Skip to content

Commit 47e5a8f

Browse files
nickrolfenickrolfe
committed
Add test for polynomial ReDoS query
1 parent cbe2366 commit 47e5a8f

File tree

3 files changed

+101
-0
lines changed

3 files changed

+101
-0
lines changed

‎ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.expected

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
edges
2+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:10:5:10:8 | name |
3+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:11:5:11:8 | name |
4+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:12:5:12:8 | name |
5+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:13:5:13:8 | name |
6+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:14:5:14:8 | name |
7+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:15:5:15:8 | name |
8+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:16:5:16:8 | name |
9+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:17:5:17:8 | name |
10+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:18:5:18:8 | name |
11+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:19:5:19:8 | name |
12+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:20:5:20:8 | name |
13+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:21:5:21:8 | name |
14+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:22:5:22:8 | name |
15+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:23:17:23:20 | name |
16+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:24:18:24:21 | name |
17+
| PolynomialReDoS.rb:27:9:27:14 | call to params : | PolynomialReDoS.rb:28:5:28:5 | a |
18+
| PolynomialReDoS.rb:29:9:29:14 | call to params : | PolynomialReDoS.rb:30:5:30:5 | b |
19+
| PolynomialReDoS.rb:31:9:31:14 | call to params : | PolynomialReDoS.rb:32:5:32:5 | c |
20+
nodes
21+
| PolynomialReDoS.rb:4:12:4:17 | call to params : | semmle.label | call to params : |
22+
| PolynomialReDoS.rb:10:5:10:8 | name | semmle.label | name |
23+
| PolynomialReDoS.rb:11:5:11:8 | name | semmle.label | name |
24+
| PolynomialReDoS.rb:12:5:12:8 | name | semmle.label | name |
25+
| PolynomialReDoS.rb:13:5:13:8 | name | semmle.label | name |
26+
| PolynomialReDoS.rb:14:5:14:8 | name | semmle.label | name |
27+
| PolynomialReDoS.rb:15:5:15:8 | name | semmle.label | name |
28+
| PolynomialReDoS.rb:16:5:16:8 | name | semmle.label | name |
29+
| PolynomialReDoS.rb:17:5:17:8 | name | semmle.label | name |
30+
| PolynomialReDoS.rb:18:5:18:8 | name | semmle.label | name |
31+
| PolynomialReDoS.rb:19:5:19:8 | name | semmle.label | name |
32+
| PolynomialReDoS.rb:20:5:20:8 | name | semmle.label | name |
33+
| PolynomialReDoS.rb:21:5:21:8 | name | semmle.label | name |
34+
| PolynomialReDoS.rb:22:5:22:8 | name | semmle.label | name |
35+
| PolynomialReDoS.rb:23:17:23:20 | name | semmle.label | name |
36+
| PolynomialReDoS.rb:24:18:24:21 | name | semmle.label | name |
37+
| PolynomialReDoS.rb:27:9:27:14 | call to params : | semmle.label | call to params : |
38+
| PolynomialReDoS.rb:28:5:28:5 | a | semmle.label | a |
39+
| PolynomialReDoS.rb:29:9:29:14 | call to params : | semmle.label | call to params : |
40+
| PolynomialReDoS.rb:30:5:30:5 | b | semmle.label | b |
41+
| PolynomialReDoS.rb:31:9:31:14 | call to params : | semmle.label | call to params : |
42+
| PolynomialReDoS.rb:32:5:32:5 | c | semmle.label | c |
43+
#select
44+
| PolynomialReDoS.rb:10:5:10:17 | ... =~ ... | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:10:5:10:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
45+
| PolynomialReDoS.rb:11:5:11:17 | ... !~ ... | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:11:5:11:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
46+
| PolynomialReDoS.rb:12:5:12:15 | ...[...] | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:12:5:12:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
47+
| PolynomialReDoS.rb:13:5:13:23 | call to gsub | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:13:5:13:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
48+
| PolynomialReDoS.rb:14:5:14:20 | call to index | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:14:5:14:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
49+
| PolynomialReDoS.rb:15:5:15:20 | call to match | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:15:5:15:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
50+
| PolynomialReDoS.rb:16:5:16:21 | call to match? | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:16:5:16:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
51+
| PolynomialReDoS.rb:17:5:17:24 | call to partition | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:17:5:17:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
52+
| PolynomialReDoS.rb:18:5:18:21 | call to rindex | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:18:5:18:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
53+
| PolynomialReDoS.rb:19:5:19:25 | call to rpartition | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:19:5:19:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
54+
| PolynomialReDoS.rb:20:5:20:19 | call to scan | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:20:5:20:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
55+
| PolynomialReDoS.rb:21:5:21:20 | call to split | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:21:5:21:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
56+
| PolynomialReDoS.rb:22:5:22:22 | call to sub | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:22:5:22:8 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
57+
| PolynomialReDoS.rb:23:5:23:20 | call to match | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:23:17:23:20 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
58+
| PolynomialReDoS.rb:24:5:24:21 | call to match? | PolynomialReDoS.rb:4:12:4:17 | call to params : | PolynomialReDoS.rb:24:18:24:21 | name | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:4:12:4:17 | call to params | a user-provided value |
59+
| PolynomialReDoS.rb:28:5:28:21 | call to gsub! | PolynomialReDoS.rb:27:9:27:14 | call to params : | PolynomialReDoS.rb:28:5:28:5 | a | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:27:9:27:14 | call to params | a user-provided value |
60+
| PolynomialReDoS.rb:30:5:30:18 | call to slice! | PolynomialReDoS.rb:29:9:29:14 | call to params : | PolynomialReDoS.rb:30:5:30:5 | b | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:29:9:29:14 | call to params | a user-provided value |
61+
| PolynomialReDoS.rb:32:5:32:20 | call to sub! | PolynomialReDoS.rb:31:9:31:14 | call to params : | PolynomialReDoS.rb:32:5:32:5 | c | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | PolynomialReDoS.rb:7:19:7:21 | \\s+ | regular expression | PolynomialReDoS.rb:31:9:31:14 | call to params | a user-provided value |

‎ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
queries/security/cwe-1333/PolynomialReDoS.ql

‎ql/test/query-tests/security/cwe-1333-polynomial-redos/PolynomialReDoS.rb

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
class FooController < ActionController::Base
2+
def some_request_handler
3+
# A source for the data-flow query (i.e. a remote flow source)
4+
name = params[:name]
5+
6+
# A vulnerable regex
7+
regex = /^\s+|\s+$/
8+
9+
# Various sinks that match the source against the regex
10+
name =~ regex # NOT GOOD
11+
name !~ regex # NOT GOOD
12+
name[regex] # NOT GOOD
13+
name.gsub regex, '' # NOT GOOD
14+
name.index regex # NOT GOOD
15+
name.match regex # NOT GOOD
16+
name.match? regex # NOT GOOD
17+
name.partition regex # NOT GOOD
18+
name.rindex regex # NOT GOOD
19+
name.rpartition regex # NOT GOOD
20+
name.scan regex # NOT GOOD
21+
name.split regex # NOT GOOD
22+
name.sub regex, '' # NOT GOOD
23+
regex.match name # NOT GOOD
24+
regex.match? name # NOT GOOD
25+
26+
# Destructive variants
27+
a = params[:b]
28+
a.gsub! regex, '' # NOT GOOD
29+
b = params[:a]
30+
b.slice! regex # NOT GOOD
31+
c = params[:c]
32+
c.sub! regex, '' # NOT GOOD
33+
34+
# GOOD - guarded by a string length check
35+
if name.length < 1024
36+
name.gsub regex, ''
37+
end
38+
end
39+
end

0 commit comments

Comments
 (0)