Skip to content

Commit 3e23a6e

Browse files
committed
Ruby: configsig rb/server-side-template-injection
1 parent 0a73ebd commit 3e23a6e

File tree

2 files changed

+18
-4
lines changed

2 files changed

+18
-4
lines changed

ruby/ql/lib/codeql/ruby/security/TemplateInjectionQuery.qll

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,9 @@ import TemplateInjectionCustomizations::TemplateInjection
99

1010
/**
1111
* A taint-tracking configuration for detecting Server Side Template Injections vulnerabilities.
12+
* DEPRECATED: Use `TemplateInjectionFlow`
1213
*/
13-
class Configuration extends TaintTracking::Configuration {
14+
deprecated class Configuration extends TaintTracking::Configuration {
1415
Configuration() { this = "TemplateInjection" }
1516

1617
override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -19,3 +20,16 @@ class Configuration extends TaintTracking::Configuration {
1920

2021
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
2122
}
23+
24+
private module TemplateInjectionConfig implements DataFlow::ConfigSig {
25+
predicate isSource(DataFlow::Node source) { source instanceof Source }
26+
27+
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
28+
29+
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
30+
}
31+
32+
/**
33+
* Taint-tracking for detecting Server Side Template Injections vulnerabilities.
34+
*/
35+
module TemplateInjectionFlow = TaintTracking::Global<TemplateInjectionConfig>;

ruby/ql/src/experimental/template-injection/TemplateInjection.ql

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@
1313

1414
import codeql.ruby.DataFlow
1515
import codeql.ruby.security.TemplateInjectionQuery
16-
import DataFlow::PathGraph
16+
import TemplateInjectionFlow::PathGraph
1717

18-
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
19-
where config.hasFlowPath(source, sink)
18+
from TemplateInjectionFlow::PathNode source, TemplateInjectionFlow::PathNode sink
19+
where TemplateInjectionFlow::flowPath(source, sink)
2020
select sink.getNode(), source, sink, "This template depends on a $@.", source.getNode(),
2121
"user-provided value"

0 commit comments

Comments
 (0)