Skip to content

Commit bc0ed45

Browse files
asgerfasgerf
committed
Ruby: use DeduplicatePathGraph in CodeInjection query
1 parent 26f15e0 commit bc0ed45

File tree

2 files changed

+34
-83
lines changed

2 files changed

+34
-83
lines changed

‎ruby/ql/src/queries/security/cwe-094/CodeInjection.ql‎

Lines changed: 4 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,9 @@
1616

1717
private import codeql.ruby.AST
1818
private import codeql.ruby.security.CodeInjectionQuery
19-
import CodeInjectionFlow::PathGraph
19+
import DataFlow::DeduplicatePathGraph<CodeInjectionFlow::PathNode, CodeInjectionFlow::PathGraph>
2020

21-
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Source sourceNode
22-
where
23-
CodeInjectionFlow::flowPath(source, sink) and
24-
sourceNode = source.getNode() and
25-
// removing duplications of the same path, but different flow-labels.
26-
sink =
27-
min(CodeInjectionFlow::PathNode otherSink |
28-
CodeInjectionFlow::flowPath(any(CodeInjectionFlow::PathNode s | s.getNode() = sourceNode),
29-
otherSink) and
30-
otherSink.getNode() = sink.getNode()
31-
|
32-
otherSink order by otherSink.getState().getStringRepresentation()
33-
)
34-
select sink.getNode(), source, sink, "This code execution depends on a $@.", sourceNode,
21+
from PathNode source, PathNode sink
22+
where CodeInjectionFlow::flowPath(source.getAnOriginalPathNode(), sink.getAnOriginalPathNode())
23+
select sink.getNode(), source, sink, "This code execution depends on a $@.", source.getNode(),
3524
"user-provided value"

‎ruby/ql/test/query-tests/security/cwe-094/CodeInjection/CodeInjection.expected‎

Lines changed: 30 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,78 +1,19 @@
1-
edges
2-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:8:10:8:13 | code |
3-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:8:10:8:13 | code |
4-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:20:20:20:23 | code |
5-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:20:20:20:23 | code |
6-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:23:21:23:24 | code |
7-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:23:21:23:24 | code |
8-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:29:15:29:18 | code |
9-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:32:19:32:22 | code |
10-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:38:24:38:27 | code |
11-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:38:24:38:27 | code |
12-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:41:40:41:43 | code |
13-
| CodeInjection.rb:5:12:5:17 | call to params | CodeInjection.rb:5:12:5:24 | ...[...] |
14-
| CodeInjection.rb:5:12:5:17 | call to params | CodeInjection.rb:5:12:5:24 | ...[...] |
15-
| CodeInjection.rb:5:12:5:24 | ...[...] | CodeInjection.rb:5:5:5:8 | code |
16-
| CodeInjection.rb:5:12:5:24 | ...[...] | CodeInjection.rb:5:5:5:8 | code |
17-
| CodeInjection.rb:38:24:38:27 | code | CodeInjection.rb:38:10:38:28 | call to escape |
18-
| CodeInjection.rb:38:24:38:27 | code | CodeInjection.rb:38:10:38:28 | call to escape |
19-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:80:16:80:19 | code |
20-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:10:86:25 | ... + ... |
21-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:10:86:37 | ... + ... |
22-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:22:86:25 | code |
23-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:88:10:88:32 | "prefix_#{...}_suffix" |
24-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:90:10:90:13 | code |
25-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:90:10:90:13 | code |
26-
| CodeInjection.rb:78:12:78:17 | call to params | CodeInjection.rb:78:12:78:24 | ...[...] |
27-
| CodeInjection.rb:78:12:78:17 | call to params | CodeInjection.rb:78:12:78:24 | ...[...] |
28-
| CodeInjection.rb:78:12:78:24 | ...[...] | CodeInjection.rb:78:5:78:8 | code |
29-
| CodeInjection.rb:78:12:78:24 | ...[...] | CodeInjection.rb:78:5:78:8 | code |
30-
| CodeInjection.rb:86:10:86:25 | ... + ... | CodeInjection.rb:86:10:86:37 | ... + ... |
31-
| CodeInjection.rb:86:10:86:25 | ... + ... [element] | CodeInjection.rb:86:10:86:37 | ... + ... [element] |
32-
| CodeInjection.rb:86:10:86:37 | ... + ... [element] | CodeInjection.rb:86:10:86:37 | ... + ... |
33-
| CodeInjection.rb:86:22:86:25 | code | CodeInjection.rb:86:10:86:25 | ... + ... [element] |
34-
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | CodeInjection.rb:111:3:113:5 | self in baz [@foo] |
35-
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | CodeInjection.rb:111:3:113:5 | self in baz [@foo] |
36-
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | CodeInjection.rb:108:3:109:5 | self in bar [@foo] |
37-
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | CodeInjection.rb:108:3:109:5 | self in bar [@foo] |
38-
| CodeInjection.rb:105:12:105:17 | call to params | CodeInjection.rb:105:12:105:23 | ...[...] |
39-
| CodeInjection.rb:105:12:105:17 | call to params | CodeInjection.rb:105:12:105:23 | ...[...] |
40-
| CodeInjection.rb:105:12:105:23 | ...[...] | CodeInjection.rb:105:5:105:8 | [post] self [@foo] |
41-
| CodeInjection.rb:105:12:105:23 | ...[...] | CodeInjection.rb:105:5:105:8 | [post] self [@foo] |
42-
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | CodeInjection.rb:101:3:102:5 | self in index [@foo] |
43-
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | CodeInjection.rb:101:3:102:5 | self in index [@foo] |
44-
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | CodeInjection.rb:112:10:112:13 | self [@foo] |
45-
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | CodeInjection.rb:112:10:112:13 | self [@foo] |
46-
| CodeInjection.rb:112:10:112:13 | self [@foo] | CodeInjection.rb:112:10:112:13 | @foo |
47-
| CodeInjection.rb:112:10:112:13 | self [@foo] | CodeInjection.rb:112:10:112:13 | @foo |
481
nodes
492
| CodeInjection.rb:5:5:5:8 | code | semmle.label | code |
50-
| CodeInjection.rb:5:5:5:8 | code | semmle.label | code |
51-
| CodeInjection.rb:5:12:5:17 | call to params | semmle.label | call to params |
523
| CodeInjection.rb:5:12:5:17 | call to params | semmle.label | call to params |
534
| CodeInjection.rb:5:12:5:24 | ...[...] | semmle.label | ...[...] |
54-
| CodeInjection.rb:5:12:5:24 | ...[...] | semmle.label | ...[...] |
55-
| CodeInjection.rb:8:10:8:13 | code | semmle.label | code |
565
| CodeInjection.rb:8:10:8:13 | code | semmle.label | code |
576
| CodeInjection.rb:11:10:11:15 | call to params | semmle.label | call to params |
58-
| CodeInjection.rb:11:10:11:15 | call to params | semmle.label | call to params |
59-
| CodeInjection.rb:20:20:20:23 | code | semmle.label | code |
607
| CodeInjection.rb:20:20:20:23 | code | semmle.label | code |
618
| CodeInjection.rb:23:21:23:24 | code | semmle.label | code |
62-
| CodeInjection.rb:23:21:23:24 | code | semmle.label | code |
639
| CodeInjection.rb:29:15:29:18 | code | semmle.label | code |
6410
| CodeInjection.rb:32:19:32:22 | code | semmle.label | code |
6511
| CodeInjection.rb:38:10:38:28 | call to escape | semmle.label | call to escape |
66-
| CodeInjection.rb:38:10:38:28 | call to escape | semmle.label | call to escape |
67-
| CodeInjection.rb:38:24:38:27 | code | semmle.label | code |
6812
| CodeInjection.rb:38:24:38:27 | code | semmle.label | code |
6913
| CodeInjection.rb:41:40:41:43 | code | semmle.label | code |
7014
| CodeInjection.rb:78:5:78:8 | code | semmle.label | code |
71-
| CodeInjection.rb:78:5:78:8 | code | semmle.label | code |
72-
| CodeInjection.rb:78:12:78:17 | call to params | semmle.label | call to params |
7315
| CodeInjection.rb:78:12:78:17 | call to params | semmle.label | call to params |
7416
| CodeInjection.rb:78:12:78:24 | ...[...] | semmle.label | ...[...] |
75-
| CodeInjection.rb:78:12:78:24 | ...[...] | semmle.label | ...[...] |
7617
| CodeInjection.rb:80:16:80:19 | code | semmle.label | code |
7718
| CodeInjection.rb:86:10:86:25 | ... + ... | semmle.label | ... + ... |
7819
| CodeInjection.rb:86:10:86:25 | ... + ... [element] | semmle.label | ... + ... [element] |
@@ -81,23 +22,44 @@ nodes
8122
| CodeInjection.rb:86:22:86:25 | code | semmle.label | code |
8223
| CodeInjection.rb:88:10:88:32 | "prefix_#{...}_suffix" | semmle.label | "prefix_#{...}_suffix" |
8324
| CodeInjection.rb:90:10:90:13 | code | semmle.label | code |
84-
| CodeInjection.rb:90:10:90:13 | code | semmle.label | code |
85-
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | semmle.label | self in index [@foo] |
8625
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | semmle.label | self in index [@foo] |
8726
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | semmle.label | [post] self [@foo] |
88-
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | semmle.label | [post] self [@foo] |
8927
| CodeInjection.rb:105:12:105:17 | call to params | semmle.label | call to params |
90-
| CodeInjection.rb:105:12:105:17 | call to params | semmle.label | call to params |
91-
| CodeInjection.rb:105:12:105:23 | ...[...] | semmle.label | ...[...] |
9228
| CodeInjection.rb:105:12:105:23 | ...[...] | semmle.label | ...[...] |
9329
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | semmle.label | self in bar [@foo] |
94-
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | semmle.label | self in bar [@foo] |
9530
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | semmle.label | self in baz [@foo] |
96-
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | semmle.label | self in baz [@foo] |
97-
| CodeInjection.rb:112:10:112:13 | @foo | semmle.label | @foo |
9831
| CodeInjection.rb:112:10:112:13 | @foo | semmle.label | @foo |
9932
| CodeInjection.rb:112:10:112:13 | self [@foo] | semmle.label | self [@foo] |
100-
| CodeInjection.rb:112:10:112:13 | self [@foo] | semmle.label | self [@foo] |
33+
edges
34+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:8:10:8:13 | code |
35+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:20:20:20:23 | code |
36+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:23:21:23:24 | code |
37+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:29:15:29:18 | code |
38+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:32:19:32:22 | code |
39+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:38:24:38:27 | code |
40+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:41:40:41:43 | code |
41+
| CodeInjection.rb:5:12:5:17 | call to params | CodeInjection.rb:5:12:5:24 | ...[...] |
42+
| CodeInjection.rb:5:12:5:24 | ...[...] | CodeInjection.rb:5:5:5:8 | code |
43+
| CodeInjection.rb:38:24:38:27 | code | CodeInjection.rb:38:10:38:28 | call to escape |
44+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:80:16:80:19 | code |
45+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:10:86:25 | ... + ... |
46+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:10:86:37 | ... + ... |
47+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:22:86:25 | code |
48+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:88:10:88:32 | "prefix_#{...}_suffix" |
49+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:90:10:90:13 | code |
50+
| CodeInjection.rb:78:12:78:17 | call to params | CodeInjection.rb:78:12:78:24 | ...[...] |
51+
| CodeInjection.rb:78:12:78:24 | ...[...] | CodeInjection.rb:78:5:78:8 | code |
52+
| CodeInjection.rb:86:10:86:25 | ... + ... | CodeInjection.rb:86:10:86:37 | ... + ... |
53+
| CodeInjection.rb:86:10:86:25 | ... + ... [element] | CodeInjection.rb:86:10:86:37 | ... + ... [element] |
54+
| CodeInjection.rb:86:10:86:37 | ... + ... [element] | CodeInjection.rb:86:10:86:37 | ... + ... |
55+
| CodeInjection.rb:86:22:86:25 | code | CodeInjection.rb:86:10:86:25 | ... + ... [element] |
56+
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | CodeInjection.rb:111:3:113:5 | self in baz [@foo] |
57+
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | CodeInjection.rb:108:3:109:5 | self in bar [@foo] |
58+
| CodeInjection.rb:105:12:105:17 | call to params | CodeInjection.rb:105:12:105:23 | ...[...] |
59+
| CodeInjection.rb:105:12:105:23 | ...[...] | CodeInjection.rb:105:5:105:8 | [post] self [@foo] |
60+
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | CodeInjection.rb:101:3:102:5 | self in index [@foo] |
61+
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | CodeInjection.rb:112:10:112:13 | self [@foo] |
62+
| CodeInjection.rb:112:10:112:13 | self [@foo] | CodeInjection.rb:112:10:112:13 | @foo |
10163
subpaths
10264
#select
10365
| CodeInjection.rb:8:10:8:13 | code | CodeInjection.rb:5:12:5:17 | call to params | CodeInjection.rb:8:10:8:13 | code | This code execution depends on a $@. | CodeInjection.rb:5:12:5:17 | call to params | user-provided value |

0 commit comments

Comments
 (0)