Skip to content

Commit ee82760

Browse files
hmachmac
committed
Ruby: Model the posix-spawn gem
This gem exists primarily to provide methods that spawn subprocesses. We model these as SystemCommandExecutions.
1 parent 3213549 commit ee82760

File tree

5 files changed

+138
-0
lines changed

5 files changed

+138
-0
lines changed

‎ruby/ql/lib/codeql/ruby/Frameworks.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@ private import codeql.ruby.frameworks.Files
1515
private import codeql.ruby.frameworks.HttpClients
1616
private import codeql.ruby.frameworks.XmlParsing
1717
private import codeql.ruby.frameworks.ActionDispatch
18+
private import codeql.ruby.frameworks.PosixSpawn

‎ruby/ql/lib/codeql/ruby/frameworks/PosixSpawn.qll

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
/**
2+
* Provides modeling for the `posix-spawn` gem.
3+
* Version: 0.3.15
4+
*/
5+
6+
private import codeql.ruby.Concepts
7+
private import codeql.ruby.ApiGraphs
8+
private import codeql.ruby.DataFlow
9+
private import codeql.ruby.controlflow.CfgNodes
10+
11+
/**
12+
* Provides modeling for the `posix-spawn` gem.
13+
* Version: 0.3.15
14+
*/
15+
module PosixSpawn {
16+
private API::Node posixSpawnModule() {
17+
result = API::getTopLevelMember("POSIX").getMember("Spawn")
18+
}
19+
20+
/**
21+
* A call to `POSIX::Spawn::Child.new` or `POSIX::Spawn::Child.build`.
22+
*/
23+
class ChildCall extends SystemCommandExecution::Range, DataFlow::CallNode {
24+
ChildCall() {
25+
this =
26+
[
27+
posixSpawnModule().getMember("Child").getAMethodCall("build"),
28+
posixSpawnModule().getMember("Child").getAnInstantiation()
29+
]
30+
}
31+
32+
override DataFlow::Node getAnArgument() {
33+
result = this.getArgument(_) and not result.asExpr() instanceof ExprNodes::PairCfgNode
34+
}
35+
36+
override predicate isShellInterpreted(DataFlow::Node arg) { none() }
37+
}
38+
39+
/**
40+
* A call to `POSIX::Spawn.spawn` or a related method.
41+
*/
42+
class SystemCall extends SystemCommandExecution::Range, DataFlow::CallNode {
43+
SystemCall() {
44+
exists(API::Node spawn | spawn = API::getTopLevelMember("POSIX").getMember("Spawn") |
45+
this =
46+
posixSpawnModule()
47+
.getAMethodCall(["spawn", "fspawn", "popen4", "pspawn", "system", "_pspawn", "`"])
48+
)
49+
}
50+
51+
override DataFlow::Node getAnArgument() { this.argument(result, _) }
52+
53+
// From the docs:
54+
// When only command is given and includes a space character, the command
55+
// text is executed by the system shell interpreter.
56+
// This means the following signatures are shell interpreted:
57+
//
58+
// spawn(cmd)
59+
// spawn(cmd, opts)
60+
// spawn(env, cmd)
61+
// spawn(env, cmd, opts)
62+
//
63+
// env and opts will be hashes. We over-approximate by assuming the argument
64+
// is shell interpreted unless there is another argument with a string
65+
// constant value.
66+
override predicate isShellInterpreted(DataFlow::Node arg) {
67+
exists(int n, int m, DataFlow::Node otherArg |
68+
this.argument(arg, n) and
69+
this.argument(otherArg, m) and
70+
otherArg.asExpr().getConstantValue().isString(_)
71+
)
72+
}
73+
74+
private predicate argument(DataFlow::Node arg, int n) {
75+
arg = this.getArgument(n) and
76+
not arg.asExpr() instanceof ExprNodes::HashLiteralCfgNode and
77+
not arg.asExpr() instanceof ExprNodes::ArrayLiteralCfgNode and
78+
not arg.asExpr() instanceof ExprNodes::PairCfgNode
79+
}
80+
}
81+
}

‎ruby/ql/test/library-tests/frameworks/PosixSpawn.expected

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
systemCalls
2+
| PosixSpawn.rb:1:1:1:32 | call to popen4 | PosixSpawn.rb:1:22:1:25 | "ls" |
3+
| PosixSpawn.rb:1:1:1:32 | call to popen4 | PosixSpawn.rb:1:28:1:31 | "-l" |
4+
| PosixSpawn.rb:2:1:2:31 | call to popen4 | PosixSpawn.rb:2:21:2:24 | "ls" |
5+
| PosixSpawn.rb:2:1:2:31 | call to popen4 | PosixSpawn.rb:2:27:2:30 | "-l" |
6+
| PosixSpawn.rb:7:1:7:40 | call to spawn | PosixSpawn.rb:7:20:7:39 | * ... |
7+
| PosixSpawn.rb:8:1:8:30 | call to spawn | PosixSpawn.rb:8:21:8:29 | "sleep 5" |
8+
| PosixSpawn.rb:13:1:13:60 | call to system | PosixSpawn.rb:13:21:13:25 | "foo" |
9+
| PosixSpawn.rb:13:1:13:60 | call to system | PosixSpawn.rb:13:28:13:32 | "bar" |
10+
| PosixSpawn.rb:13:1:13:60 | call to system | PosixSpawn.rb:13:35:13:44 | "--a-flag" |
11+
| PosixSpawn.rb:13:1:13:60 | call to system | PosixSpawn.rb:13:47:13:52 | call to before |
12+
| PosixSpawn.rb:13:1:13:60 | call to system | PosixSpawn.rb:13:55:13:59 | call to after |
13+
| PosixSpawn.rb:15:1:15:28 | call to fspawn | PosixSpawn.rb:15:21:15:27 | call to command |
14+
| PosixSpawn.rb:16:1:16:28 | call to pspawn | PosixSpawn.rb:16:21:16:27 | call to command |
15+
| PosixSpawn.rb:17:1:17:28 | call to popen4 | PosixSpawn.rb:17:21:17:27 | call to command |
16+
| PosixSpawn.rb:19:1:19:28 | call to ` | PosixSpawn.rb:19:16:19:20 | "foo" |
17+
| PosixSpawn.rb:19:1:19:28 | call to ` | PosixSpawn.rb:19:23:19:27 | "bar" |
18+
childCalls
19+
| PosixSpawn.rb:4:1:4:77 | call to new | PosixSpawn.rb:4:25:4:39 | call to [] |
20+
| PosixSpawn.rb:4:1:4:77 | call to new | PosixSpawn.rb:4:42:4:51 | ... + ... |
21+
| PosixSpawn.rb:4:1:4:77 | call to new | PosixSpawn.rb:4:54:4:58 | * ... |
22+
| PosixSpawn.rb:5:1:5:80 | call to new | PosixSpawn.rb:5:25:5:32 | * ... |
23+
| PosixSpawn.rb:10:1:10:35 | call to new | PosixSpawn.rb:10:25:10:28 | "ls" |
24+
| PosixSpawn.rb:10:1:10:35 | call to new | PosixSpawn.rb:10:31:10:34 | "-l" |
25+
| PosixSpawn.rb:11:1:11:38 | call to build | PosixSpawn.rb:11:27:11:32 | "echo" |
26+
| PosixSpawn.rb:11:1:11:38 | call to build | PosixSpawn.rb:11:35:11:37 | call to msg |

‎ruby/ql/test/library-tests/frameworks/PosixSpawn.ql

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
import ruby
2+
import codeql.ruby.frameworks.PosixSpawn
3+
import codeql.ruby.DataFlow
4+
5+
query predicate systemCalls(PosixSpawn::SystemCall call, DataFlow::Node arg) {
6+
arg = call.getAnArgument()
7+
}
8+
9+
query predicate childCalls(PosixSpawn::ChildCall call, DataFlow::Node arg) {
10+
arg = call.getAnArgument()
11+
}

‎ruby/ql/test/library-tests/frameworks/PosixSpawn.rb

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
POSIX::Spawn::popen4("ls", "-l")
2+
POSIX::Spawn.popen4("ls", "-l")
3+
4+
POSIX::Spawn::Child.new({'ENV' => @var}, "foo/"+cmd, *argv, :chdir=>root_dir)
5+
POSIX::Spawn::Child.new(*command, input: options[:stdin].to_s, timeout: timeout)
6+
7+
POSIX::Spawn.spawn(*(argv+[{:in => f}]))
8+
POSIX::Spawn::spawn('sleep 5')
9+
10+
POSIX::Spawn::Child.new("ls", "-l")
11+
POSIX::Spawn::Child.build("echo", msg)
12+
13+
POSIX::Spawn.system("foo", "bar", "--a-flag", before, after)
14+
15+
POSIX::Spawn.fspawn(command)
16+
POSIX::Spawn.pspawn(command)
17+
POSIX::Spawn.popen4(command)
18+
19+
POSIX::Spawn.`("foo", "bar")

0 commit comments

Comments
 (0)