Skip to content

Commit f89dd10

Browse files
yoffyoff
committed
ruby: Add back sanitizer as MaD model
1 parent 4226890 commit f89dd10

3 files changed

Lines changed: 11 additions & 20 deletions

File tree

‎ruby/ql/lib/codeql/ruby/frameworks/regexp/model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/ruby-all
4+
extensible: barrierModel
5+
data:
6+
- ['Regexp!', 'Method[escape,quote].ReturnValue', 'regexp-injection']

‎ruby/ql/lib/codeql/ruby/security/regexp/RegExpInjectionCustomizations.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ private import codeql.ruby.Frameworks
1010
private import codeql.ruby.dataflow.RemoteFlowSources
1111
private import codeql.ruby.dataflow.BarrierGuards
1212
private import codeql.ruby.ApiGraphs
13+
private import codeql.ruby.frameworks.data.internal.ApiGraphModels
1314

1415
/**
1516
* Provides default sources, sinks and sanitizers for detecting
@@ -68,4 +69,8 @@ module RegExpInjection {
6869
class StringConstArrayInclusionCallAsSanitizer extends Sanitizer,
6970
StringConstArrayInclusionCallBarrier
7071
{ }
72+
73+
private class ExternalRegexpInjectionSanitizer extends Sanitizer {
74+
ExternalRegexpInjectionSanitizer() { ModelOutput::barrierNode(this, "regexp-injection") }
75+
}
7176
}

‎ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.expected‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,6 @@ edges
1313
| RegExpInjection.rb:22:12:22:17 | call to params | RegExpInjection.rb:22:12:22:24 | ...[...] | provenance | |
1414
| RegExpInjection.rb:22:12:22:24 | ...[...] | RegExpInjection.rb:22:5:22:8 | name | provenance | |
1515
| RegExpInjection.rb:23:30:23:33 | name | RegExpInjection.rb:23:24:23:33 | ... + ... | provenance | |
16-
| RegExpInjection.rb:42:5:42:8 | name | RegExpInjection.rb:43:38:43:41 | name | provenance | |
17-
| RegExpInjection.rb:42:12:42:17 | call to params | RegExpInjection.rb:42:12:42:24 | ...[...] | provenance | |
18-
| RegExpInjection.rb:42:12:42:24 | ...[...] | RegExpInjection.rb:42:5:42:8 | name | provenance | |
19-
| RegExpInjection.rb:43:38:43:41 | name | RegExpInjection.rb:43:24:43:42 | call to escape | provenance | MaD:21 |
20-
| RegExpInjection.rb:48:5:48:8 | name | RegExpInjection.rb:49:37:49:40 | name | provenance | |
21-
| RegExpInjection.rb:48:12:48:17 | call to params | RegExpInjection.rb:48:12:48:24 | ...[...] | provenance | |
22-
| RegExpInjection.rb:48:12:48:24 | ...[...] | RegExpInjection.rb:48:5:48:8 | name | provenance | |
23-
| RegExpInjection.rb:49:37:49:40 | name | RegExpInjection.rb:49:24:49:41 | call to quote | provenance | MaD:21 |
2416
| RegExpInjection.rb:54:5:54:8 | name | RegExpInjection.rb:55:28:55:37 | ... + ... | provenance | |
2517
| RegExpInjection.rb:54:5:54:8 | name | RegExpInjection.rb:55:34:55:37 | name | provenance | |
2618
| RegExpInjection.rb:54:12:54:17 | call to params | RegExpInjection.rb:54:12:54:24 | ...[...] | provenance | |
@@ -44,16 +36,6 @@ nodes
4436
| RegExpInjection.rb:22:12:22:24 | ...[...] | semmle.label | ...[...] |
4537
| RegExpInjection.rb:23:24:23:33 | ... + ... | semmle.label | ... + ... |
4638
| RegExpInjection.rb:23:30:23:33 | name | semmle.label | name |
47-
| RegExpInjection.rb:42:5:42:8 | name | semmle.label | name |
48-
| RegExpInjection.rb:42:12:42:17 | call to params | semmle.label | call to params |
49-
| RegExpInjection.rb:42:12:42:24 | ...[...] | semmle.label | ...[...] |
50-
| RegExpInjection.rb:43:24:43:42 | call to escape | semmle.label | call to escape |
51-
| RegExpInjection.rb:43:38:43:41 | name | semmle.label | name |
52-
| RegExpInjection.rb:48:5:48:8 | name | semmle.label | name |
53-
| RegExpInjection.rb:48:12:48:17 | call to params | semmle.label | call to params |
54-
| RegExpInjection.rb:48:12:48:24 | ...[...] | semmle.label | ...[...] |
55-
| RegExpInjection.rb:49:24:49:41 | call to quote | semmle.label | call to quote |
56-
| RegExpInjection.rb:49:37:49:40 | name | semmle.label | name |
5739
| RegExpInjection.rb:54:5:54:8 | name | semmle.label | name |
5840
| RegExpInjection.rb:54:12:54:17 | call to params | semmle.label | call to params |
5941
| RegExpInjection.rb:54:12:54:24 | ...[...] | semmle.label | ...[...] |
@@ -65,6 +47,4 @@ subpaths
6547
| RegExpInjection.rb:11:13:11:27 | /foo#{...}bar/ | RegExpInjection.rb:10:12:10:17 | call to params | RegExpInjection.rb:11:13:11:27 | /foo#{...}bar/ | This regular expression depends on a $@. | RegExpInjection.rb:10:12:10:17 | call to params | user-provided value |
6648
| RegExpInjection.rb:17:24:17:27 | name | RegExpInjection.rb:16:12:16:17 | call to params | RegExpInjection.rb:17:24:17:27 | name | This regular expression depends on a $@. | RegExpInjection.rb:16:12:16:17 | call to params | user-provided value |
6749
| RegExpInjection.rb:23:24:23:33 | ... + ... | RegExpInjection.rb:22:12:22:17 | call to params | RegExpInjection.rb:23:24:23:33 | ... + ... | This regular expression depends on a $@. | RegExpInjection.rb:22:12:22:17 | call to params | user-provided value |
68-
| RegExpInjection.rb:43:24:43:42 | call to escape | RegExpInjection.rb:42:12:42:17 | call to params | RegExpInjection.rb:43:24:43:42 | call to escape | This regular expression depends on a $@. | RegExpInjection.rb:42:12:42:17 | call to params | user-provided value |
69-
| RegExpInjection.rb:49:24:49:41 | call to quote | RegExpInjection.rb:48:12:48:17 | call to params | RegExpInjection.rb:49:24:49:41 | call to quote | This regular expression depends on a $@. | RegExpInjection.rb:48:12:48:17 | call to params | user-provided value |
7050
| RegExpInjection.rb:55:28:55:37 | ... + ... | RegExpInjection.rb:54:12:54:17 | call to params | RegExpInjection.rb:55:28:55:37 | ... + ... | This regular expression depends on a $@. | RegExpInjection.rb:54:12:54:17 | call to params | user-provided value |

0 commit comments

Comments
 (0)