Skip to content

Commit e66ae68

Browse files
chanel-ychanel-y
committed
add ValidateAttribute case
1 parent 5e0ef92 commit e66ae68

File tree

3 files changed

+47
-19
lines changed

3 files changed

+47
-19
lines changed

‎powershell/ql/lib/semmle/code/powershell/security/CommandInjectionCustomizations.qll‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,17 @@ module CommandInjection {
228228
}
229229
}
230230

231+
class ValidateAttributeSanitizer extends Sanitizer {
232+
ValidateAttributeSanitizer() {
233+
exists(Function f, Attribute a, Parameter p |
234+
p = f.getAParameter() and
235+
p.getAnAttribute() = a and
236+
a.getName() = ["ValidateScript", "ValidateSet", "ValidatePattern"] and
237+
this.asParameter() = p
238+
)
239+
}
240+
}
241+
231242
class SingleQuoteSanitizer extends Sanitizer {
232243
SingleQuoteSanitizer() {
233244
exists(ExpandableStringExpr e, VarReadAccess v |

‎powershell/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -61,14 +61,14 @@ edges
6161
| test.ps1:185:42:185:47 | input | test.ps1:144:11:144:20 | userinput | provenance | |
6262
| test.ps1:186:58:186:63 | input | test.ps1:153:11:153:20 | userinput | provenance | |
6363
| test.ps1:187:41:187:46 | input | test.ps1:159:11:159:20 | userinput | provenance | |
64-
| test.ps1:228:5:228:6 | o | test.ps1:231:7:231:10 | $o | provenance | |
65-
| test.ps1:228:10:228:32 | Call to read-host | test.ps1:228:5:228:6 | o | provenance | Src:MaD:0 |
66-
| test.ps1:239:5:239:10 | input | test.ps1:240:5:240:21 | env:bar | provenance | |
67-
| test.ps1:239:5:239:10 | input | test.ps1:240:5:240:21 | env:bar | provenance | |
68-
| test.ps1:239:14:239:36 | Call to read-host | test.ps1:239:5:239:10 | input | provenance | Src:MaD:0 |
69-
| test.ps1:239:14:239:36 | Call to read-host | test.ps1:239:5:239:10 | input | provenance | Src:MaD:0 |
70-
| test.ps1:240:5:240:21 | env:bar | test.ps1:242:5:242:6 | y | provenance | |
71-
| test.ps1:242:5:242:6 | y | test.ps1:243:7:243:10 | $y | provenance | |
64+
| test.ps1:245:5:245:6 | o | test.ps1:248:7:248:10 | $o | provenance | |
65+
| test.ps1:245:10:245:32 | Call to read-host | test.ps1:245:5:245:6 | o | provenance | Src:MaD:0 |
66+
| test.ps1:256:5:256:10 | input | test.ps1:257:5:257:21 | env:bar | provenance | |
67+
| test.ps1:256:5:256:10 | input | test.ps1:257:5:257:21 | env:bar | provenance | |
68+
| test.ps1:256:14:256:36 | Call to read-host | test.ps1:256:5:256:10 | input | provenance | Src:MaD:0 |
69+
| test.ps1:256:14:256:36 | Call to read-host | test.ps1:256:5:256:10 | input | provenance | Src:MaD:0 |
70+
| test.ps1:257:5:257:21 | env:bar | test.ps1:259:5:259:6 | y | provenance | |
71+
| test.ps1:259:5:259:6 | y | test.ps1:260:7:260:10 | $y | provenance | |
7272
nodes
7373
| test.ps1:3:11:3:20 | userinput | semmle.label | userinput |
7474
| test.ps1:4:23:4:52 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
@@ -133,15 +133,15 @@ nodes
133133
| test.ps1:185:42:185:47 | input | semmle.label | input |
134134
| test.ps1:186:58:186:63 | input | semmle.label | input |
135135
| test.ps1:187:41:187:46 | input | semmle.label | input |
136-
| test.ps1:228:5:228:6 | o | semmle.label | o |
137-
| test.ps1:228:10:228:32 | Call to read-host | semmle.label | Call to read-host |
138-
| test.ps1:231:7:231:10 | $o | semmle.label | $o |
139-
| test.ps1:239:5:239:10 | input | semmle.label | input |
140-
| test.ps1:239:5:239:10 | input | semmle.label | input |
141-
| test.ps1:239:14:239:36 | Call to read-host | semmle.label | Call to read-host |
142-
| test.ps1:240:5:240:21 | env:bar | semmle.label | env:bar |
143-
| test.ps1:242:5:242:6 | y | semmle.label | y |
144-
| test.ps1:243:7:243:10 | $y | semmle.label | $y |
136+
| test.ps1:245:5:245:6 | o | semmle.label | o |
137+
| test.ps1:245:10:245:32 | Call to read-host | semmle.label | Call to read-host |
138+
| test.ps1:248:7:248:10 | $o | semmle.label | $o |
139+
| test.ps1:256:5:256:10 | input | semmle.label | input |
140+
| test.ps1:256:5:256:10 | input | semmle.label | input |
141+
| test.ps1:256:14:256:36 | Call to read-host | semmle.label | Call to read-host |
142+
| test.ps1:257:5:257:21 | env:bar | semmle.label | env:bar |
143+
| test.ps1:259:5:259:6 | y | semmle.label | y |
144+
| test.ps1:260:7:260:10 | $y | semmle.label | $y |
145145
subpaths
146146
#select
147147
| test.ps1:4:23:4:52 | Get-Process -Name $UserInput | test.ps1:164:10:164:32 | Call to read-host | test.ps1:4:23:4:52 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:164:10:164:32 | Call to read-host | user-provided value |
@@ -164,5 +164,5 @@ subpaths
164164
| test.ps1:147:63:147:72 | UserInput | test.ps1:164:10:164:32 | Call to read-host | test.ps1:147:63:147:72 | UserInput | This command depends on a $@. | test.ps1:164:10:164:32 | Call to read-host | user-provided value |
165165
| test.ps1:154:23:154:52 | Get-Process -Name $UserInput | test.ps1:164:10:164:32 | Call to read-host | test.ps1:154:23:154:52 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:164:10:164:32 | Call to read-host | user-provided value |
166166
| test.ps1:160:29:160:38 | UserInput | test.ps1:164:10:164:32 | Call to read-host | test.ps1:160:29:160:38 | UserInput | This command depends on a $@. | test.ps1:164:10:164:32 | Call to read-host | user-provided value |
167-
| test.ps1:231:7:231:10 | $o | test.ps1:228:10:228:32 | Call to read-host | test.ps1:231:7:231:10 | $o | This command depends on a $@. | test.ps1:228:10:228:32 | Call to read-host | user-provided value |
168-
| test.ps1:243:7:243:10 | $y | test.ps1:239:14:239:36 | Call to read-host | test.ps1:243:7:243:10 | $y | This command depends on a $@. | test.ps1:239:14:239:36 | Call to read-host | user-provided value |
167+
| test.ps1:248:7:248:10 | $o | test.ps1:245:10:245:32 | Call to read-host | test.ps1:248:7:248:10 | $o | This command depends on a $@. | test.ps1:245:10:245:32 | Call to read-host | user-provided value |
168+
| test.ps1:260:7:260:10 | $y | test.ps1:256:14:256:36 | Call to read-host | test.ps1:260:7:260:10 | $y | This command depends on a $@. | test.ps1:256:14:256:36 | Call to read-host | user-provided value |

‎powershell/ql/test/query-tests/security/cwe-078/CommandInjection/test.ps1‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,10 +218,27 @@ function Invoke-InvokeExpressionInjectionSafe4
218218
Invoke-Expression "Get-Process -Name $UserInputClean"
219219
}
220220

221+
#ValidatePattern Attribute
222+
function Invoke-InvokeExpressionInjectionSafe5
223+
{
224+
param(
225+
[ValidateScript({
226+
if ($_ -eq "GoodValue") {
227+
$true
228+
} else {
229+
throw "$_ is invalid."
230+
}
231+
})]
232+
$UserInput
233+
)
234+
Invoke-Expression "Get-Process -Name $UserInput"
235+
}
236+
221237
Invoke-InvokeExpressionInjectionSafe1 -UserInput $input
222238
Invoke-InvokeExpressionInjectionSafe2 -UserInput $input
223239
Invoke-InvokeExpressionInjectionSafe3 -UserInput $input
224240
Invoke-InvokeExpressionInjectionSafe4 -UserInput $input
241+
Invoke-InvokeExpressionInjectionSafe5 -UserInput $input
225242

226243
function false-positive-in-call-operator($d)
227244
{

0 commit comments

Comments
 (0)