mirror of
https://github.com/github/codeql.git
synced 2026-08-04 01:13:00 +02:00
134 lines
3.0 KiB
Ruby
134 lines
3.0 KiB
Ruby
require 'zip'
|
|
|
|
class TestController < ActionController::Base
|
|
# BAD
|
|
def tarReaderUnsafe
|
|
path = params[:path]
|
|
file_stream = IO.new(IO.sysopen(path))
|
|
tarfile = Gem::Package::TarReader.new(file_stream) # $ Source
|
|
tarfile.each do |entry|
|
|
::File.open(entry.full_name, "wb") do |os| # $ Alert
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
|
|
# BAD
|
|
def tarReaderBlockUnsafe
|
|
path = params[:path]
|
|
file_stream = IO.new(IO.sysopen(path))
|
|
Gem::Package::TarReader.new(file_stream) do |tarfile| # $ Source
|
|
tarfile.each_entry do |entry|
|
|
::File.open(entry.full_name, "wb") do |os| # $ Alert
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
# GOOD
|
|
def tarReadeSanitizedExpandPath
|
|
path = params[:path]
|
|
file_stream = IO.new(IO.sysopen(path))
|
|
tarfile = Gem::Package::TarReader.new(file_stream)
|
|
tarfile.each do |entry|
|
|
entry_path = entry.full_name
|
|
next if !File.expand_path(entry_path).start_with?("/safepath/")
|
|
::File.open(entry_path, "wb") do |os|
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
|
|
# BAD
|
|
def zipFileUnsafe
|
|
path = params[:path]
|
|
Zip::File.open(path).each do |entry| # $ Source
|
|
File.open(entry.name, "wb") do |os| # $ Alert
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
|
|
# BAD
|
|
def zipFileBlockUnsafe
|
|
path = params[:path]
|
|
Zip::File.open(path) do |zip_file| # $ Source
|
|
zip_file.each do |entry|
|
|
File.open(entry.name, "wb") do |os| # $ Alert
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
# GOOD
|
|
def zipFileBlockSafeHardcodedPath
|
|
path = '/safepath.zip'
|
|
Zip::File.open(path) do |zip_file|
|
|
zip_file.each do |entry|
|
|
File.open(entry.name, "wb") do |os|
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
# GOOD
|
|
def zipFileSanitizedConstCompare
|
|
path = params[:path]
|
|
Zip::File.open(path).each do |entry|
|
|
entry_path = entry.name
|
|
raise ExtractFailed if entry_path != "/safepath"
|
|
File.open(entry_path, "wb") do |os|
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
|
|
def get_compressed_file_stream(compressed_file_path)
|
|
gzip = Zlib::GzipReader.open(compressed_file_path) # $ Source
|
|
yield(gzip)
|
|
end
|
|
|
|
# BAD
|
|
def gzipReaderUnsafe
|
|
path = params[:path]
|
|
get_compressed_file_stream(path) do |compressed_file|
|
|
compressed_file.each do |entry|
|
|
entry_path = entry.full_name
|
|
::File.open(entry_path, 'wb') do |os| # $ Alert
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
# GOOD
|
|
def gzipReaderSafeConstPath
|
|
path = "/safe.zip"
|
|
zlib = Zlib::GzipReader.open(path)
|
|
zlib.each do |entry|
|
|
entry_path = entry.full_name
|
|
::File.open(entry_path, 'wb') do |os|
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
|
|
# BAD
|
|
def gzipReaderUnsafeNewInstance
|
|
path = params[:path]
|
|
File.open(path, 'rb') do |f|
|
|
gz = Zlib::GzipReader.new(f) # $ Source
|
|
gz.each do |entry|
|
|
entry_path = entry.full_name
|
|
::File.open(entry_path, 'wb') do |os| # $ Alert
|
|
entry.read
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
end
|