Skip to content

Commit b10a296

Browse files
aibaarsaibaars
committed
Rust: add more path-injection sinks
1 parent efedfa1 commit b10a296

File tree

4 files changed

+65
-5
lines changed

4 files changed

+65
-5
lines changed

‎rust/ql/lib/codeql/rust/frameworks/stdlib/fs.model.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,33 @@ extensions:
77
pack: codeql/rust-all
88
extensible: sinkModel
99
data:
10+
- ["lang:std", "crate::fs::copy", "Argument[0]", "path-injection", "manual"]
11+
- ["lang:std", "crate::fs::copy", "Argument[1]", "path-injection", "manual"]
12+
- ["lang:std", "crate::fs::create_dir", "Argument[0]", "path-injection", "manual"]
13+
- ["lang:std", "crate::fs::create_dir_all", "Argument[0]", "path-injection", "manual"]
14+
- ["lang:std", "crate::fs::hard_link", "Argument[0]", "path-injection", "manual"]
15+
- ["lang:std", "crate::fs::hard_link", "Argument[1]", "path-injection", "manual"]
16+
- ["lang:std", "crate::fs::metadata", "Argument[0]", "path-injection", "manual"]
17+
- ["lang:std", "crate::fs::read", "Argument[0]", "path-injection", "manual"]
18+
- ["lang:std", "crate::fs::read_dir", "Argument[0]", "path-injection", "manual"]
19+
- ["lang:std", "crate::fs::read_link", "Argument[0]", "path-injection", "manual"]
1020
- ["lang:std", "crate::fs::read_to_string", "Argument[0]", "path-injection", "manual"]
21+
- ["lang:std", "crate::fs::remove_dir", "Argument[0]", "path-injection", "manual"]
22+
- ["lang:std", "crate::fs::remove_dir_all", "Argument[0]", "path-injection", "manual"]
23+
- ["lang:std", "crate::fs::remove_file", "Argument[0]", "path-injection", "manual"]
24+
- ["lang:std", "crate::fs::rename", "Argument[0]", "path-injection", "manual"]
25+
- ["lang:std", "crate::fs::rename", "Argument[1]", "path-injection", "manual"]
26+
- ["lang:std", "crate::fs::set_permissions", "Argument[0]", "path-injection", "manual"]
27+
- ["lang:std", "crate::fs::soft_link", "Argument[0]", "path-injection", "manual"]
28+
- ["lang:std", "crate::fs::soft_link", "Argument[1]", "path-injection", "manual"]
29+
- ["lang:std", "crate::fs::symlink_metadata", "Argument[0]", "path-injection", "manual"]
30+
- ["lang:std", "crate::fs::write", "Argument[0]", "path-injection", "manual"]
31+
- ["lang:std", "<crate::fs::DirBuilder>::create", "Argument[0]", "path-injection", "manual"]
32+
- ["lang:std", "<crate::fs::File>::create", "Argument[0]", "path-injection", "manual"]
33+
- ["lang:std", "<crate::fs::File>::create_buffered", "Argument[0]", "path-injection", "manual"]
34+
- ["lang:std", "<crate::fs::File>::create_new", "Argument[0]", "path-injection", "manual"]
35+
- ["lang:std", "<crate::fs::File>::open", "Argument[0]", "path-injection", "manual"]
36+
- ["lang:std", "<crate::fs::File>::open_buffered", "Argument[0]", "path-injection", "manual"]
1137

1238
- addsTo:
1339
pack: codeql/rust-all

‎rust/ql/test/query-tests/security/CWE-020/RegexInjection.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,14 @@
33
edges
44
| main.rs:4:9:4:16 | username | main.rs:5:25:5:44 | MacroExpr | provenance | |
55
| main.rs:4:20:4:32 | ...::var | main.rs:4:20:4:40 | ...::var(...) [Ok] | provenance | Src:MaD:62 |
6-
| main.rs:4:20:4:40 | ...::var(...) [Ok] | main.rs:4:20:4:66 | ... .unwrap_or(...) | provenance | MaD:1599 |
6+
| main.rs:4:20:4:40 | ...::var(...) [Ok] | main.rs:4:20:4:66 | ... .unwrap_or(...) | provenance | MaD:1625 |
77
| main.rs:4:20:4:66 | ... .unwrap_or(...) | main.rs:4:9:4:16 | username | provenance | |
88
| main.rs:5:9:5:13 | regex | main.rs:6:26:6:30 | regex | provenance | |
99
| main.rs:5:17:5:45 | res | main.rs:5:25:5:44 | { ... } | provenance | |
1010
| main.rs:5:25:5:44 | ...::format(...) | main.rs:5:17:5:45 | res | provenance | |
1111
| main.rs:5:25:5:44 | ...::must_use(...) | main.rs:5:9:5:13 | regex | provenance | |
12-
| main.rs:5:25:5:44 | MacroExpr | main.rs:5:25:5:44 | ...::format(...) | provenance | MaD:72 |
13-
| main.rs:5:25:5:44 | { ... } | main.rs:5:25:5:44 | ...::must_use(...) | provenance | MaD:3022 |
12+
| main.rs:5:25:5:44 | MacroExpr | main.rs:5:25:5:44 | ...::format(...) | provenance | MaD:98 |
13+
| main.rs:5:25:5:44 | { ... } | main.rs:5:25:5:44 | ...::must_use(...) | provenance | MaD:3048 |
1414
| main.rs:6:26:6:30 | regex | main.rs:6:25:6:30 | &regex | provenance | |
1515
nodes
1616
| main.rs:4:9:4:16 | username | semmle.label | username |

‎rust/ql/test/query-tests/security/CWE-022/rust-toolchain.toml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# This file specifies the Rust version used to develop and test the
2+
# extractors written in rust. It is set to the lowest version of Rust
3+
# we want to support.
4+
5+
[toolchain]
6+
channel = "nightly"
7+
profile = "minimal"
8+
components = [ ]

‎rust/ql/test/query-tests/security/CWE-022/src/main.rs‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1+
#![feature(file_buffered)]
12
use poem::{error::InternalServerError, handler, http::StatusCode, web::Query, Error, Result};
2-
use std::{fs, path::PathBuf};
3-
3+
use std::{fs, path::Path, path::PathBuf};
44
//#[handler]
55
fn tainted_path_handler_bad(
66
Query(file_name): Query<String>, // $ Source=remote1
@@ -59,4 +59,30 @@ fn tainted_path_handler_folder_almost_good2(
5959
fs::read_to_string(file_path).map_err(InternalServerError) // $ path-injection-sink Alert[rust/path-injection]=remote5
6060
}
6161

62+
fn sinks(path1: &Path, path2: &Path) {
63+
let _ = std::fs::copy(path1, path2); // $ path-injection-sink
64+
let _ = std::fs::create_dir(path1); // $ path-injection-sink
65+
let _ = std::fs::create_dir_all(path1); // $ path-injection-sink
66+
let _ = std::fs::hard_link(path1, path2); // $ path-injection-sink
67+
let _ = std::fs::metadata(path1); // $ path-injection-sink
68+
let _ = std::fs::read(path1); // $ path-injection-sink
69+
let _ = std::fs::read_dir(path1); // $ path-injection-sink
70+
let _ = std::fs::read_link(path1); // $ path-injection-sink
71+
let _ = std::fs::read_to_string(path1); // $ path-injection-sink
72+
let _ = std::fs::remove_dir(path1); // $ path-injection-sink
73+
let _ = std::fs::remove_dir_all(path1); // $ path-injection-sink
74+
let _ = std::fs::remove_file(path1); // $ path-injection-sink
75+
let _ = std::fs::rename(path1, path2); // $ path-injection-sink
76+
let _ = std::fs::set_permissions(path1, std::os::unix::fs::PermissionsExt::from_mode(7)); // $ path-injection-sink
77+
let _ = std::fs::soft_link(path1, path2); // $ path-injection-sink
78+
let _ = std::fs::symlink_metadata(path1); // $ path-injection-sink
79+
let _ = std::fs::write(path1, "contents"); // $ path-injection-sink
80+
let _ = std::fs::DirBuilder::new().create(path1); // $ path-injection-sink
81+
let _ = std::fs::File::create(path1); // $ path-injection-sink
82+
let _ = std::fs::File::create_buffered(path1); // $ path-injection-sink
83+
let _ = std::fs::File::create_new(path1); // $ path-injection-sink
84+
let _ = std::fs::File::open(path1); // $ path-injection-sink
85+
let _ = std::fs::File::open_buffered(path1); // $ path-injection-sink
86+
}
87+
6288
fn main() {}

0 commit comments

Comments
 (0)