Skip to content

Commit 12b918e

Browse files
chanel-ychanel-y
committed
pr feedback: removed toString, updated .expected
1 parent ed553d3 commit 12b918e

File tree

2 files changed

+153
-26
lines changed

2 files changed

+153
-26
lines changed

‎powershell/ql/lib/semmle/code/powershell/security/CommandInjectionCustomizations.qll

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -91,18 +91,19 @@ class CreateNestedPipelineSink extends Sink {
9191
}
9292

9393
class AddScriptInvokeSink extends Sink {
94-
AddScriptInvokeSink() {
95-
exists(InvokeMemberExpr ie |
96-
this.asExpr().getExpr() = ie.getAnArgument() and
97-
ie.getName() = "AddScript" and
98-
ie.getQualifier().(InvokeMemberExpr).getName() = "Create" and
99-
ie.getQualifier().getAChild().toString() = "PowerShell" and
100-
ie.getParent().(InvokeMemberExpr).getName() = "Invoke"
101-
)
102-
}
103-
override string getSinkType(){
104-
result = "call to AddScript"
105-
}
94+
AddScriptInvokeSink() {
95+
exists(InvokeMemberExpr addscript, InvokeMemberExpr create |
96+
this.asExpr().getExpr() = addscript.getAnArgument() and
97+
addscript.getName() = "AddScript" and
98+
create.getName() = "Create" and
99+
100+
addscript.getQualifier().(InvokeMemberExpr) = create and
101+
create.getQualifier().(TypeNameExpr).getName() = "PowerShell"
102+
)
103+
}
104+
override string getSinkType(){
105+
result = "call to AddScript"
106+
}
106107
}
107108

108109
class PowershellSink extends Sink {
@@ -111,7 +112,7 @@ class PowershellSink extends Sink {
111112
c.getName() = "powershell" |
112113
(
113114
this.asExpr().getExpr() = c.getArgument(1) and
114-
c.getArgument(0).getValue().toString() = "-command"
115+
c.getArgument(0).getValue().asString() = "-command"
115116
) or
116117
(
117118
this.asExpr().getExpr() = c.getArgument(0)
@@ -128,7 +129,7 @@ class CmdSink extends Sink {
128129
exists(CmdCall c |
129130
this.asExpr().getExpr() = c.getArgument(1) and
130131
c.getName() = "cmd" and
131-
c.getArgument(0).getValue().toString() = "/c"
132+
c.getArgument(0).getValue().asString() = "/c"
132133
)
133134
}
134135
override string getSinkType(){
@@ -165,7 +166,7 @@ class CreateScriptBlockSink extends Sink {
165166
exists(InvokeMemberExpr ie |
166167
this.asExpr().getExpr() = ie.getAnArgument() and
167168
ie.getName() = "Create" and
168-
ie.getQualifier().toString() = "ScriptBlock"
169+
ie.getQualifier().(TypeNameExpr).getName() = "ScriptBlock"
169170
)
170171
}
171172
override string getSinkType(){
@@ -219,9 +220,10 @@ class ExpandStringSink extends Sink {
219220

220221
class SingleQuoteSanitizer extends Sanitizer {
221222
SingleQuoteSanitizer() {
222-
exists(Expr e, VarReadAccess v |
223-
e = this.asExpr().getExpr().getParent() and
224-
e.toString().matches("%'$" + v.getVariable().getName() + "'%")
223+
exists(ExpandableStringExpr e, VarReadAccess v |
224+
v = this.asExpr().getExpr() and
225+
e.getUnexpandedValue().matches("%'$" + v.getVariable().getName() + "'%") and
226+
e.getAnExpr() = v
225227
)
226228
}
227229
}

‎powershell/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected

Lines changed: 133 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,137 @@
11
edges
2-
| test.ps1:1:8:1:9 | x | test.ps1:3:28:3:47 | Get-Process -Id $x | provenance | |
3-
| test.ps1:5:10:5:20 | my_var | test.ps1:7:3:7:19 | $code --enabled | provenance | |
2+
| test.ps1:3:11:3:20 | UserInput | test.ps1:4:23:4:52 | Get-Process -Name $UserInput | provenance | |
3+
| test.ps1:9:11:9:20 | UserInput | test.ps1:10:9:10:38 | Get-Process -Name $UserInput | provenance | |
4+
| test.ps1:15:11:15:20 | UserInput | test.ps1:16:50:16:79 | Get-Process -Name $UserInput | provenance | |
5+
| test.ps1:21:11:21:20 | UserInput | test.ps1:22:41:22:70 | Get-Process -Name $UserInput | provenance | |
6+
| test.ps1:21:11:21:20 | UserInput | test.ps1:22:60:22:69 | UserInput | provenance | |
7+
| test.ps1:27:11:27:20 | UserInput | test.ps1:28:38:28:67 | Get-Process -Name $UserInput | provenance | |
8+
| test.ps1:27:11:27:20 | UserInput | test.ps1:28:57:28:66 | UserInput | provenance | |
9+
| test.ps1:33:11:33:20 | UserInput | test.ps1:34:14:34:46 | public class Foo { $UserInput } | provenance | |
10+
| test.ps1:39:11:39:20 | UserInput | test.ps1:40:30:40:62 | public class Foo { $UserInput } | provenance | |
11+
| test.ps1:45:11:45:20 | UserInput | test.ps1:48:30:48:34 | code | provenance | |
12+
| test.ps1:73:11:73:20 | UserInput | test.ps1:75:25:75:54 | Get-Process -Name $UserInput | provenance | |
13+
| test.ps1:80:11:80:20 | UserInput | test.ps1:82:16:82:45 | Get-Process -Name $UserInput | provenance | |
14+
| test.ps1:87:11:87:20 | UserInput | test.ps1:89:12:89:28 | ping $UserInput | provenance | |
15+
| test.ps1:94:11:94:20 | UserInput | test.ps1:98:33:98:62 | Get-Process -Name $UserInput | provenance | |
16+
| test.ps1:104:11:104:20 | UserInput | test.ps1:108:58:108:87 | Get-Process -Name $UserInput | provenance | |
17+
| test.ps1:114:11:114:20 | UserInput | test.ps1:116:34:116:43 | UserInput | provenance | |
18+
| test.ps1:121:11:121:20 | UserInput | test.ps1:123:28:123:37 | UserInput | provenance | |
19+
| test.ps1:128:11:128:20 | UserInput | test.ps1:130:28:130:37 | UserInput | provenance | |
20+
| test.ps1:136:11:136:20 | UserInput | test.ps1:139:50:139:59 | UserInput | provenance | |
21+
| test.ps1:144:11:144:20 | UserInput | test.ps1:147:63:147:72 | UserInput | provenance | |
22+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:154:46:154:51 | input | provenance | Src:MaD:11464 |
23+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:155:46:155:51 | input | provenance | Src:MaD:11464 |
24+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:156:46:156:51 | input | provenance | Src:MaD:11464 |
25+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:157:46:157:51 | input | provenance | Src:MaD:11464 |
26+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:158:46:158:51 | input | provenance | Src:MaD:11464 |
27+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:159:46:159:51 | input | provenance | Src:MaD:11464 |
28+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:160:46:160:51 | input | provenance | Src:MaD:11464 |
29+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:161:46:161:51 | input | provenance | Src:MaD:11464 |
30+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:163:48:163:53 | input | provenance | Src:MaD:11464 |
31+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:164:48:164:53 | input | provenance | Src:MaD:11464 |
32+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:165:48:165:53 | input | provenance | Src:MaD:11464 |
33+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:166:41:166:46 | input | provenance | Src:MaD:11464 |
34+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:167:41:167:46 | input | provenance | Src:MaD:11464 |
35+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:168:36:168:41 | input | provenance | Src:MaD:11464 |
36+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:169:36:169:41 | input | provenance | Src:MaD:11464 |
37+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:170:36:170:41 | input | provenance | Src:MaD:11464 |
38+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:172:42:172:47 | input | provenance | Src:MaD:11464 |
39+
| test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:173:42:173:47 | input | provenance | Src:MaD:11464 |
40+
| test.ps1:154:46:154:51 | input | test.ps1:3:11:3:20 | UserInput | provenance | |
41+
| test.ps1:155:46:155:51 | input | test.ps1:9:11:9:20 | UserInput | provenance | |
42+
| test.ps1:156:46:156:51 | input | test.ps1:15:11:15:20 | UserInput | provenance | |
43+
| test.ps1:157:46:157:51 | input | test.ps1:21:11:21:20 | UserInput | provenance | |
44+
| test.ps1:158:46:158:51 | input | test.ps1:27:11:27:20 | UserInput | provenance | |
45+
| test.ps1:159:46:159:51 | input | test.ps1:33:11:33:20 | UserInput | provenance | |
46+
| test.ps1:160:46:160:51 | input | test.ps1:39:11:39:20 | UserInput | provenance | |
47+
| test.ps1:161:46:161:51 | input | test.ps1:45:11:45:20 | UserInput | provenance | |
48+
| test.ps1:163:48:163:53 | input | test.ps1:73:11:73:20 | UserInput | provenance | |
49+
| test.ps1:164:48:164:53 | input | test.ps1:80:11:80:20 | UserInput | provenance | |
50+
| test.ps1:165:48:165:53 | input | test.ps1:87:11:87:20 | UserInput | provenance | |
51+
| test.ps1:166:41:166:46 | input | test.ps1:94:11:94:20 | UserInput | provenance | |
52+
| test.ps1:167:41:167:46 | input | test.ps1:104:11:104:20 | UserInput | provenance | |
53+
| test.ps1:168:36:168:41 | input | test.ps1:114:11:114:20 | UserInput | provenance | |
54+
| test.ps1:169:36:169:41 | input | test.ps1:121:11:121:20 | UserInput | provenance | |
55+
| test.ps1:170:36:170:41 | input | test.ps1:128:11:128:20 | UserInput | provenance | |
56+
| test.ps1:172:42:172:47 | input | test.ps1:136:11:136:20 | UserInput | provenance | |
57+
| test.ps1:173:42:173:47 | input | test.ps1:144:11:144:20 | UserInput | provenance | |
458
nodes
5-
| test.ps1:1:8:1:9 | x | semmle.label | x |
6-
| test.ps1:3:28:3:47 | Get-Process -Id $x | semmle.label | Get-Process -Id $x |
7-
| test.ps1:5:10:5:20 | my_var | semmle.label | my_var |
8-
| test.ps1:7:3:7:19 | $code --enabled | semmle.label | $code --enabled |
59+
| test.ps1:3:11:3:20 | UserInput | semmle.label | UserInput |
60+
| test.ps1:4:23:4:52 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
61+
| test.ps1:9:11:9:20 | UserInput | semmle.label | UserInput |
62+
| test.ps1:10:9:10:38 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
63+
| test.ps1:15:11:15:20 | UserInput | semmle.label | UserInput |
64+
| test.ps1:16:50:16:79 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
65+
| test.ps1:21:11:21:20 | UserInput | semmle.label | UserInput |
66+
| test.ps1:22:41:22:70 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
67+
| test.ps1:22:60:22:69 | UserInput | semmle.label | UserInput |
68+
| test.ps1:27:11:27:20 | UserInput | semmle.label | UserInput |
69+
| test.ps1:28:38:28:67 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
70+
| test.ps1:28:57:28:66 | UserInput | semmle.label | UserInput |
71+
| test.ps1:33:11:33:20 | UserInput | semmle.label | UserInput |
72+
| test.ps1:34:14:34:46 | public class Foo { $UserInput } | semmle.label | public class Foo { $UserInput } |
73+
| test.ps1:39:11:39:20 | UserInput | semmle.label | UserInput |
74+
| test.ps1:40:30:40:62 | public class Foo { $UserInput } | semmle.label | public class Foo { $UserInput } |
75+
| test.ps1:45:11:45:20 | UserInput | semmle.label | UserInput |
76+
| test.ps1:48:30:48:34 | code | semmle.label | code |
77+
| test.ps1:73:11:73:20 | UserInput | semmle.label | UserInput |
78+
| test.ps1:75:25:75:54 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
79+
| test.ps1:80:11:80:20 | UserInput | semmle.label | UserInput |
80+
| test.ps1:82:16:82:45 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
81+
| test.ps1:87:11:87:20 | UserInput | semmle.label | UserInput |
82+
| test.ps1:89:12:89:28 | ping $UserInput | semmle.label | ping $UserInput |
83+
| test.ps1:94:11:94:20 | UserInput | semmle.label | UserInput |
84+
| test.ps1:98:33:98:62 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
85+
| test.ps1:104:11:104:20 | UserInput | semmle.label | UserInput |
86+
| test.ps1:108:58:108:87 | Get-Process -Name $UserInput | semmle.label | Get-Process -Name $UserInput |
87+
| test.ps1:114:11:114:20 | UserInput | semmle.label | UserInput |
88+
| test.ps1:116:34:116:43 | UserInput | semmle.label | UserInput |
89+
| test.ps1:121:11:121:20 | UserInput | semmle.label | UserInput |
90+
| test.ps1:123:28:123:37 | UserInput | semmle.label | UserInput |
91+
| test.ps1:128:11:128:20 | UserInput | semmle.label | UserInput |
92+
| test.ps1:130:28:130:37 | UserInput | semmle.label | UserInput |
93+
| test.ps1:136:11:136:20 | UserInput | semmle.label | UserInput |
94+
| test.ps1:139:50:139:59 | UserInput | semmle.label | UserInput |
95+
| test.ps1:144:11:144:20 | UserInput | semmle.label | UserInput |
96+
| test.ps1:147:63:147:72 | UserInput | semmle.label | UserInput |
97+
| test.ps1:152:10:152:32 | Call to Read-Host | semmle.label | Call to Read-Host |
98+
| test.ps1:154:46:154:51 | input | semmle.label | input |
99+
| test.ps1:155:46:155:51 | input | semmle.label | input |
100+
| test.ps1:156:46:156:51 | input | semmle.label | input |
101+
| test.ps1:157:46:157:51 | input | semmle.label | input |
102+
| test.ps1:158:46:158:51 | input | semmle.label | input |
103+
| test.ps1:159:46:159:51 | input | semmle.label | input |
104+
| test.ps1:160:46:160:51 | input | semmle.label | input |
105+
| test.ps1:161:46:161:51 | input | semmle.label | input |
106+
| test.ps1:163:48:163:53 | input | semmle.label | input |
107+
| test.ps1:164:48:164:53 | input | semmle.label | input |
108+
| test.ps1:165:48:165:53 | input | semmle.label | input |
109+
| test.ps1:166:41:166:46 | input | semmle.label | input |
110+
| test.ps1:167:41:167:46 | input | semmle.label | input |
111+
| test.ps1:168:36:168:41 | input | semmle.label | input |
112+
| test.ps1:169:36:169:41 | input | semmle.label | input |
113+
| test.ps1:170:36:170:41 | input | semmle.label | input |
114+
| test.ps1:172:42:172:47 | input | semmle.label | input |
115+
| test.ps1:173:42:173:47 | input | semmle.label | input |
9116
subpaths
10117
#select
11-
| test.ps1:3:28:3:47 | Get-Process -Id $x | test.ps1:1:8:1:9 | x | test.ps1:3:28:3:47 | Get-Process -Id $x | This command depends on a $@. | test.ps1:1:8:1:9 | x | user-provided value |
12-
| test.ps1:7:3:7:19 | $code --enabled | test.ps1:5:10:5:20 | my_var | test.ps1:7:3:7:19 | $code --enabled | This command depends on a $@. | test.ps1:5:10:5:20 | my_var | user-provided value |
118+
| test.ps1:4:23:4:52 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:4:23:4:52 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
119+
| test.ps1:10:9:10:38 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:10:9:10:38 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
120+
| test.ps1:16:50:16:79 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:16:50:16:79 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
121+
| test.ps1:22:41:22:70 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:22:41:22:70 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
122+
| test.ps1:22:60:22:69 | UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:22:60:22:69 | UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
123+
| test.ps1:28:38:28:67 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:28:38:28:67 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
124+
| test.ps1:28:57:28:66 | UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:28:57:28:66 | UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
125+
| test.ps1:34:14:34:46 | public class Foo { $UserInput } | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:34:14:34:46 | public class Foo { $UserInput } | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
126+
| test.ps1:40:30:40:62 | public class Foo { $UserInput } | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:40:30:40:62 | public class Foo { $UserInput } | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
127+
| test.ps1:48:30:48:34 | code | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:48:30:48:34 | code | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
128+
| test.ps1:75:25:75:54 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:75:25:75:54 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
129+
| test.ps1:82:16:82:45 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:82:16:82:45 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
130+
| test.ps1:89:12:89:28 | ping $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:89:12:89:28 | ping $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
131+
| test.ps1:98:33:98:62 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:98:33:98:62 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
132+
| test.ps1:108:58:108:87 | Get-Process -Name $UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:108:58:108:87 | Get-Process -Name $UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
133+
| test.ps1:116:34:116:43 | UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:116:34:116:43 | UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
134+
| test.ps1:123:28:123:37 | UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:123:28:123:37 | UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
135+
| test.ps1:130:28:130:37 | UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:130:28:130:37 | UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
136+
| test.ps1:139:50:139:59 | UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:139:50:139:59 | UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |
137+
| test.ps1:147:63:147:72 | UserInput | test.ps1:152:10:152:32 | Call to Read-Host | test.ps1:147:63:147:72 | UserInput | This command depends on a $@. | test.ps1:152:10:152:32 | Call to Read-Host | user-provided value |

0 commit comments

Comments
 (0)