class B
def self.match?(x)
some_string.match?(x)
end
end
B.match?("^http://test.example.com") # $ Alert // NOT OK