Skip to content

Commit f9c0ba3

Browse files
asgerfasgerf
committed
Ruby: use DeduplicatePathGraph in CodeInjection query
1 parent 815581d commit f9c0ba3

File tree

2 files changed

+31
-80
lines changed

2 files changed

+31
-80
lines changed

‎ruby/ql/src/queries/security/cwe-094/CodeInjection.ql‎

Lines changed: 4 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,9 @@
1616

1717
private import codeql.ruby.AST
1818
private import codeql.ruby.security.CodeInjectionQuery
19-
import CodeInjectionFlow::PathGraph
19+
import DataFlow::DeduplicatePathGraph<CodeInjectionFlow::PathNode, CodeInjectionFlow::PathGraph>
2020

21-
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Source sourceNode
22-
where
23-
CodeInjectionFlow::flowPath(source, sink) and
24-
sourceNode = source.getNode() and
25-
// removing duplications of the same path, but different flow-labels.
26-
sink =
27-
min(CodeInjectionFlow::PathNode otherSink |
28-
CodeInjectionFlow::flowPath(any(CodeInjectionFlow::PathNode s | s.getNode() = sourceNode),
29-
otherSink) and
30-
otherSink.getNode() = sink.getNode()
31-
|
32-
otherSink order by otherSink.getState().getStringRepresentation()
33-
)
34-
select sink.getNode(), source, sink, "This code execution depends on a $@.", sourceNode,
21+
from PathNode source, PathNode sink
22+
where CodeInjectionFlow::flowPath(source.getAnOriginalPathNode(), sink.getAnOriginalPathNode())
23+
select sink.getNode(), source, sink, "This code execution depends on a $@.", source.getNode(),
3524
"user-provided value"

‎ruby/ql/test/query-tests/security/cwe-094/CodeInjection/CodeInjection.expected‎

Lines changed: 27 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,60 @@
1-
edges
2-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:8:10:8:13 | code | provenance | |
3-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:8:10:8:13 | code | provenance | |
4-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:20:20:20:23 | code | provenance | |
5-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:20:20:20:23 | code | provenance | |
6-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:23:21:23:24 | code | provenance | |
7-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:23:21:23:24 | code | provenance | |
8-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:29:15:29:18 | code | provenance | |
9-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:32:19:32:22 | code | provenance | |
10-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:38:24:38:27 | code | provenance | |
11-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:38:24:38:27 | code | provenance | |
12-
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:41:40:41:43 | code | provenance | |
13-
| CodeInjection.rb:5:12:5:17 | call to params | CodeInjection.rb:5:12:5:24 | ...[...] | provenance | |
14-
| CodeInjection.rb:5:12:5:17 | call to params | CodeInjection.rb:5:12:5:24 | ...[...] | provenance | |
15-
| CodeInjection.rb:5:12:5:24 | ...[...] | CodeInjection.rb:5:5:5:8 | code | provenance | |
16-
| CodeInjection.rb:5:12:5:24 | ...[...] | CodeInjection.rb:5:5:5:8 | code | provenance | |
17-
| CodeInjection.rb:38:24:38:27 | code | CodeInjection.rb:38:10:38:28 | call to escape | provenance | MaD:21 |
18-
| CodeInjection.rb:38:24:38:27 | code | CodeInjection.rb:38:10:38:28 | call to escape | provenance | MaD:21 |
19-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:80:16:80:19 | code | provenance | |
20-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:10:86:37 | ... + ... | provenance | |
21-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:22:86:25 | code | provenance | |
22-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:88:10:88:32 | "prefix_#{...}_suffix" | provenance | AdditionalTaintStep |
23-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:90:10:90:13 | code | provenance | |
24-
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:90:10:90:13 | code | provenance | |
25-
| CodeInjection.rb:78:12:78:17 | call to params | CodeInjection.rb:78:12:78:24 | ...[...] | provenance | |
26-
| CodeInjection.rb:78:12:78:17 | call to params | CodeInjection.rb:78:12:78:24 | ...[...] | provenance | |
27-
| CodeInjection.rb:78:12:78:24 | ...[...] | CodeInjection.rb:78:5:78:8 | code | provenance | |
28-
| CodeInjection.rb:78:12:78:24 | ...[...] | CodeInjection.rb:78:5:78:8 | code | provenance | |
29-
| CodeInjection.rb:86:10:86:25 | ... + ... [element] | CodeInjection.rb:86:10:86:37 | ... + ... | provenance | |
30-
| CodeInjection.rb:86:22:86:25 | code | CodeInjection.rb:86:10:86:25 | ... + ... [element] | provenance | |
31-
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | CodeInjection.rb:111:3:113:5 | self in baz [@foo] | provenance | |
32-
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | CodeInjection.rb:111:3:113:5 | self in baz [@foo] | provenance | |
33-
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | CodeInjection.rb:108:3:109:5 | self in bar [@foo] | provenance | |
34-
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | CodeInjection.rb:108:3:109:5 | self in bar [@foo] | provenance | |
35-
| CodeInjection.rb:105:12:105:17 | call to params | CodeInjection.rb:105:12:105:23 | ...[...] | provenance | |
36-
| CodeInjection.rb:105:12:105:17 | call to params | CodeInjection.rb:105:12:105:23 | ...[...] | provenance | |
37-
| CodeInjection.rb:105:12:105:23 | ...[...] | CodeInjection.rb:105:5:105:8 | [post] self [@foo] | provenance | |
38-
| CodeInjection.rb:105:12:105:23 | ...[...] | CodeInjection.rb:105:5:105:8 | [post] self [@foo] | provenance | |
39-
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | CodeInjection.rb:101:3:102:5 | self in index [@foo] | provenance | |
40-
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | CodeInjection.rb:101:3:102:5 | self in index [@foo] | provenance | |
41-
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | CodeInjection.rb:112:10:112:13 | self [@foo] | provenance | |
42-
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | CodeInjection.rb:112:10:112:13 | self [@foo] | provenance | |
43-
| CodeInjection.rb:112:10:112:13 | self [@foo] | CodeInjection.rb:112:10:112:13 | @foo | provenance | |
44-
| CodeInjection.rb:112:10:112:13 | self [@foo] | CodeInjection.rb:112:10:112:13 | @foo | provenance | |
451
nodes
462
| CodeInjection.rb:5:5:5:8 | code | semmle.label | code |
47-
| CodeInjection.rb:5:5:5:8 | code | semmle.label | code |
48-
| CodeInjection.rb:5:12:5:17 | call to params | semmle.label | call to params |
493
| CodeInjection.rb:5:12:5:17 | call to params | semmle.label | call to params |
504
| CodeInjection.rb:5:12:5:24 | ...[...] | semmle.label | ...[...] |
51-
| CodeInjection.rb:5:12:5:24 | ...[...] | semmle.label | ...[...] |
52-
| CodeInjection.rb:8:10:8:13 | code | semmle.label | code |
535
| CodeInjection.rb:8:10:8:13 | code | semmle.label | code |
546
| CodeInjection.rb:11:10:11:15 | call to params | semmle.label | call to params |
55-
| CodeInjection.rb:11:10:11:15 | call to params | semmle.label | call to params |
567
| CodeInjection.rb:20:20:20:23 | code | semmle.label | code |
57-
| CodeInjection.rb:20:20:20:23 | code | semmle.label | code |
58-
| CodeInjection.rb:23:21:23:24 | code | semmle.label | code |
598
| CodeInjection.rb:23:21:23:24 | code | semmle.label | code |
609
| CodeInjection.rb:29:15:29:18 | code | semmle.label | code |
6110
| CodeInjection.rb:32:19:32:22 | code | semmle.label | code |
6211
| CodeInjection.rb:38:10:38:28 | call to escape | semmle.label | call to escape |
63-
| CodeInjection.rb:38:10:38:28 | call to escape | semmle.label | call to escape |
64-
| CodeInjection.rb:38:24:38:27 | code | semmle.label | code |
6512
| CodeInjection.rb:38:24:38:27 | code | semmle.label | code |
6613
| CodeInjection.rb:41:40:41:43 | code | semmle.label | code |
6714
| CodeInjection.rb:78:5:78:8 | code | semmle.label | code |
68-
| CodeInjection.rb:78:5:78:8 | code | semmle.label | code |
69-
| CodeInjection.rb:78:12:78:17 | call to params | semmle.label | call to params |
7015
| CodeInjection.rb:78:12:78:17 | call to params | semmle.label | call to params |
7116
| CodeInjection.rb:78:12:78:24 | ...[...] | semmle.label | ...[...] |
72-
| CodeInjection.rb:78:12:78:24 | ...[...] | semmle.label | ...[...] |
7317
| CodeInjection.rb:80:16:80:19 | code | semmle.label | code |
7418
| CodeInjection.rb:86:10:86:25 | ... + ... [element] | semmle.label | ... + ... [element] |
7519
| CodeInjection.rb:86:10:86:37 | ... + ... | semmle.label | ... + ... |
7620
| CodeInjection.rb:86:22:86:25 | code | semmle.label | code |
7721
| CodeInjection.rb:88:10:88:32 | "prefix_#{...}_suffix" | semmle.label | "prefix_#{...}_suffix" |
7822
| CodeInjection.rb:90:10:90:13 | code | semmle.label | code |
79-
| CodeInjection.rb:90:10:90:13 | code | semmle.label | code |
80-
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | semmle.label | self in index [@foo] |
8123
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | semmle.label | self in index [@foo] |
8224
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | semmle.label | [post] self [@foo] |
83-
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | semmle.label | [post] self [@foo] |
84-
| CodeInjection.rb:105:12:105:17 | call to params | semmle.label | call to params |
8525
| CodeInjection.rb:105:12:105:17 | call to params | semmle.label | call to params |
8626
| CodeInjection.rb:105:12:105:23 | ...[...] | semmle.label | ...[...] |
87-
| CodeInjection.rb:105:12:105:23 | ...[...] | semmle.label | ...[...] |
8827
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | semmle.label | self in bar [@foo] |
89-
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | semmle.label | self in bar [@foo] |
90-
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | semmle.label | self in baz [@foo] |
9128
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | semmle.label | self in baz [@foo] |
9229
| CodeInjection.rb:112:10:112:13 | @foo | semmle.label | @foo |
93-
| CodeInjection.rb:112:10:112:13 | @foo | semmle.label | @foo |
94-
| CodeInjection.rb:112:10:112:13 | self [@foo] | semmle.label | self [@foo] |
9530
| CodeInjection.rb:112:10:112:13 | self [@foo] | semmle.label | self [@foo] |
31+
edges
32+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:8:10:8:13 | code | provenance | |
33+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:20:20:20:23 | code | provenance | |
34+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:23:21:23:24 | code | provenance | |
35+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:29:15:29:18 | code | provenance | |
36+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:32:19:32:22 | code | provenance | |
37+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:38:24:38:27 | code | provenance | |
38+
| CodeInjection.rb:5:5:5:8 | code | CodeInjection.rb:41:40:41:43 | code | provenance | |
39+
| CodeInjection.rb:5:12:5:17 | call to params | CodeInjection.rb:5:12:5:24 | ...[...] | provenance | |
40+
| CodeInjection.rb:5:12:5:24 | ...[...] | CodeInjection.rb:5:5:5:8 | code | provenance | |
41+
| CodeInjection.rb:38:24:38:27 | code | CodeInjection.rb:38:10:38:28 | call to escape | provenance | MaD:21 |
42+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:80:16:80:19 | code | provenance | |
43+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:10:86:37 | ... + ... | provenance | |
44+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:86:22:86:25 | code | provenance | |
45+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:88:10:88:32 | "prefix_#{...}_suffix" | provenance | AdditionalTaintStep |
46+
| CodeInjection.rb:78:5:78:8 | code | CodeInjection.rb:90:10:90:13 | code | provenance | |
47+
| CodeInjection.rb:78:12:78:17 | call to params | CodeInjection.rb:78:12:78:24 | ...[...] | provenance | |
48+
| CodeInjection.rb:78:12:78:24 | ...[...] | CodeInjection.rb:78:5:78:8 | code | provenance | |
49+
| CodeInjection.rb:86:10:86:25 | ... + ... [element] | CodeInjection.rb:86:10:86:37 | ... + ... | provenance | |
50+
| CodeInjection.rb:86:22:86:25 | code | CodeInjection.rb:86:10:86:25 | ... + ... [element] | provenance | |
51+
| CodeInjection.rb:101:3:102:5 | self in index [@foo] | CodeInjection.rb:111:3:113:5 | self in baz [@foo] | provenance | |
52+
| CodeInjection.rb:105:5:105:8 | [post] self [@foo] | CodeInjection.rb:108:3:109:5 | self in bar [@foo] | provenance | |
53+
| CodeInjection.rb:105:12:105:17 | call to params | CodeInjection.rb:105:12:105:23 | ...[...] | provenance | |
54+
| CodeInjection.rb:105:12:105:23 | ...[...] | CodeInjection.rb:105:5:105:8 | [post] self [@foo] | provenance | |
55+
| CodeInjection.rb:108:3:109:5 | self in bar [@foo] | CodeInjection.rb:101:3:102:5 | self in index [@foo] | provenance | |
56+
| CodeInjection.rb:111:3:113:5 | self in baz [@foo] | CodeInjection.rb:112:10:112:13 | self [@foo] | provenance | |
57+
| CodeInjection.rb:112:10:112:13 | self [@foo] | CodeInjection.rb:112:10:112:13 | @foo | provenance | |
9658
subpaths
9759
#select
9860
| CodeInjection.rb:8:10:8:13 | code | CodeInjection.rb:5:12:5:17 | call to params | CodeInjection.rb:8:10:8:13 | code | This code execution depends on a $@. | CodeInjection.rb:5:12:5:17 | call to params | user-provided value |

0 commit comments

Comments
 (0)