Skip to content

Commit 464e2e4

Browse files
am0o0hmac
am0o0
authored and
hmac
committed
fix qldoc and test files
1 parent 18fa91b commit 464e2e4

File tree

5 files changed

+89
-104
lines changed

5 files changed

+89
-104
lines changed

‎ruby/ql/lib/codeql/ruby/frameworks/Yaml.qll

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ private class YamlParseStep extends AdditionalTaintStep {
5858
}
5959
}
6060

61+
/**
62+
* A Node ends with YAML parse, parse_stream, parse_file methods
63+
*/
6164
API::Node yamlNode() {
6265
result = yamlLibrary().getMethod(["parse", "parse_stream", "parse_file"]).getReturn()
6366
or
@@ -68,4 +71,7 @@ API::Node yamlNode() {
6871
result = yamlNode().getAnElement()
6972
}
7073

74+
/**
75+
* A YAML module instance
76+
*/
7177
API::Node yamlLibrary() { result = API::getTopLevelMember(["YAML", "Psych"]) }

‎ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/PlistUnsafeDeserialization.rb

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.expected

Lines changed: 29 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
edges
2-
| PlistUnsafeDeserialization.rb:5:30:5:35 | call to params | PlistUnsafeDeserialization.rb:5:30:5:49 | ...[...] | provenance | |
3-
| PlistUnsafeDeserialization.rb:6:30:6:35 | call to params | PlistUnsafeDeserialization.rb:6:30:6:49 | ...[...] | provenance | |
42
| UnsafeDeserialization.rb:11:5:11:19 | serialized_data | UnsafeDeserialization.rb:12:27:12:41 | serialized_data | provenance | |
53
| UnsafeDeserialization.rb:11:23:11:50 | call to decode64 | UnsafeDeserialization.rb:11:5:11:19 | serialized_data | provenance | |
64
| UnsafeDeserialization.rb:11:39:11:44 | call to params | UnsafeDeserialization.rb:11:39:11:50 | ...[...] | provenance | |
@@ -40,21 +38,14 @@ edges
4038
| UnsafeDeserialization.rb:115:5:115:13 | yaml_data | UnsafeDeserialization.rb:116:25:116:33 | yaml_data | provenance | |
4139
| UnsafeDeserialization.rb:115:17:115:22 | call to params | UnsafeDeserialization.rb:115:17:115:28 | ...[...] | provenance | |
4240
| UnsafeDeserialization.rb:115:17:115:28 | ...[...] | UnsafeDeserialization.rb:115:5:115:13 | yaml_data | provenance | |
43-
| YAMLUnsafeDeserialization.rb:5:16:5:21 | call to params | YAMLUnsafeDeserialization.rb:5:16:5:35 | ...[...] | provenance | |
44-
| YAMLUnsafeDeserialization.rb:11:23:11:28 | call to params | YAMLUnsafeDeserialization.rb:11:23:11:42 | ...[...] | provenance | |
45-
| YAMLUnsafeDeserialization.rb:12:28:12:33 | call to params | YAMLUnsafeDeserialization.rb:12:28:12:45 | ...[...] | provenance | |
46-
| YAMLUnsafeDeserialization.rb:13:23:13:28 | call to params | YAMLUnsafeDeserialization.rb:13:23:13:42 | ...[...] | provenance | |
47-
| YAMLUnsafeDeserialization.rb:14:39:14:44 | call to params | YAMLUnsafeDeserialization.rb:14:39:14:58 | ...[...] | provenance | |
48-
| YAMLUnsafeDeserialization.rb:14:39:14:58 | ...[...] | YAMLUnsafeDeserialization.rb:15:5:15:24 | call to to_ruby | provenance | |
49-
| YAMLUnsafeDeserialization.rb:16:17:16:22 | call to params | YAMLUnsafeDeserialization.rb:16:17:16:36 | ...[...] | provenance | |
50-
| YAMLUnsafeDeserialization.rb:16:17:16:36 | ...[...] | YAMLUnsafeDeserialization.rb:16:5:16:45 | call to to_ruby | provenance | |
51-
| YAMLUnsafeDeserialization.rb:17:22:17:27 | call to params | YAMLUnsafeDeserialization.rb:17:22:17:39 | ...[...] | provenance | |
52-
| YAMLUnsafeDeserialization.rb:17:22:17:39 | ...[...] | YAMLUnsafeDeserialization.rb:17:5:17:48 | call to to_ruby | provenance | |
41+
| UnsafeDeserialization.rb:122:5:122:13 | yaml_data | UnsafeDeserialization.rb:123:25:123:33 | yaml_data | provenance | |
42+
| UnsafeDeserialization.rb:122:17:122:22 | call to params | UnsafeDeserialization.rb:122:17:122:28 | ...[...] | provenance | |
43+
| UnsafeDeserialization.rb:122:17:122:28 | ...[...] | UnsafeDeserialization.rb:122:5:122:13 | yaml_data | provenance | |
44+
| UnsafeDeserialization.rb:161:5:161:14 | plist_data | UnsafeDeserialization.rb:162:30:162:39 | plist_data | provenance | |
45+
| UnsafeDeserialization.rb:161:5:161:14 | plist_data | UnsafeDeserialization.rb:163:30:163:39 | plist_data | provenance | |
46+
| UnsafeDeserialization.rb:161:18:161:23 | call to params | UnsafeDeserialization.rb:161:18:161:29 | ...[...] | provenance | |
47+
| UnsafeDeserialization.rb:161:18:161:29 | ...[...] | UnsafeDeserialization.rb:161:5:161:14 | plist_data | provenance | |
5348
nodes
54-
| PlistUnsafeDeserialization.rb:5:30:5:35 | call to params | semmle.label | call to params |
55-
| PlistUnsafeDeserialization.rb:5:30:5:49 | ...[...] | semmle.label | ...[...] |
56-
| PlistUnsafeDeserialization.rb:6:30:6:35 | call to params | semmle.label | call to params |
57-
| PlistUnsafeDeserialization.rb:6:30:6:49 | ...[...] | semmle.label | ...[...] |
5849
| UnsafeDeserialization.rb:11:5:11:19 | serialized_data | semmle.label | serialized_data |
5950
| UnsafeDeserialization.rb:11:23:11:50 | call to decode64 | semmle.label | call to decode64 |
6051
| UnsafeDeserialization.rb:11:39:11:44 | call to params | semmle.label | call to params |
@@ -106,32 +97,22 @@ nodes
10697
| UnsafeDeserialization.rb:115:17:115:22 | call to params | semmle.label | call to params |
10798
| UnsafeDeserialization.rb:115:17:115:28 | ...[...] | semmle.label | ...[...] |
10899
| UnsafeDeserialization.rb:116:25:116:33 | yaml_data | semmle.label | yaml_data |
109-
| UnsafeDeserialization.rb:120:24:120:34 | call to read | semmle.label | call to read |
110-
| UnsafeDeserialization.rb:123:24:123:33 | call to gets | semmle.label | call to gets |
111-
| UnsafeDeserialization.rb:126:24:126:32 | call to read | semmle.label | call to read |
112-
| UnsafeDeserialization.rb:129:24:129:27 | call to gets | semmle.label | call to gets |
113-
| UnsafeDeserialization.rb:132:24:132:32 | call to readlines | semmle.label | call to readlines |
114-
| YAMLUnsafeDeserialization.rb:5:16:5:21 | call to params | semmle.label | call to params |
115-
| YAMLUnsafeDeserialization.rb:5:16:5:35 | ...[...] | semmle.label | ...[...] |
116-
| YAMLUnsafeDeserialization.rb:11:23:11:28 | call to params | semmle.label | call to params |
117-
| YAMLUnsafeDeserialization.rb:11:23:11:42 | ...[...] | semmle.label | ...[...] |
118-
| YAMLUnsafeDeserialization.rb:12:28:12:33 | call to params | semmle.label | call to params |
119-
| YAMLUnsafeDeserialization.rb:12:28:12:45 | ...[...] | semmle.label | ...[...] |
120-
| YAMLUnsafeDeserialization.rb:13:23:13:28 | call to params | semmle.label | call to params |
121-
| YAMLUnsafeDeserialization.rb:13:23:13:42 | ...[...] | semmle.label | ...[...] |
122-
| YAMLUnsafeDeserialization.rb:14:39:14:44 | call to params | semmle.label | call to params |
123-
| YAMLUnsafeDeserialization.rb:14:39:14:58 | ...[...] | semmle.label | ...[...] |
124-
| YAMLUnsafeDeserialization.rb:15:5:15:24 | call to to_ruby | semmle.label | call to to_ruby |
125-
| YAMLUnsafeDeserialization.rb:16:5:16:45 | call to to_ruby | semmle.label | call to to_ruby |
126-
| YAMLUnsafeDeserialization.rb:16:17:16:22 | call to params | semmle.label | call to params |
127-
| YAMLUnsafeDeserialization.rb:16:17:16:36 | ...[...] | semmle.label | ...[...] |
128-
| YAMLUnsafeDeserialization.rb:17:5:17:48 | call to to_ruby | semmle.label | call to to_ruby |
129-
| YAMLUnsafeDeserialization.rb:17:22:17:27 | call to params | semmle.label | call to params |
130-
| YAMLUnsafeDeserialization.rb:17:22:17:39 | ...[...] | semmle.label | ...[...] |
100+
| UnsafeDeserialization.rb:122:5:122:13 | yaml_data | semmle.label | yaml_data |
101+
| UnsafeDeserialization.rb:122:17:122:22 | call to params | semmle.label | call to params |
102+
| UnsafeDeserialization.rb:122:17:122:28 | ...[...] | semmle.label | ...[...] |
103+
| UnsafeDeserialization.rb:123:25:123:33 | yaml_data | semmle.label | yaml_data |
104+
| UnsafeDeserialization.rb:161:5:161:14 | plist_data | semmle.label | plist_data |
105+
| UnsafeDeserialization.rb:161:18:161:23 | call to params | semmle.label | call to params |
106+
| UnsafeDeserialization.rb:161:18:161:29 | ...[...] | semmle.label | ...[...] |
107+
| UnsafeDeserialization.rb:162:30:162:39 | plist_data | semmle.label | plist_data |
108+
| UnsafeDeserialization.rb:163:30:163:39 | plist_data | semmle.label | plist_data |
109+
| UnsafeDeserialization.rb:173:24:173:34 | call to read | semmle.label | call to read |
110+
| UnsafeDeserialization.rb:176:24:176:33 | call to gets | semmle.label | call to gets |
111+
| UnsafeDeserialization.rb:179:24:179:32 | call to read | semmle.label | call to read |
112+
| UnsafeDeserialization.rb:182:24:182:27 | call to gets | semmle.label | call to gets |
113+
| UnsafeDeserialization.rb:185:24:185:32 | call to readlines | semmle.label | call to readlines |
131114
subpaths
132115
#select
133-
| PlistUnsafeDeserialization.rb:5:30:5:49 | ...[...] | PlistUnsafeDeserialization.rb:5:30:5:35 | call to params | PlistUnsafeDeserialization.rb:5:30:5:49 | ...[...] | Unsafe deserialization depends on a $@. | PlistUnsafeDeserialization.rb:5:30:5:35 | call to params | user-provided value |
134-
| PlistUnsafeDeserialization.rb:6:30:6:49 | ...[...] | PlistUnsafeDeserialization.rb:6:30:6:35 | call to params | PlistUnsafeDeserialization.rb:6:30:6:49 | ...[...] | Unsafe deserialization depends on a $@. | PlistUnsafeDeserialization.rb:6:30:6:35 | call to params | user-provided value |
135116
| UnsafeDeserialization.rb:12:27:12:41 | serialized_data | UnsafeDeserialization.rb:11:39:11:44 | call to params | UnsafeDeserialization.rb:12:27:12:41 | serialized_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:11:39:11:44 | call to params | user-provided value |
136117
| UnsafeDeserialization.rb:18:30:18:44 | serialized_data | UnsafeDeserialization.rb:17:39:17:44 | call to params | UnsafeDeserialization.rb:18:30:18:44 | serialized_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:17:39:17:44 | call to params | user-provided value |
137118
| UnsafeDeserialization.rb:24:24:24:32 | json_data | UnsafeDeserialization.rb:23:17:23:22 | call to params | UnsafeDeserialization.rb:24:24:24:32 | json_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:23:17:23:22 | call to params | user-provided value |
@@ -145,15 +126,11 @@ subpaths
145126
| UnsafeDeserialization.rb:94:22:94:29 | xml_data | UnsafeDeserialization.rb:93:16:93:21 | call to params | UnsafeDeserialization.rb:94:22:94:29 | xml_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:93:16:93:21 | call to params | user-provided value |
146127
| UnsafeDeserialization.rb:110:34:110:36 | xml | UnsafeDeserialization.rb:109:11:109:16 | call to params | UnsafeDeserialization.rb:110:34:110:36 | xml | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:109:11:109:16 | call to params | user-provided value |
147128
| UnsafeDeserialization.rb:116:25:116:33 | yaml_data | UnsafeDeserialization.rb:115:17:115:22 | call to params | UnsafeDeserialization.rb:116:25:116:33 | yaml_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:115:17:115:22 | call to params | user-provided value |
148-
| UnsafeDeserialization.rb:120:24:120:34 | call to read | UnsafeDeserialization.rb:120:24:120:34 | call to read | UnsafeDeserialization.rb:120:24:120:34 | call to read | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:120:24:120:34 | call to read | value from stdin |
149-
| UnsafeDeserialization.rb:123:24:123:33 | call to gets | UnsafeDeserialization.rb:123:24:123:33 | call to gets | UnsafeDeserialization.rb:123:24:123:33 | call to gets | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:123:24:123:33 | call to gets | value from stdin |
150-
| UnsafeDeserialization.rb:126:24:126:32 | call to read | UnsafeDeserialization.rb:126:24:126:32 | call to read | UnsafeDeserialization.rb:126:24:126:32 | call to read | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:126:24:126:32 | call to read | value from stdin |
151-
| UnsafeDeserialization.rb:129:24:129:27 | call to gets | UnsafeDeserialization.rb:129:24:129:27 | call to gets | UnsafeDeserialization.rb:129:24:129:27 | call to gets | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:129:24:129:27 | call to gets | value from stdin |
152-
| UnsafeDeserialization.rb:132:24:132:32 | call to readlines | UnsafeDeserialization.rb:132:24:132:32 | call to readlines | UnsafeDeserialization.rb:132:24:132:32 | call to readlines | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:132:24:132:32 | call to readlines | value from stdin |
153-
| YAMLUnsafeDeserialization.rb:5:16:5:35 | ...[...] | YAMLUnsafeDeserialization.rb:5:16:5:21 | call to params | YAMLUnsafeDeserialization.rb:5:16:5:35 | ...[...] | Unsafe deserialization depends on a $@. | YAMLUnsafeDeserialization.rb:5:16:5:21 | call to params | user-provided value |
154-
| YAMLUnsafeDeserialization.rb:11:23:11:42 | ...[...] | YAMLUnsafeDeserialization.rb:11:23:11:28 | call to params | YAMLUnsafeDeserialization.rb:11:23:11:42 | ...[...] | Unsafe deserialization depends on a $@. | YAMLUnsafeDeserialization.rb:11:23:11:28 | call to params | user-provided value |
155-
| YAMLUnsafeDeserialization.rb:12:28:12:45 | ...[...] | YAMLUnsafeDeserialization.rb:12:28:12:33 | call to params | YAMLUnsafeDeserialization.rb:12:28:12:45 | ...[...] | Unsafe deserialization depends on a $@. | YAMLUnsafeDeserialization.rb:12:28:12:33 | call to params | user-provided value |
156-
| YAMLUnsafeDeserialization.rb:13:23:13:42 | ...[...] | YAMLUnsafeDeserialization.rb:13:23:13:28 | call to params | YAMLUnsafeDeserialization.rb:13:23:13:42 | ...[...] | Unsafe deserialization depends on a $@. | YAMLUnsafeDeserialization.rb:13:23:13:28 | call to params | user-provided value |
157-
| YAMLUnsafeDeserialization.rb:15:5:15:24 | call to to_ruby | YAMLUnsafeDeserialization.rb:14:39:14:44 | call to params | YAMLUnsafeDeserialization.rb:15:5:15:24 | call to to_ruby | Unsafe deserialization depends on a $@. | YAMLUnsafeDeserialization.rb:14:39:14:44 | call to params | user-provided value |
158-
| YAMLUnsafeDeserialization.rb:16:5:16:45 | call to to_ruby | YAMLUnsafeDeserialization.rb:16:17:16:22 | call to params | YAMLUnsafeDeserialization.rb:16:5:16:45 | call to to_ruby | Unsafe deserialization depends on a $@. | YAMLUnsafeDeserialization.rb:16:17:16:22 | call to params | user-provided value |
159-
| YAMLUnsafeDeserialization.rb:17:5:17:48 | call to to_ruby | YAMLUnsafeDeserialization.rb:17:22:17:27 | call to params | YAMLUnsafeDeserialization.rb:17:5:17:48 | call to to_ruby | Unsafe deserialization depends on a $@. | YAMLUnsafeDeserialization.rb:17:22:17:27 | call to params | user-provided value |
129+
| UnsafeDeserialization.rb:123:25:123:33 | yaml_data | UnsafeDeserialization.rb:122:17:122:22 | call to params | UnsafeDeserialization.rb:123:25:123:33 | yaml_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:122:17:122:22 | call to params | user-provided value |
130+
| UnsafeDeserialization.rb:162:30:162:39 | plist_data | UnsafeDeserialization.rb:161:18:161:23 | call to params | UnsafeDeserialization.rb:162:30:162:39 | plist_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:161:18:161:23 | call to params | user-provided value |
131+
| UnsafeDeserialization.rb:163:30:163:39 | plist_data | UnsafeDeserialization.rb:161:18:161:23 | call to params | UnsafeDeserialization.rb:163:30:163:39 | plist_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:161:18:161:23 | call to params | user-provided value |
132+
| UnsafeDeserialization.rb:173:24:173:34 | call to read | UnsafeDeserialization.rb:173:24:173:34 | call to read | UnsafeDeserialization.rb:173:24:173:34 | call to read | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:173:24:173:34 | call to read | value from stdin |
133+
| UnsafeDeserialization.rb:176:24:176:33 | call to gets | UnsafeDeserialization.rb:176:24:176:33 | call to gets | UnsafeDeserialization.rb:176:24:176:33 | call to gets | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:176:24:176:33 | call to gets | value from stdin |
134+
| UnsafeDeserialization.rb:179:24:179:32 | call to read | UnsafeDeserialization.rb:179:24:179:32 | call to read | UnsafeDeserialization.rb:179:24:179:32 | call to read | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:179:24:179:32 | call to read | value from stdin |
135+
| UnsafeDeserialization.rb:182:24:182:27 | call to gets | UnsafeDeserialization.rb:182:24:182:27 | call to gets | UnsafeDeserialization.rb:182:24:182:27 | call to gets | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:182:24:182:27 | call to gets | value from stdin |
136+
| UnsafeDeserialization.rb:185:24:185:32 | call to readlines | UnsafeDeserialization.rb:185:24:185:32 | call to readlines | UnsafeDeserialization.rb:185:24:185:32 | call to readlines | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:185:24:185:32 | call to readlines | value from stdin |

‎ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.rb

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,10 +110,63 @@ def route14
110110
hash = Hash.from_trusted_xml(xml)
111111
end
112112

113-
# BAD
113+
# BAD before psych version 4.0.0
114114
def route15
115115
yaml_data = params[:key]
116116
object = Psych.load yaml_data
117+
object = Psych.load_file yaml_data
118+
end
119+
120+
# GOOD In psych version 4.0.0 and above
121+
def route16
122+
yaml_data = params[:key]
123+
object = Psych.load yaml_data
124+
object = Psych.load_file yaml_data2
125+
end
126+
127+
# GOOD
128+
def route17
129+
yaml_data = params[:key]
130+
object = Psych.parse_stream(yaml_data)
131+
object = Psych.parse(yaml_data)
132+
object = Psych.parse_file(yaml_data)
133+
end
134+
135+
# BAD
136+
def route18
137+
yaml_data = params[:key]
138+
object = Psych.unsafe_load(plist_data)
139+
object = Psych.unsafe_load_file(plist_data)
140+
object = Psych.load_stream(plist_data)
141+
parse_output = Psych.parse_stream(plist_data)
142+
object = parse_output.to_ruby
143+
object = Psych.parse(plist_data).to_ruby
144+
object = Psych.parse_file(plist_data).to_ruby
145+
parsed_yaml = Psych.parse_stream(plist_data)
146+
parsed_yaml.children.each do |child|
147+
object = child.to_ruby
148+
end
149+
Psych.parse_stream(plist_data) do |document|
150+
object = document.to_ruby
151+
end
152+
object = parsed_yaml.children.first.to_ruby
153+
content = parsed_yaml.children[0].children[0].children
154+
object = parsed_yaml.to_ruby[0]
155+
object = content.to_ruby[0]
156+
object = Psych.parse(plist_data).children[0].to_ruby
157+
end
158+
159+
# BAD
160+
def route19
161+
plist_data = params[:key]
162+
result = Plist.parse_xml(plist_data)
163+
result = Plist.parse_xml(plist_data, marshal: true)
164+
end
165+
166+
# GOOD
167+
def route20
168+
plist_data = params[:key]
169+
result = Plist.parse_xml(plist_data, marshal: false)
117170
end
118171

119172
def stdin

‎ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/YAMLUnsafeDeserialization.rb

Lines changed: 0 additions & 38 deletions
This file was deleted.

0 commit comments

Comments
 (0)