Skip to content

Commit 5a85fa1

Browse files
gregxsundaygregxsunday
committed
add block test cases and update tests
1 parent f9b5846 commit 5a85fa1

File tree

2 files changed

+84
-26
lines changed

2 files changed

+84
-26
lines changed

‎ruby/ql/test/query-tests/security/cwe-022-ZipSlip/ZipSlip.expected

Lines changed: 42 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,53 @@ edges
22
| zip_slip.rb:8:15:8:54 | call to new : | zip_slip.rb:9:5:9:11 | tarfile : |
33
| zip_slip.rb:9:5:9:11 | tarfile : | zip_slip.rb:9:22:9:26 | entry : |
44
| zip_slip.rb:9:22:9:26 | entry : | zip_slip.rb:10:19:10:33 | call to full_name |
5-
| zip_slip.rb:33:5:33:24 | call to open : | zip_slip.rb:33:35:33:39 | entry : |
6-
| zip_slip.rb:33:35:33:39 | entry : | zip_slip.rb:34:17:34:26 | call to name |
7-
| zip_slip.rb:53:12:53:54 | call to open : | zip_slip.rb:54:11:54:14 | gzip : |
8-
| zip_slip.rb:54:11:54:14 | gzip : | zip_slip.rb:60:42:60:56 | compressed_file : |
9-
| zip_slip.rb:60:42:60:56 | compressed_file : | zip_slip.rb:61:7:61:21 | compressed_file : |
10-
| zip_slip.rb:61:7:61:21 | compressed_file : | zip_slip.rb:61:32:61:36 | entry : |
11-
| zip_slip.rb:61:32:61:36 | entry : | zip_slip.rb:63:21:63:30 | entry_path |
5+
| zip_slip.rb:20:50:20:56 | tarfile : | zip_slip.rb:21:7:21:13 | tarfile : |
6+
| zip_slip.rb:21:7:21:13 | tarfile : | zip_slip.rb:21:30:21:34 | entry : |
7+
| zip_slip.rb:21:30:21:34 | entry : | zip_slip.rb:22:21:22:35 | call to full_name |
8+
| zip_slip.rb:46:5:46:24 | call to open : | zip_slip.rb:46:35:46:39 | entry : |
9+
| zip_slip.rb:46:35:46:39 | entry : | zip_slip.rb:47:17:47:26 | call to name |
10+
| zip_slip.rb:56:30:56:37 | zip_file : | zip_slip.rb:57:7:57:14 | zip_file : |
11+
| zip_slip.rb:57:7:57:14 | zip_file : | zip_slip.rb:57:25:57:29 | entry : |
12+
| zip_slip.rb:57:25:57:29 | entry : | zip_slip.rb:58:19:58:28 | call to name |
13+
| zip_slip.rb:90:12:90:54 | call to open : | zip_slip.rb:91:11:91:14 | gzip : |
14+
| zip_slip.rb:91:11:91:14 | gzip : | zip_slip.rb:97:42:97:56 | compressed_file : |
15+
| zip_slip.rb:97:42:97:56 | compressed_file : | zip_slip.rb:98:7:98:21 | compressed_file : |
16+
| zip_slip.rb:98:7:98:21 | compressed_file : | zip_slip.rb:98:32:98:36 | entry : |
17+
| zip_slip.rb:98:32:98:36 | entry : | zip_slip.rb:100:21:100:30 | entry_path |
18+
| zip_slip.rb:123:12:123:34 | call to new : | zip_slip.rb:124:7:124:8 | gz : |
19+
| zip_slip.rb:124:7:124:8 | gz : | zip_slip.rb:124:19:124:23 | entry : |
20+
| zip_slip.rb:124:19:124:23 | entry : | zip_slip.rb:126:21:126:30 | entry_path |
1221
nodes
1322
| zip_slip.rb:8:15:8:54 | call to new : | semmle.label | call to new : |
1423
| zip_slip.rb:9:5:9:11 | tarfile : | semmle.label | tarfile : |
1524
| zip_slip.rb:9:22:9:26 | entry : | semmle.label | entry : |
1625
| zip_slip.rb:10:19:10:33 | call to full_name | semmle.label | call to full_name |
17-
| zip_slip.rb:33:5:33:24 | call to open : | semmle.label | call to open : |
18-
| zip_slip.rb:33:35:33:39 | entry : | semmle.label | entry : |
19-
| zip_slip.rb:34:17:34:26 | call to name | semmle.label | call to name |
20-
| zip_slip.rb:53:12:53:54 | call to open : | semmle.label | call to open : |
21-
| zip_slip.rb:54:11:54:14 | gzip : | semmle.label | gzip : |
22-
| zip_slip.rb:60:42:60:56 | compressed_file : | semmle.label | compressed_file : |
23-
| zip_slip.rb:61:7:61:21 | compressed_file : | semmle.label | compressed_file : |
24-
| zip_slip.rb:61:32:61:36 | entry : | semmle.label | entry : |
25-
| zip_slip.rb:63:21:63:30 | entry_path | semmle.label | entry_path |
26+
| zip_slip.rb:20:50:20:56 | tarfile : | semmle.label | tarfile : |
27+
| zip_slip.rb:21:7:21:13 | tarfile : | semmle.label | tarfile : |
28+
| zip_slip.rb:21:30:21:34 | entry : | semmle.label | entry : |
29+
| zip_slip.rb:22:21:22:35 | call to full_name | semmle.label | call to full_name |
30+
| zip_slip.rb:46:5:46:24 | call to open : | semmle.label | call to open : |
31+
| zip_slip.rb:46:35:46:39 | entry : | semmle.label | entry : |
32+
| zip_slip.rb:47:17:47:26 | call to name | semmle.label | call to name |
33+
| zip_slip.rb:56:30:56:37 | zip_file : | semmle.label | zip_file : |
34+
| zip_slip.rb:57:7:57:14 | zip_file : | semmle.label | zip_file : |
35+
| zip_slip.rb:57:25:57:29 | entry : | semmle.label | entry : |
36+
| zip_slip.rb:58:19:58:28 | call to name | semmle.label | call to name |
37+
| zip_slip.rb:90:12:90:54 | call to open : | semmle.label | call to open : |
38+
| zip_slip.rb:91:11:91:14 | gzip : | semmle.label | gzip : |
39+
| zip_slip.rb:97:42:97:56 | compressed_file : | semmle.label | compressed_file : |
40+
| zip_slip.rb:98:7:98:21 | compressed_file : | semmle.label | compressed_file : |
41+
| zip_slip.rb:98:32:98:36 | entry : | semmle.label | entry : |
42+
| zip_slip.rb:100:21:100:30 | entry_path | semmle.label | entry_path |
43+
| zip_slip.rb:123:12:123:34 | call to new : | semmle.label | call to new : |
44+
| zip_slip.rb:124:7:124:8 | gz : | semmle.label | gz : |
45+
| zip_slip.rb:124:19:124:23 | entry : | semmle.label | entry : |
46+
| zip_slip.rb:126:21:126:30 | entry_path | semmle.label | entry_path |
2647
subpaths
2748
#select
2849
| zip_slip.rb:10:19:10:33 | call to full_name | zip_slip.rb:8:15:8:54 | call to new : | zip_slip.rb:10:19:10:33 | call to full_name | This file extraction depends on a $@. | zip_slip.rb:8:15:8:54 | call to new | potentially untrusted source |
29-
| zip_slip.rb:34:17:34:26 | call to name | zip_slip.rb:33:5:33:24 | call to open : | zip_slip.rb:34:17:34:26 | call to name | This file extraction depends on a $@. | zip_slip.rb:33:5:33:24 | call to open | potentially untrusted source |
30-
| zip_slip.rb:63:21:63:30 | entry_path | zip_slip.rb:53:12:53:54 | call to open : | zip_slip.rb:63:21:63:30 | entry_path | This file extraction depends on a $@. | zip_slip.rb:53:12:53:54 | call to open | potentially untrusted source |
50+
| zip_slip.rb:22:21:22:35 | call to full_name | zip_slip.rb:20:50:20:56 | tarfile : | zip_slip.rb:22:21:22:35 | call to full_name | This file extraction depends on a $@. | zip_slip.rb:20:50:20:56 | tarfile | potentially untrusted source |
51+
| zip_slip.rb:47:17:47:26 | call to name | zip_slip.rb:46:5:46:24 | call to open : | zip_slip.rb:47:17:47:26 | call to name | This file extraction depends on a $@. | zip_slip.rb:46:5:46:24 | call to open | potentially untrusted source |
52+
| zip_slip.rb:58:19:58:28 | call to name | zip_slip.rb:56:30:56:37 | zip_file : | zip_slip.rb:58:19:58:28 | call to name | This file extraction depends on a $@. | zip_slip.rb:56:30:56:37 | zip_file | potentially untrusted source |
53+
| zip_slip.rb:100:21:100:30 | entry_path | zip_slip.rb:90:12:90:54 | call to open : | zip_slip.rb:100:21:100:30 | entry_path | This file extraction depends on a $@. | zip_slip.rb:90:12:90:54 | call to open | potentially untrusted source |
54+
| zip_slip.rb:126:21:126:30 | entry_path | zip_slip.rb:123:12:123:34 | call to new : | zip_slip.rb:126:21:126:30 | entry_path | This file extraction depends on a $@. | zip_slip.rb:123:12:123:34 | call to new | potentially untrusted source |

‎ruby/ql/test/query-tests/security/cwe-022-ZipSlip/zip_slip.rb

Lines changed: 42 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,19 @@ def tarReaderUnsafe
1212
end
1313
end
1414
end
15+
16+
# BAD
17+
def tarReaderBlockUnsafe
18+
path = params[:path]
19+
file_stream = IO.new(IO.sysopen(path))
20+
Gem::Package::TarReader.new(file_stream) do |tarfile|
21+
tarfile.each_entry do |entry|
22+
::File.open(entry.full_name, "wb") do |os|
23+
entry.read
24+
end
25+
end
26+
end
27+
end
1528

1629
# GOOD
1730
def tarReadeSanitizedExpandPath
@@ -36,6 +49,30 @@ def zipFileUnsafe
3649
end
3750
end
3851
end
52+
53+
# BAD
54+
def zipFileBlockUnsafe
55+
path = params[:path]
56+
Zip::File.open(path) do |zip_file|
57+
zip_file.each do |entry|
58+
File.open(entry.name, "wb") do |os|
59+
entry.read
60+
end
61+
end
62+
end
63+
end
64+
65+
# GOOD
66+
def zipFileBlockSafeHardcodedPath
67+
path = '/safepath.zip'
68+
Zip::File.open(path) do |zip_file|
69+
zip_file.each do |entry|
70+
File.open(entry.name, "wb") do |os|
71+
entry.read
72+
end
73+
end
74+
end
75+
end
3976

4077
# GOOD
4178
def zipFileSanitizedConstCompare
@@ -84,14 +121,11 @@ def gzipReaderUnsafeNewInstance
84121
path = params[:path]
85122
File.open(path, 'rb') do |f|
86123
gz = Zlib::GzipReader.new(f)
87-
uncompressed_data = gz.read
88-
puts uncompressed_data
89-
gz.close
90-
end
91-
zlib.each do |entry|
92-
entry_path = entry.full_name
93-
::File.open(entry_path, 'wb') do |os|
94-
entry.read
124+
gz.each do |entry|
125+
entry_path = entry.full_name
126+
::File.open(entry_path, 'wb') do |os|
127+
entry.read
128+
end
95129
end
96130
end
97131
end

0 commit comments

Comments
 (0)