mirror of
https://github.com/github/codeql.git
synced 2026-07-24 12:42:02 +02:00
47 lines
1.5 KiB
XML
47 lines
1.5 KiB
XML
<!DOCTYPE qhelp PUBLIC
|
|
"-//Semmle//qhelp//EN"
|
|
"qhelp.dtd">
|
|
<qhelp>
|
|
|
|
<overview>
|
|
<p>
|
|
Directly evaluating user input (for example, an HTTP request parameter) as code without properly
|
|
sanitizing the input first allows an attacker arbitrary code execution. This can occur when user
|
|
input is passed to code that interprets it as an expression to be
|
|
evaluated, such as <code>eval</code> or <code>exec</code>.
|
|
</p>
|
|
</overview>
|
|
|
|
<recommendation>
|
|
<p>
|
|
Avoid including user input in any expression that may be dynamically evaluated. If user input must
|
|
be included, use context-specific escaping before including it.
|
|
It is important that the correct escaping is used for the type of evaluation that will occur.
|
|
</p>
|
|
</recommendation>
|
|
|
|
<example>
|
|
<p>
|
|
The following example shows two functions setting a name from a request.
|
|
The first function uses <code>exec</code> to execute the <code>setname</code> function.
|
|
This is dangerous as it can allow a malicious user to execute arbitrary code on the server.
|
|
For example, the user could supply the value <code>"' + subprocess.call('rm -rf') + '"</code>
|
|
to destroy the server's file system.
|
|
The second function calls the <code>setname</code> function directly and is thus safe.
|
|
|
|
</p>
|
|
|
|
<sample src="examples/code_injection.py" />
|
|
</example>
|
|
|
|
<references>
|
|
<li>
|
|
OWASP:
|
|
<a href="https://www.owasp.org/index.php/Code_Injection">Code Injection</a>.
|
|
</li>
|
|
<li>
|
|
Wikipedia: <a href="https://en.wikipedia.org/wiki/Code_injection">Code Injection</a>.
|
|
</li>
|
|
</references>
|
|
</qhelp>
|