Skip to content

Commit b80a84c

Browse files
nickrolfenickrolfe
authored
Merge pull request #7341 from github/nickrolfe/cookies
2 parents 66c1629 + b6c5b4d commit b80a84c

File tree

6 files changed

+58
-20
lines changed

6 files changed

+58
-20
lines changed

‎ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,28 @@ class ParamsSource extends RemoteFlowSource::Range {
118118
override string getSourceType() { result = "ActionController::Metal#params" }
119119
}
120120

121+
/**
122+
* A call to the `cookies` method to fetch the request parameters.
123+
*/
124+
abstract class CookiesCall extends MethodCall {
125+
CookiesCall() { this.getMethodName() = "cookies" }
126+
}
127+
128+
/**
129+
* A `RemoteFlowSource::Range` to represent accessing the
130+
* ActionController parameters available via the `cookies` method.
131+
*/
132+
class CookiesSource extends RemoteFlowSource::Range {
133+
CookiesCall call;
134+
135+
CookiesSource() { this.asExpr().getExpr() = call }
136+
137+
override string getSourceType() { result = "ActionController::Metal#cookies" }
138+
}
139+
140+
// A call to `cookies` from within a controller.
141+
private class ActionControllerCookiesCall extends ActionControllerContextCall, CookiesCall { }
142+
121143
// A call to `params` from within a controller.
122144
private class ActionControllerParamsCall extends ActionControllerContextCall, ParamsCall { }
123145

‎ruby/ql/lib/codeql/ruby/frameworks/ActionView.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,9 @@ class RawCall extends ActionViewContextCall {
6666
// A call to the `params` method within the context of a template.
6767
private class ActionViewParamsCall extends ActionViewContextCall, ParamsCall { }
6868

69+
// A call to the `cookies` method within the context of a template.
70+
private class ActionViewCookiesCall extends ActionViewContextCall, CookiesCall { }
71+
6972
/**
7073
* A call to a `render` method that will populate the response body with the
7174
* rendered content.

‎ruby/ql/test/library-tests/frameworks/ActionController.expected

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@ actionControllerControllerClasses
22
| ActiveRecordInjection.rb:27:1:58:3 | FooController |
33
| ActiveRecordInjection.rb:60:1:90:3 | BarController |
44
| ActiveRecordInjection.rb:92:1:96:3 | BazController |
5-
| app/controllers/foo/bars_controller.rb:1:1:20:3 | BarsController |
5+
| app/controllers/foo/bars_controller.rb:3:1:25:3 | BarsController |
66
actionControllerActionMethods
77
| ActiveRecordInjection.rb:32:3:57:5 | some_request_handler |
88
| ActiveRecordInjection.rb:61:3:69:5 | some_other_request_handler |
99
| ActiveRecordInjection.rb:71:3:89:5 | safe_paths |
1010
| ActiveRecordInjection.rb:93:3:95:5 | yet_another_handler |
11-
| app/controllers/foo/bars_controller.rb:3:3:5:5 | index |
12-
| app/controllers/foo/bars_controller.rb:7:3:13:5 | show_debug |
13-
| app/controllers/foo/bars_controller.rb:15:3:19:5 | show |
11+
| app/controllers/foo/bars_controller.rb:5:3:7:5 | index |
12+
| app/controllers/foo/bars_controller.rb:9:3:18:5 | show_debug |
13+
| app/controllers/foo/bars_controller.rb:20:3:24:5 | show |
1414
paramsCalls
1515
| ActiveRecordInjection.rb:35:30:35:35 | call to params |
1616
| ActiveRecordInjection.rb:39:29:39:34 | call to params |
@@ -25,10 +25,10 @@ paramsCalls
2525
| ActiveRecordInjection.rb:83:12:83:17 | call to params |
2626
| ActiveRecordInjection.rb:88:15:88:20 | call to params |
2727
| ActiveRecordInjection.rb:94:21:94:26 | call to params |
28-
| app/controllers/foo/bars_controller.rb:8:21:8:26 | call to params |
29-
| app/controllers/foo/bars_controller.rb:9:10:9:15 | call to params |
30-
| app/controllers/foo/bars_controller.rb:16:21:16:26 | call to params |
31-
| app/controllers/foo/bars_controller.rb:17:10:17:15 | call to params |
28+
| app/controllers/foo/bars_controller.rb:13:21:13:26 | call to params |
29+
| app/controllers/foo/bars_controller.rb:14:10:14:15 | call to params |
30+
| app/controllers/foo/bars_controller.rb:21:21:21:26 | call to params |
31+
| app/controllers/foo/bars_controller.rb:22:10:22:15 | call to params |
3232
| app/views/foo/bars/show.html.erb:5:9:5:14 | call to params |
3333
paramsSources
3434
| ActiveRecordInjection.rb:35:30:35:35 | call to params |
@@ -44,17 +44,21 @@ paramsSources
4444
| ActiveRecordInjection.rb:83:12:83:17 | call to params |
4545
| ActiveRecordInjection.rb:88:15:88:20 | call to params |
4646
| ActiveRecordInjection.rb:94:21:94:26 | call to params |
47-
| app/controllers/foo/bars_controller.rb:8:21:8:26 | call to params |
48-
| app/controllers/foo/bars_controller.rb:9:10:9:15 | call to params |
49-
| app/controllers/foo/bars_controller.rb:16:21:16:26 | call to params |
50-
| app/controllers/foo/bars_controller.rb:17:10:17:15 | call to params |
47+
| app/controllers/foo/bars_controller.rb:13:21:13:26 | call to params |
48+
| app/controllers/foo/bars_controller.rb:14:10:14:15 | call to params |
49+
| app/controllers/foo/bars_controller.rb:21:21:21:26 | call to params |
50+
| app/controllers/foo/bars_controller.rb:22:10:22:15 | call to params |
5151
| app/views/foo/bars/show.html.erb:5:9:5:14 | call to params |
52+
cookiesCalls
53+
| app/controllers/foo/bars_controller.rb:10:27:10:33 | call to cookies |
54+
cookiesSources
55+
| app/controllers/foo/bars_controller.rb:10:27:10:33 | call to cookies |
5256
redirectToCalls
53-
| app/controllers/foo/bars_controller.rb:12:5:12:30 | call to redirect_to |
57+
| app/controllers/foo/bars_controller.rb:17:5:17:30 | call to redirect_to |
5458
actionControllerHelperMethods
5559
getAssociatedControllerClasses
56-
| app/controllers/foo/bars_controller.rb:1:1:20:3 | BarsController | app/views/foo/bars/_widget.html.erb:0:0:0:0 | app/views/foo/bars/_widget.html.erb |
57-
| app/controllers/foo/bars_controller.rb:1:1:20:3 | BarsController | app/views/foo/bars/show.html.erb:0:0:0:0 | app/views/foo/bars/show.html.erb |
60+
| app/controllers/foo/bars_controller.rb:3:1:25:3 | BarsController | app/views/foo/bars/_widget.html.erb:0:0:0:0 | app/views/foo/bars/_widget.html.erb |
61+
| app/controllers/foo/bars_controller.rb:3:1:25:3 | BarsController | app/views/foo/bars/show.html.erb:0:0:0:0 | app/views/foo/bars/show.html.erb |
5862
controllerTemplateFiles
59-
| app/controllers/foo/bars_controller.rb:1:1:20:3 | BarsController | app/views/foo/bars/_widget.html.erb:0:0:0:0 | app/views/foo/bars/_widget.html.erb |
60-
| app/controllers/foo/bars_controller.rb:1:1:20:3 | BarsController | app/views/foo/bars/show.html.erb:0:0:0:0 | app/views/foo/bars/show.html.erb |
63+
| app/controllers/foo/bars_controller.rb:3:1:25:3 | BarsController | app/views/foo/bars/_widget.html.erb:0:0:0:0 | app/views/foo/bars/_widget.html.erb |
64+
| app/controllers/foo/bars_controller.rb:3:1:25:3 | BarsController | app/views/foo/bars/show.html.erb:0:0:0:0 | app/views/foo/bars/show.html.erb |

‎ruby/ql/test/library-tests/frameworks/ActionController.ql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ query predicate paramsCalls(ParamsCall c) { any() }
1010

1111
query predicate paramsSources(ParamsSource src) { any() }
1212

13+
query predicate cookiesCalls(CookiesCall c) { any() }
14+
15+
query predicate cookiesSources(CookiesSource src) { any() }
16+
1317
query predicate redirectToCalls(RedirectToCall c) { any() }
1418

1519
query predicate actionControllerHelperMethods(ActionControllerHelperMethod m) { any() }

‎ruby/ql/test/library-tests/frameworks/ActionView.expected

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ rawCalls
1212
| app/views/foo/bars/show.html.erb:5:5:5:21 | call to raw |
1313
| app/views/foo/bars/show.html.erb:7:5:7:19 | call to raw |
1414
renderCalls
15-
| app/controllers/foo/bars_controller.rb:4:5:4:37 | call to render |
16-
| app/controllers/foo/bars_controller.rb:18:5:18:76 | call to render |
15+
| app/controllers/foo/bars_controller.rb:6:5:6:37 | call to render |
16+
| app/controllers/foo/bars_controller.rb:23:5:23:76 | call to render |
1717
| app/views/foo/bars/show.html.erb:31:5:31:89 | call to render |
1818
renderToCalls
19-
| app/controllers/foo/bars_controller.rb:10:16:10:97 | call to render_to_string |
19+
| app/controllers/foo/bars_controller.rb:15:16:15:97 | call to render_to_string |
2020
linkToCalls
2121
| app/views/foo/bars/show.html.erb:33:5:33:41 | call to link_to |

‎ruby/ql/test/library-tests/frameworks/app/controllers/foo/bars_controller.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
1+
require 'json'
2+
13
class BarsController < ApplicationController
24

35
def index
46
render template: "foo/bars/index"
57
end
68

79
def show_debug
10+
user_info = JSON.load cookies[:user_info]
11+
puts "User: #{user_info['name']}"
12+
813
@user_website = params[:website]
914
dt = params[:text]
1015
rendered = render_to_string "foo/bars/show", locals: { display_text: dt, safe_text: "hello" }

0 commit comments

Comments
 (0)