Skip to content

Commit c4baf0b

Browse files
alexrfordalexrford
committed
Ruby: add space for test case
1 parent 5cadd3c commit c4baf0b

File tree

2 files changed

+35
-30
lines changed

2 files changed

+35
-30
lines changed

‎ruby/ql/test/query-tests/security/cwe-094/CodeInjection.expected

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,29 @@
11
edges
2-
| CodeInjection.rb:3:12:3:17 | call to params : | CodeInjection.rb:3:12:3:24 | ...[...] : |
3-
| CodeInjection.rb:3:12:3:24 | ...[...] : | CodeInjection.rb:6:10:6:13 | code |
4-
| CodeInjection.rb:3:12:3:24 | ...[...] : | CodeInjection.rb:18:20:18:23 | code |
5-
| CodeInjection.rb:3:12:3:24 | ...[...] : | CodeInjection.rb:21:21:21:24 | code |
6-
| CodeInjection.rb:3:12:3:24 | ...[...] : | CodeInjection.rb:27:15:27:18 | code |
7-
| CodeInjection.rb:3:12:3:24 | ...[...] : | CodeInjection.rb:30:19:30:22 | code |
8-
| CodeInjection.rb:3:12:3:24 | ...[...] : | CodeInjection.rb:36:24:36:27 | code : |
9-
| CodeInjection.rb:36:24:36:27 | code : | CodeInjection.rb:36:10:36:28 | call to escape |
2+
| CodeInjection.rb:5:12:5:17 | call to params : | CodeInjection.rb:5:12:5:24 | ...[...] : |
3+
| CodeInjection.rb:5:12:5:24 | ...[...] : | CodeInjection.rb:8:10:8:13 | code |
4+
| CodeInjection.rb:5:12:5:24 | ...[...] : | CodeInjection.rb:20:20:20:23 | code |
5+
| CodeInjection.rb:5:12:5:24 | ...[...] : | CodeInjection.rb:23:21:23:24 | code |
6+
| CodeInjection.rb:5:12:5:24 | ...[...] : | CodeInjection.rb:29:15:29:18 | code |
7+
| CodeInjection.rb:5:12:5:24 | ...[...] : | CodeInjection.rb:32:19:32:22 | code |
8+
| CodeInjection.rb:5:12:5:24 | ...[...] : | CodeInjection.rb:38:24:38:27 | code : |
9+
| CodeInjection.rb:38:24:38:27 | code : | CodeInjection.rb:38:10:38:28 | call to escape |
1010
nodes
11-
| CodeInjection.rb:3:12:3:17 | call to params : | semmle.label | call to params : |
12-
| CodeInjection.rb:3:12:3:24 | ...[...] : | semmle.label | ...[...] : |
13-
| CodeInjection.rb:6:10:6:13 | code | semmle.label | code |
14-
| CodeInjection.rb:9:10:9:15 | call to params | semmle.label | call to params |
15-
| CodeInjection.rb:18:20:18:23 | code | semmle.label | code |
16-
| CodeInjection.rb:21:21:21:24 | code | semmle.label | code |
17-
| CodeInjection.rb:27:15:27:18 | code | semmle.label | code |
18-
| CodeInjection.rb:30:19:30:22 | code | semmle.label | code |
19-
| CodeInjection.rb:36:10:36:28 | call to escape | semmle.label | call to escape |
20-
| CodeInjection.rb:36:24:36:27 | code : | semmle.label | code : |
11+
| CodeInjection.rb:5:12:5:17 | call to params : | semmle.label | call to params : |
12+
| CodeInjection.rb:5:12:5:24 | ...[...] : | semmle.label | ...[...] : |
13+
| CodeInjection.rb:8:10:8:13 | code | semmle.label | code |
14+
| CodeInjection.rb:11:10:11:15 | call to params | semmle.label | call to params |
15+
| CodeInjection.rb:20:20:20:23 | code | semmle.label | code |
16+
| CodeInjection.rb:23:21:23:24 | code | semmle.label | code |
17+
| CodeInjection.rb:29:15:29:18 | code | semmle.label | code |
18+
| CodeInjection.rb:32:19:32:22 | code | semmle.label | code |
19+
| CodeInjection.rb:38:10:38:28 | call to escape | semmle.label | call to escape |
20+
| CodeInjection.rb:38:24:38:27 | code : | semmle.label | code : |
2121
subpaths
2222
#select
23-
| CodeInjection.rb:6:10:6:13 | code | CodeInjection.rb:3:12:3:17 | call to params : | CodeInjection.rb:6:10:6:13 | code | This code execution depends on a $@. | CodeInjection.rb:3:12:3:17 | call to params | user-provided value |
24-
| CodeInjection.rb:9:10:9:15 | call to params | CodeInjection.rb:9:10:9:15 | call to params | CodeInjection.rb:9:10:9:15 | call to params | This code execution depends on a $@. | CodeInjection.rb:9:10:9:15 | call to params | user-provided value |
25-
| CodeInjection.rb:18:20:18:23 | code | CodeInjection.rb:3:12:3:17 | call to params : | CodeInjection.rb:18:20:18:23 | code | This code execution depends on a $@. | CodeInjection.rb:3:12:3:17 | call to params | user-provided value |
26-
| CodeInjection.rb:21:21:21:24 | code | CodeInjection.rb:3:12:3:17 | call to params : | CodeInjection.rb:21:21:21:24 | code | This code execution depends on a $@. | CodeInjection.rb:3:12:3:17 | call to params | user-provided value |
27-
| CodeInjection.rb:27:15:27:18 | code | CodeInjection.rb:3:12:3:17 | call to params : | CodeInjection.rb:27:15:27:18 | code | This code execution depends on a $@. | CodeInjection.rb:3:12:3:17 | call to params | user-provided value |
28-
| CodeInjection.rb:30:19:30:22 | code | CodeInjection.rb:3:12:3:17 | call to params : | CodeInjection.rb:30:19:30:22 | code | This code execution depends on a $@. | CodeInjection.rb:3:12:3:17 | call to params | user-provided value |
29-
| CodeInjection.rb:36:10:36:28 | call to escape | CodeInjection.rb:3:12:3:17 | call to params : | CodeInjection.rb:36:10:36:28 | call to escape | This code execution depends on a $@. | CodeInjection.rb:3:12:3:17 | call to params | user-provided value |
23+
| CodeInjection.rb:8:10:8:13 | code | CodeInjection.rb:5:12:5:17 | call to params : | CodeInjection.rb:8:10:8:13 | code | This code execution depends on a $@. | CodeInjection.rb:5:12:5:17 | call to params | user-provided value |
24+
| CodeInjection.rb:11:10:11:15 | call to params | CodeInjection.rb:11:10:11:15 | call to params | CodeInjection.rb:11:10:11:15 | call to params | This code execution depends on a $@. | CodeInjection.rb:11:10:11:15 | call to params | user-provided value |
25+
| CodeInjection.rb:20:20:20:23 | code | CodeInjection.rb:5:12:5:17 | call to params : | CodeInjection.rb:20:20:20:23 | code | This code execution depends on a $@. | CodeInjection.rb:5:12:5:17 | call to params | user-provided value |
26+
| CodeInjection.rb:23:21:23:24 | code | CodeInjection.rb:5:12:5:17 | call to params : | CodeInjection.rb:23:21:23:24 | code | This code execution depends on a $@. | CodeInjection.rb:5:12:5:17 | call to params | user-provided value |
27+
| CodeInjection.rb:29:15:29:18 | code | CodeInjection.rb:5:12:5:17 | call to params : | CodeInjection.rb:29:15:29:18 | code | This code execution depends on a $@. | CodeInjection.rb:5:12:5:17 | call to params | user-provided value |
28+
| CodeInjection.rb:32:19:32:22 | code | CodeInjection.rb:5:12:5:17 | call to params : | CodeInjection.rb:32:19:32:22 | code | This code execution depends on a $@. | CodeInjection.rb:5:12:5:17 | call to params | user-provided value |
29+
| CodeInjection.rb:38:10:38:28 | call to escape | CodeInjection.rb:5:12:5:17 | call to params : | CodeInjection.rb:38:10:38:28 | call to escape | This code execution depends on a $@. | CodeInjection.rb:5:12:5:17 | call to params | user-provided value |

‎ruby/ql/test/query-tests/security/cwe-094/CodeInjection.rb

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
require 'active_job'
2+
13
class UsersController < ActionController::Base
24
def create
35
code = params[:code]
@@ -22,18 +24,21 @@ def create
2224

2325
# GOOD
2426
Bar.class_eval(code)
25-
27+
2628
# BAD
2729
const_get(code)
28-
30+
2931
# BAD
3032
Foo.const_get(code)
31-
33+
3234
# GOOD
3335
Bar.const_get(code)
3436

3537
# BAD
3638
eval(Regexp.escape(code))
39+
40+
41+
3742
end
3843

3944
def update
@@ -62,8 +67,8 @@ class Bar
6267
def self.class_eval(x)
6368
true
6469
end
65-
70+
6671
def self.const_get(x)
6772
true
6873
end
69-
end
74+
end

0 commit comments

Comments
 (0)