Skip to content

Commit 3ce3fbf

Browse files
hmachmac
committed
Ruby: Block flow into flow sources
This restricts alert paths to the minimum necessary.
1 parent 4b5a203 commit 3ce3fbf

27 files changed

+54
-0
lines changed

Diff for: ‎ruby/ql/lib/codeql/ruby/security/CleartextLoggingQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ private module Config implements DataFlow::ConfigSig {
4141

4242
predicate isBarrier(DataFlow::Node node) { node instanceof CL::Sanitizer }
4343

44+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
45+
4446
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
4547
CL::isAdditionalTaintStep(nodeFrom, nodeTo)
4648
}

Diff for: ‎ruby/ql/lib/codeql/ruby/security/CleartextStorageQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ private module Config implements DataFlow::ConfigSig {
4040

4141
predicate isBarrier(DataFlow::Node node) { node instanceof CS::Sanitizer }
4242

43+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
44+
4345
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
4446
CS::isAdditionalTaintStep(nodeFrom, nodeTo)
4547
}

Diff for: ‎ruby/ql/lib/codeql/ruby/security/CodeInjectionQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ private module Config implements DataFlow::StateConfigSig {
5555
}
5656

5757
predicate isBarrier(DataFlow::Node node, FlowState state) { node.(Sanitizer).getAState() = state }
58+
59+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
5860
}
5961

6062
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/CommandInjectionQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ private module Config implements DataFlow::ConfigSig {
4141
node instanceof StringConstCompareBarrier or
4242
node instanceof StringConstArrayInclusionCallBarrier
4343
}
44+
45+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
4446
}
4547

4648
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/HardcodedDataInterpretedAsCodeQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ private module Config implements DataFlow::StateConfigSig {
5454

5555
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
5656

57+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
58+
5759
predicate isAdditionalFlowStep(
5860
DataFlow::Node nodeFrom, FlowState stateFrom, DataFlow::Node nodeTo, FlowState stateTo
5961
) {

Diff for: ‎ruby/ql/lib/codeql/ruby/security/HttpToFileAccessQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ deprecated class Configuration extends TaintTracking::Configuration {
3434

3535
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3636

37+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
38+
3739
override predicate isSanitizer(DataFlow::Node node) {
3840
super.isSanitizer(node) or
3941
node instanceof Sanitizer

Diff for: ‎ruby/ql/lib/codeql/ruby/security/InsecureDownloadQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ private module InsecureDownloadConfig implements DataFlow::StateConfigSig {
4242
predicate isSink(DataFlow::Node sink, FlowState label) { sink.(Sink).getAFlowLabel() = label }
4343

4444
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
45+
46+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
4547
}
4648

4749
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/KernelOpenQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,8 @@ private module KernelOpenConfig implements DataFlow::ConfigSig {
8585
node instanceof StringConstArrayInclusionCallBarrier or
8686
node instanceof Sanitizer
8787
}
88+
89+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
8890
}
8991

9092
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/LogInjectionQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,8 @@ private module LogInjectionConfig implements DataFlow::ConfigSig {
8787
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
8888

8989
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
90+
91+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
9092
}
9193

9294
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/PathInjectionQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ private module PathInjectionConfig implements DataFlow::ConfigSig {
3737
predicate isBarrier(DataFlow::Node node) {
3838
node instanceof Path::PathSanitization or node instanceof PathInjection::Sanitizer
3939
}
40+
41+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
4042
}
4143

4244
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/ReflectedXSSQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ private module ReflectedXssConfig implements DataFlow::ConfigSig {
4545

4646
predicate isBarrier(DataFlow::Node node) { node instanceof RX::Sanitizer }
4747

48+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
49+
4850
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
4951
RX::isAdditionalXssTaintStep(node1, node2)
5052
}

Diff for: ‎ruby/ql/lib/codeql/ruby/security/SensitiveGetQueryQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ private module SensitiveGetQueryConfig implements DataFlow::ConfigSig {
3737
predicate isSource(DataFlow::Node source) { source instanceof Source }
3838

3939
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
40+
41+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
4042
}
4143

4244
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/ServerSideRequestForgeryQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ private module ServerSideRequestForgeryConfig implements DataFlow::ConfigSig {
4141
node instanceof StringConstCompareBarrier or
4242
node instanceof StringConstArrayInclusionCallBarrier
4343
}
44+
45+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
4446
}
4547

4648
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/SqlInjectionQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ private module SqlInjectionConfig implements DataFlow::ConfigSig {
2727
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2828

2929
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
30+
31+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
3032
}
3133

3234
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/StackTraceExposureQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ private module StackTraceExposureConfig implements DataFlow::ConfigSig {
3131
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3232

3333
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
34+
35+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
3436
}
3537

3638
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/StoredXSSQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ private module StoredXssConfig implements DataFlow::ConfigSig {
5252

5353
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
5454

55+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
56+
5557
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
5658
isAdditionalXssTaintStep(node1, node2)
5759
}

Diff for: ‎ruby/ql/lib/codeql/ruby/security/TaintedFormatStringQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -40,4 +40,6 @@ deprecated class Configuration extends TaintTracking::Configuration {
4040
super.isSanitizer(node) or
4141
node instanceof Sanitizer
4242
}
43+
44+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
4345
}

Diff for: ‎ruby/ql/lib/codeql/ruby/security/UnsafeCodeConstructionQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ private module UnsafeCodeConstructionConfig implements DataFlow::ConfigSig {
4444
node instanceof StringConstArrayInclusionCallBarrier
4545
}
4646

47+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
48+
4749
// override to require the path doesn't have unmatched return steps
4850
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
4951

Diff for: ‎ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
3636
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeDeserialization::Sink }
3737

3838
predicate isBarrier(DataFlow::Node node) { node instanceof UnsafeDeserialization::Sanitizer }
39+
40+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
3941
}
4042

4143
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/UnsafeShellCommandConstructionQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ private module UnsafeShellCommandConstructionConfig implements DataFlow::ConfigS
4747
node instanceof StringConstArrayInclusionCallBarrier
4848
}
4949

50+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
51+
5052
// override to require the path doesn't have unmatched return steps
5153
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
5254

Diff for: ‎ruby/ql/lib/codeql/ruby/security/UrlRedirectQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ private module UrlRedirectConfig implements DataFlow::ConfigSig {
3737

3838
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
3939

40+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
41+
4042
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
4143
UrlRedirect::isAdditionalTaintStep(node1, node2)
4244
}

Diff for: ‎ruby/ql/lib/codeql/ruby/security/regexp/MissingFullAnchorQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ private module MissingFullAnchorConfig implements DataFlow::ConfigSig {
3232
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3333

3434
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
35+
36+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
3537
}
3638

3739
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ private module PolynomialReDoSConfig implements DataFlow::ConfigSig {
4242
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
4343

4444
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
45+
46+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
4547
}
4648

4749
/**

Diff for: ‎ruby/ql/lib/codeql/ruby/security/regexp/RegExpInjectionQuery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ private module RegExpInjectionConfig implements DataFlow::ConfigSig {
3131
predicate isSink(DataFlow::Node sink) { sink instanceof RegExpInjection::Sink }
3232

3333
predicate isBarrier(DataFlow::Node node) { node instanceof RegExpInjection::Sanitizer }
34+
35+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
3436
}
3537

3638
/**

Diff for: ‎ruby/ql/src/queries/security/cwe-611/Xxe.ql

+2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ private module XxeConfig implements DataFlow::ConfigSig {
3131
predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
3232

3333
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeXxeSink }
34+
35+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
3436
}
3537

3638
private module XxeFlow = TaintTracking::Global<XxeConfig>;

Diff for: ‎ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql

+2
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ private module PermissivePermissionsConfig implements DataFlow::ConfigSig {
5454
predicate isSink(DataFlow::Node sink) {
5555
exists(FileSystemPermissionModification mod | mod.getAPermissionNode() = sink)
5656
}
57+
58+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
5759
}
5860

5961
private module PermissivePermissionsFlow = DataFlow::Global<PermissivePermissionsConfig>;

Diff for: ‎ruby/ql/src/queries/security/cwe-798/HardcodedCredentials.ql

+2
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,8 @@ private module HardcodedCredentialsConfig implements DataFlow::ConfigSig {
136136

137137
predicate isSink(DataFlow::Node sink) { sink instanceof CredentialSink }
138138

139+
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
140+
139141
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
140142
exists(ExprNodes::BinaryOperationCfgNode binop |
141143
(

0 commit comments

Comments
 (0)