Skip to content

Commit 2d95b6a

Browse files
hmachmac
committed
Ruby: Add count_by_sql as SQL sink
1 parent c97dccf commit 2d95b6a

File tree

3 files changed

+26
-20
lines changed

3 files changed

+26
-20
lines changed

‎ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ private Expr sqlFragmentArgument(MethodCall call) {
123123
or
124124
methodName = "calculate" and result = call.getArgument(1)
125125
or
126-
methodName in ["average", "count", "maximum", "minimum", "sum"] and
126+
methodName in ["average", "count", "maximum", "minimum", "sum", "count_by_sql"] and
127127
result = call.getArgument(0)
128128
or
129129
// This format was supported until Rails 2.3.8

‎ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,8 @@ def some_request_handler
9292
User.update_all(params[:fields])
9393

9494
User.reorder(params[:direction])
95+
96+
User.count_by_sql(params[:custom_sql_query])
9597
end
9698
end
9799

‎ruby/ql/test/query-tests/security/cwe-089/SqlInjection.expected

Lines changed: 23 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,14 @@ edges
2727
| ActiveRecordInjection.rb:88:18:88:23 | call to params : | ActiveRecordInjection.rb:88:18:88:35 | ...[...] |
2828
| ActiveRecordInjection.rb:92:21:92:26 | call to params : | ActiveRecordInjection.rb:92:21:92:35 | ...[...] |
2929
| ActiveRecordInjection.rb:94:18:94:23 | call to params : | ActiveRecordInjection.rb:94:18:94:35 | ...[...] |
30-
| ActiveRecordInjection.rb:100:10:100:15 | call to params : | ActiveRecordInjection.rb:101:11:101:12 | ps : |
31-
| ActiveRecordInjection.rb:101:11:101:12 | ps : | ActiveRecordInjection.rb:101:11:101:17 | ...[...] : |
32-
| ActiveRecordInjection.rb:101:11:101:17 | ...[...] : | ActiveRecordInjection.rb:106:20:106:32 | ... + ... |
33-
| ActiveRecordInjection.rb:139:21:139:26 | call to params : | ActiveRecordInjection.rb:139:21:139:44 | ...[...] : |
34-
| ActiveRecordInjection.rb:139:21:139:44 | ...[...] : | ActiveRecordInjection.rb:20:22:20:30 | condition : |
35-
| ActiveRecordInjection.rb:153:59:153:64 | call to params : | ActiveRecordInjection.rb:153:59:153:74 | ...[...] : |
36-
| ActiveRecordInjection.rb:153:59:153:74 | ...[...] : | ActiveRecordInjection.rb:153:27:153:76 | "this is an unsafe annotation:..." |
30+
| ActiveRecordInjection.rb:96:23:96:28 | call to params : | ActiveRecordInjection.rb:96:23:96:47 | ...[...] |
31+
| ActiveRecordInjection.rb:102:10:102:15 | call to params : | ActiveRecordInjection.rb:103:11:103:12 | ps : |
32+
| ActiveRecordInjection.rb:103:11:103:12 | ps : | ActiveRecordInjection.rb:103:11:103:17 | ...[...] : |
33+
| ActiveRecordInjection.rb:103:11:103:17 | ...[...] : | ActiveRecordInjection.rb:108:20:108:32 | ... + ... |
34+
| ActiveRecordInjection.rb:141:21:141:26 | call to params : | ActiveRecordInjection.rb:141:21:141:44 | ...[...] : |
35+
| ActiveRecordInjection.rb:141:21:141:44 | ...[...] : | ActiveRecordInjection.rb:20:22:20:30 | condition : |
36+
| ActiveRecordInjection.rb:155:59:155:64 | call to params : | ActiveRecordInjection.rb:155:59:155:74 | ...[...] : |
37+
| ActiveRecordInjection.rb:155:59:155:74 | ...[...] : | ActiveRecordInjection.rb:155:27:155:76 | "this is an unsafe annotation:..." |
3738
| ArelInjection.rb:4:12:4:17 | call to params : | ArelInjection.rb:4:12:4:29 | ...[...] : |
3839
| ArelInjection.rb:4:12:4:29 | ...[...] : | ArelInjection.rb:6:20:6:61 | "SELECT * FROM users WHERE nam..." |
3940
nodes
@@ -81,23 +82,25 @@ nodes
8182
| ActiveRecordInjection.rb:92:21:92:35 | ...[...] | semmle.label | ...[...] |
8283
| ActiveRecordInjection.rb:94:18:94:23 | call to params : | semmle.label | call to params : |
8384
| ActiveRecordInjection.rb:94:18:94:35 | ...[...] | semmle.label | ...[...] |
84-
| ActiveRecordInjection.rb:100:10:100:15 | call to params : | semmle.label | call to params : |
85-
| ActiveRecordInjection.rb:101:11:101:12 | ps : | semmle.label | ps : |
86-
| ActiveRecordInjection.rb:101:11:101:17 | ...[...] : | semmle.label | ...[...] : |
87-
| ActiveRecordInjection.rb:106:20:106:32 | ... + ... | semmle.label | ... + ... |
88-
| ActiveRecordInjection.rb:139:21:139:26 | call to params : | semmle.label | call to params : |
89-
| ActiveRecordInjection.rb:139:21:139:44 | ...[...] : | semmle.label | ...[...] : |
90-
| ActiveRecordInjection.rb:153:27:153:76 | "this is an unsafe annotation:..." | semmle.label | "this is an unsafe annotation:..." |
91-
| ActiveRecordInjection.rb:153:59:153:64 | call to params : | semmle.label | call to params : |
92-
| ActiveRecordInjection.rb:153:59:153:74 | ...[...] : | semmle.label | ...[...] : |
85+
| ActiveRecordInjection.rb:96:23:96:28 | call to params : | semmle.label | call to params : |
86+
| ActiveRecordInjection.rb:96:23:96:47 | ...[...] | semmle.label | ...[...] |
87+
| ActiveRecordInjection.rb:102:10:102:15 | call to params : | semmle.label | call to params : |
88+
| ActiveRecordInjection.rb:103:11:103:12 | ps : | semmle.label | ps : |
89+
| ActiveRecordInjection.rb:103:11:103:17 | ...[...] : | semmle.label | ...[...] : |
90+
| ActiveRecordInjection.rb:108:20:108:32 | ... + ... | semmle.label | ... + ... |
91+
| ActiveRecordInjection.rb:141:21:141:26 | call to params : | semmle.label | call to params : |
92+
| ActiveRecordInjection.rb:141:21:141:44 | ...[...] : | semmle.label | ...[...] : |
93+
| ActiveRecordInjection.rb:155:27:155:76 | "this is an unsafe annotation:..." | semmle.label | "this is an unsafe annotation:..." |
94+
| ActiveRecordInjection.rb:155:59:155:64 | call to params : | semmle.label | call to params : |
95+
| ActiveRecordInjection.rb:155:59:155:74 | ...[...] : | semmle.label | ...[...] : |
9396
| ArelInjection.rb:4:12:4:17 | call to params : | semmle.label | call to params : |
9497
| ArelInjection.rb:4:12:4:29 | ...[...] : | semmle.label | ...[...] : |
9598
| ArelInjection.rb:6:20:6:61 | "SELECT * FROM users WHERE nam..." | semmle.label | "SELECT * FROM users WHERE nam..." |
9699
subpaths
97100
#select
98101
| ActiveRecordInjection.rb:10:33:10:67 | "name='#{...}' and pass='#{...}'" | ActiveRecordInjection.rb:70:23:70:28 | call to params : | ActiveRecordInjection.rb:10:33:10:67 | "name='#{...}' and pass='#{...}'" | This SQL query depends on a $@. | ActiveRecordInjection.rb:70:23:70:28 | call to params | user-provided value |
99102
| ActiveRecordInjection.rb:10:33:10:67 | "name='#{...}' and pass='#{...}'" | ActiveRecordInjection.rb:70:38:70:43 | call to params : | ActiveRecordInjection.rb:10:33:10:67 | "name='#{...}' and pass='#{...}'" | This SQL query depends on a $@. | ActiveRecordInjection.rb:70:38:70:43 | call to params | user-provided value |
100-
| ActiveRecordInjection.rb:23:16:23:24 | condition | ActiveRecordInjection.rb:139:21:139:26 | call to params : | ActiveRecordInjection.rb:23:16:23:24 | condition | This SQL query depends on a $@. | ActiveRecordInjection.rb:139:21:139:26 | call to params | user-provided value |
103+
| ActiveRecordInjection.rb:23:16:23:24 | condition | ActiveRecordInjection.rb:141:21:141:26 | call to params : | ActiveRecordInjection.rb:23:16:23:24 | condition | This SQL query depends on a $@. | ActiveRecordInjection.rb:141:21:141:26 | call to params | user-provided value |
101104
| ActiveRecordInjection.rb:35:30:35:44 | ...[...] | ActiveRecordInjection.rb:35:30:35:35 | call to params : | ActiveRecordInjection.rb:35:30:35:44 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:35:30:35:35 | call to params | user-provided value |
102105
| ActiveRecordInjection.rb:39:18:39:32 | ...[...] | ActiveRecordInjection.rb:39:18:39:23 | call to params : | ActiveRecordInjection.rb:39:18:39:32 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:39:18:39:23 | call to params | user-provided value |
103106
| ActiveRecordInjection.rb:43:20:43:42 | "id = '#{...}'" | ActiveRecordInjection.rb:43:29:43:34 | call to params : | ActiveRecordInjection.rb:43:20:43:42 | "id = '#{...}'" | This SQL query depends on a $@. | ActiveRecordInjection.rb:43:29:43:34 | call to params | user-provided value |
@@ -112,6 +115,7 @@ subpaths
112115
| ActiveRecordInjection.rb:88:18:88:35 | ...[...] | ActiveRecordInjection.rb:88:18:88:23 | call to params : | ActiveRecordInjection.rb:88:18:88:35 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:88:18:88:23 | call to params | user-provided value |
113116
| ActiveRecordInjection.rb:92:21:92:35 | ...[...] | ActiveRecordInjection.rb:92:21:92:26 | call to params : | ActiveRecordInjection.rb:92:21:92:35 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:92:21:92:26 | call to params | user-provided value |
114117
| ActiveRecordInjection.rb:94:18:94:35 | ...[...] | ActiveRecordInjection.rb:94:18:94:23 | call to params : | ActiveRecordInjection.rb:94:18:94:35 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:94:18:94:23 | call to params | user-provided value |
115-
| ActiveRecordInjection.rb:106:20:106:32 | ... + ... | ActiveRecordInjection.rb:100:10:100:15 | call to params : | ActiveRecordInjection.rb:106:20:106:32 | ... + ... | This SQL query depends on a $@. | ActiveRecordInjection.rb:100:10:100:15 | call to params | user-provided value |
116-
| ActiveRecordInjection.rb:153:27:153:76 | "this is an unsafe annotation:..." | ActiveRecordInjection.rb:153:59:153:64 | call to params : | ActiveRecordInjection.rb:153:27:153:76 | "this is an unsafe annotation:..." | This SQL query depends on a $@. | ActiveRecordInjection.rb:153:59:153:64 | call to params | user-provided value |
118+
| ActiveRecordInjection.rb:96:23:96:47 | ...[...] | ActiveRecordInjection.rb:96:23:96:28 | call to params : | ActiveRecordInjection.rb:96:23:96:47 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:96:23:96:28 | call to params | user-provided value |
119+
| ActiveRecordInjection.rb:108:20:108:32 | ... + ... | ActiveRecordInjection.rb:102:10:102:15 | call to params : | ActiveRecordInjection.rb:108:20:108:32 | ... + ... | This SQL query depends on a $@. | ActiveRecordInjection.rb:102:10:102:15 | call to params | user-provided value |
120+
| ActiveRecordInjection.rb:155:27:155:76 | "this is an unsafe annotation:..." | ActiveRecordInjection.rb:155:59:155:64 | call to params : | ActiveRecordInjection.rb:155:27:155:76 | "this is an unsafe annotation:..." | This SQL query depends on a $@. | ActiveRecordInjection.rb:155:59:155:64 | call to params | user-provided value |
117121
| ArelInjection.rb:6:20:6:61 | "SELECT * FROM users WHERE nam..." | ArelInjection.rb:4:12:4:17 | call to params : | ArelInjection.rb:6:20:6:61 | "SELECT * FROM users WHERE nam..." | This SQL query depends on a $@. | ArelInjection.rb:4:12:4:17 | call to params | user-provided value |

0 commit comments

Comments
 (0)