Skip to content

Commit c7e67eb

Browse files
thiggy1342thiggy1342
authored
expand test coverage for sanitizers
1 parent 074583e commit c7e67eb

File tree

2 files changed

+52
-20
lines changed

2 files changed

+52
-20
lines changed

‎ruby/ql/test/query-tests/security/archive-api-path-traversal/ArchiveApiPathTraversal.expected

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
edges
2-
| ArchiveApiPathTraversal.rb:4:26:4:31 | call to params : | ArchiveApiPathTraversal.rb:4:26:4:42 | ...[...] : |
3-
| ArchiveApiPathTraversal.rb:4:26:4:42 | ...[...] : | ArchiveApiPathTraversal.rb:11:17:11:27 | destination : |
4-
| ArchiveApiPathTraversal.rb:8:11:8:16 | call to params : | ArchiveApiPathTraversal.rb:8:11:8:23 | ...[...] : |
5-
| ArchiveApiPathTraversal.rb:8:11:8:23 | ...[...] : | ArchiveApiPathTraversal.rb:29:13:29:16 | file : |
6-
| ArchiveApiPathTraversal.rb:11:17:11:27 | destination : | ArchiveApiPathTraversal.rb:14:38:14:48 | destination : |
7-
| ArchiveApiPathTraversal.rb:14:28:14:67 | call to join : | ArchiveApiPathTraversal.rb:21:21:21:36 | destination_file |
8-
| ArchiveApiPathTraversal.rb:14:38:14:48 | destination : | ArchiveApiPathTraversal.rb:14:28:14:67 | call to join : |
9-
| ArchiveApiPathTraversal.rb:29:13:29:16 | file : | ArchiveApiPathTraversal.rb:30:20:30:23 | file |
2+
| ArchiveApiPathTraversal.rb:5:26:5:31 | call to params : | ArchiveApiPathTraversal.rb:5:26:5:42 | ...[...] : |
3+
| ArchiveApiPathTraversal.rb:5:26:5:42 | ...[...] : | ArchiveApiPathTraversal.rb:43:17:43:27 | destination : |
4+
| ArchiveApiPathTraversal.rb:10:11:10:16 | call to params : | ArchiveApiPathTraversal.rb:10:11:10:23 | ...[...] : |
5+
| ArchiveApiPathTraversal.rb:10:11:10:23 | ...[...] : | ArchiveApiPathTraversal.rb:61:13:61:16 | file : |
6+
| ArchiveApiPathTraversal.rb:43:17:43:27 | destination : | ArchiveApiPathTraversal.rb:46:38:46:48 | destination : |
7+
| ArchiveApiPathTraversal.rb:46:28:46:67 | call to join : | ArchiveApiPathTraversal.rb:53:21:53:36 | destination_file |
8+
| ArchiveApiPathTraversal.rb:46:38:46:48 | destination : | ArchiveApiPathTraversal.rb:46:28:46:67 | call to join : |
9+
| ArchiveApiPathTraversal.rb:61:13:61:16 | file : | ArchiveApiPathTraversal.rb:62:20:62:23 | file |
1010
nodes
11-
| ArchiveApiPathTraversal.rb:4:26:4:31 | call to params : | semmle.label | call to params : |
12-
| ArchiveApiPathTraversal.rb:4:26:4:42 | ...[...] : | semmle.label | ...[...] : |
13-
| ArchiveApiPathTraversal.rb:8:11:8:16 | call to params : | semmle.label | call to params : |
14-
| ArchiveApiPathTraversal.rb:8:11:8:23 | ...[...] : | semmle.label | ...[...] : |
15-
| ArchiveApiPathTraversal.rb:11:17:11:27 | destination : | semmle.label | destination : |
16-
| ArchiveApiPathTraversal.rb:14:28:14:67 | call to join : | semmle.label | call to join : |
17-
| ArchiveApiPathTraversal.rb:14:38:14:48 | destination : | semmle.label | destination : |
18-
| ArchiveApiPathTraversal.rb:21:21:21:36 | destination_file | semmle.label | destination_file |
19-
| ArchiveApiPathTraversal.rb:29:13:29:16 | file : | semmle.label | file : |
20-
| ArchiveApiPathTraversal.rb:30:20:30:23 | file | semmle.label | file |
11+
| ArchiveApiPathTraversal.rb:5:26:5:31 | call to params : | semmle.label | call to params : |
12+
| ArchiveApiPathTraversal.rb:5:26:5:42 | ...[...] : | semmle.label | ...[...] : |
13+
| ArchiveApiPathTraversal.rb:10:11:10:16 | call to params : | semmle.label | call to params : |
14+
| ArchiveApiPathTraversal.rb:10:11:10:23 | ...[...] : | semmle.label | ...[...] : |
15+
| ArchiveApiPathTraversal.rb:43:17:43:27 | destination : | semmle.label | destination : |
16+
| ArchiveApiPathTraversal.rb:46:28:46:67 | call to join : | semmle.label | call to join : |
17+
| ArchiveApiPathTraversal.rb:46:38:46:48 | destination : | semmle.label | destination : |
18+
| ArchiveApiPathTraversal.rb:53:21:53:36 | destination_file | semmle.label | destination_file |
19+
| ArchiveApiPathTraversal.rb:61:13:61:16 | file : | semmle.label | file : |
20+
| ArchiveApiPathTraversal.rb:62:20:62:23 | file | semmle.label | file |
2121
subpaths
2222
#select
23-
| ArchiveApiPathTraversal.rb:21:21:21:36 | destination_file | ArchiveApiPathTraversal.rb:4:26:4:31 | call to params : | ArchiveApiPathTraversal.rb:21:21:21:36 | destination_file | This call to $@ appears to extract an archive using user-controlled data $@ to set the filename. If the filename is not properly handled, they could end up writing to unintended places in the filesystem. | call to open | call to open | call to params : | call to params : |
24-
| ArchiveApiPathTraversal.rb:30:20:30:23 | file | ArchiveApiPathTraversal.rb:8:11:8:16 | call to params : | ArchiveApiPathTraversal.rb:30:20:30:23 | file | This call to $@ appears to extract an archive using user-controlled data $@ to set the filename. If the filename is not properly handled, they could end up writing to unintended places in the filesystem. | call to open | call to open | call to params : | call to params : |
23+
| ArchiveApiPathTraversal.rb:53:21:53:36 | destination_file | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params : | ArchiveApiPathTraversal.rb:53:21:53:36 | destination_file | This call to $@ appears to extract an archive using user-controlled data $@ to set the filename. If the filename is not properly handled, they could end up writing to unintended places in the filesystem. | call to open | call to open | call to params : | call to params : |
24+
| ArchiveApiPathTraversal.rb:62:20:62:23 | file | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params : | ArchiveApiPathTraversal.rb:62:20:62:23 | file | This call to $@ appears to extract an archive using user-controlled data $@ to set the filename. If the filename is not properly handled, they could end up writing to unintended places in the filesystem. | call to open | call to open | call to params : | call to params : |

‎ruby/ql/test/query-tests/security/archive-api-path-traversal/ArchiveApiPathTraversal.rb

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,45 @@
11
class TestContoller < ActionController::Base
22

3+
# this is vulnerable
34
def upload
45
untar params[:file], params[:filename]
56
end
67

8+
# this is vulnerable
79
def unpload_zip
810
unzip params[:file]
911
end
1012

13+
# these are not vulnerable because of the string compare sanitizer
14+
def safe_upload_string_compare
15+
filename = params[:filename]
16+
if filename == "safefile.tar"
17+
untar params[:file], filename
18+
end
19+
end
20+
21+
def safe_upload_zip_string_compare
22+
filename = params[:filename]
23+
if filename == "safefile.zip"
24+
unzip filename
25+
end
26+
end
27+
28+
# these are not vulnerable beacuse of the string array compare sanitizer
29+
def safe_upload_string_array_compare
30+
filename = params[:filename]
31+
if ["safefile1.tar", "safefile2.tar"].include? filename
32+
untar params[:file], filename
33+
end
34+
end
35+
36+
def safe_upload_zip_string_array_compare
37+
filename = params[:filename]
38+
if ["safefile1.zip", "safefile2.zip"].include? filename
39+
unzip filename
40+
end
41+
end
42+
1143
def untar(io, destination)
1244
Gem::Package::TarReader.new io do |tar|
1345
tar.each do |tarfile|

0 commit comments

Comments
 (0)