Skip to content

Commit 44c4b9b

Browse files
alexrfordalexrford
committed
Ruby: add rb/log-injection test cases
1 parent 00e290e commit 44c4b9b

File tree

3 files changed

+82
-0
lines changed

3 files changed

+82
-0
lines changed

‎ruby/ql/test/query-tests/security/cwe-117/LogInjection.expected

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
edges
2+
| app/controllers/users_controller.rb:15:19:15:24 | call to params : | app/controllers/users_controller.rb:15:19:15:30 | ...[...] : |
3+
| app/controllers/users_controller.rb:15:19:15:30 | ...[...] : | app/controllers/users_controller.rb:16:19:16:29 | unsanitized |
4+
| app/controllers/users_controller.rb:15:19:15:30 | ...[...] : | app/controllers/users_controller.rb:17:19:17:41 | ... + ... |
5+
| app/controllers/users_controller.rb:15:19:15:30 | ...[...] : | app/controllers/users_controller.rb:23:20:23:30 | unsanitized : |
6+
| app/controllers/users_controller.rb:23:5:23:44 | ... = ... : | app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 |
7+
| app/controllers/users_controller.rb:23:20:23:30 | unsanitized : | app/controllers/users_controller.rb:23:20:23:44 | call to sub : |
8+
| app/controllers/users_controller.rb:23:20:23:44 | call to sub : | app/controllers/users_controller.rb:23:5:23:44 | ... = ... : |
9+
| app/controllers/users_controller.rb:23:20:23:44 | call to sub : | app/controllers/users_controller.rb:27:16:27:39 | ... + ... |
10+
| app/controllers/users_controller.rb:33:5:33:31 | ... = ... : | app/controllers/users_controller.rb:34:33:34:43 | unsanitized |
11+
| app/controllers/users_controller.rb:33:5:33:31 | ... = ... : | app/controllers/users_controller.rb:35:33:35:55 | ... + ... |
12+
| app/controllers/users_controller.rb:33:19:33:25 | call to cookies : | app/controllers/users_controller.rb:33:19:33:31 | ...[...] : |
13+
| app/controllers/users_controller.rb:33:19:33:31 | ...[...] : | app/controllers/users_controller.rb:33:5:33:31 | ... = ... : |
14+
nodes
15+
| app/controllers/users_controller.rb:15:19:15:24 | call to params : | semmle.label | call to params : |
16+
| app/controllers/users_controller.rb:15:19:15:30 | ...[...] : | semmle.label | ...[...] : |
17+
| app/controllers/users_controller.rb:16:19:16:29 | unsanitized | semmle.label | unsanitized |
18+
| app/controllers/users_controller.rb:17:19:17:41 | ... + ... | semmle.label | ... + ... |
19+
| app/controllers/users_controller.rb:23:5:23:44 | ... = ... : | semmle.label | ... = ... : |
20+
| app/controllers/users_controller.rb:23:20:23:30 | unsanitized : | semmle.label | unsanitized : |
21+
| app/controllers/users_controller.rb:23:20:23:44 | call to sub : | semmle.label | call to sub : |
22+
| app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 | semmle.label | unsanitized2 |
23+
| app/controllers/users_controller.rb:27:16:27:39 | ... + ... | semmle.label | ... + ... |
24+
| app/controllers/users_controller.rb:33:5:33:31 | ... = ... : | semmle.label | ... = ... : |
25+
| app/controllers/users_controller.rb:33:19:33:25 | call to cookies : | semmle.label | call to cookies : |
26+
| app/controllers/users_controller.rb:33:19:33:31 | ...[...] : | semmle.label | ...[...] : |
27+
| app/controllers/users_controller.rb:34:33:34:43 | unsanitized | semmle.label | unsanitized |
28+
| app/controllers/users_controller.rb:35:33:35:55 | ... + ... | semmle.label | ... + ... |
29+
subpaths
30+
#select
31+
| app/controllers/users_controller.rb:16:19:16:29 | unsanitized | app/controllers/users_controller.rb:15:19:15:24 | call to params : | app/controllers/users_controller.rb:16:19:16:29 | unsanitized | $@ flows to log entry. | app/controllers/users_controller.rb:15:19:15:24 | call to params | User-provided value |
32+
| app/controllers/users_controller.rb:17:19:17:41 | ... + ... | app/controllers/users_controller.rb:15:19:15:24 | call to params : | app/controllers/users_controller.rb:17:19:17:41 | ... + ... | $@ flows to log entry. | app/controllers/users_controller.rb:15:19:15:24 | call to params | User-provided value |
33+
| app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 | app/controllers/users_controller.rb:15:19:15:24 | call to params : | app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 | $@ flows to log entry. | app/controllers/users_controller.rb:15:19:15:24 | call to params | User-provided value |
34+
| app/controllers/users_controller.rb:27:16:27:39 | ... + ... | app/controllers/users_controller.rb:15:19:15:24 | call to params : | app/controllers/users_controller.rb:27:16:27:39 | ... + ... | $@ flows to log entry. | app/controllers/users_controller.rb:15:19:15:24 | call to params | User-provided value |
35+
| app/controllers/users_controller.rb:34:33:34:43 | unsanitized | app/controllers/users_controller.rb:33:19:33:25 | call to cookies : | app/controllers/users_controller.rb:34:33:34:43 | unsanitized | $@ flows to log entry. | app/controllers/users_controller.rb:33:19:33:25 | call to cookies | User-provided value |
36+
| app/controllers/users_controller.rb:35:33:35:55 | ... + ... | app/controllers/users_controller.rb:33:19:33:25 | call to cookies : | app/controllers/users_controller.rb:35:33:35:55 | ... + ... | $@ flows to log entry. | app/controllers/users_controller.rb:33:19:33:25 | call to cookies | User-provided value |

‎ruby/ql/test/query-tests/security/cwe-117/LogInjection.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
queries/security/cwe-117/LogInjection.ql

‎ruby/ql/test/query-tests/security/cwe-117/app/controllers/users_controller.rb

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
require 'logger'
2+
3+
class UsersController < ApplicationController
4+
include ERB::Util
5+
6+
def init_logger
7+
if @logger == nil
8+
@logger = Logger.new STDOUT
9+
end
10+
end
11+
12+
def read_from_params
13+
init_logger
14+
15+
unsanitized = params[:foo]
16+
@logger.debug unsanitized # BAD: unsanitized user input
17+
@logger.error "input: " + unsanitized # BAD: unsanitized user input
18+
19+
sanitized = unsanitized.gsub("\n", "")
20+
@logger.fatal sanitized # GOOD: sanitized user input
21+
@logger.warn "input: " + sanitized # GOOD: sanitized user input
22+
23+
unsanitized2 = unsanitized.sub("\n", "")
24+
@logger.info do
25+
unsanitized2 # BAD: partially sanitized user input
26+
end
27+
@logger << "input: " + unsanitized2 # BAD: partially sanitized user input
28+
end
29+
30+
def read_from_cookies
31+
init_logger
32+
33+
unsanitized = cookies[:bar]
34+
@logger.add(Logger::INFO) { unsanitized } # BAD: unsanitized user input
35+
@logger.log(Logger::WARN) { "input: " + unsanitized } # BAD: unsanitized user input
36+
end
37+
38+
def html_sanitization
39+
init_logger
40+
41+
sanitized = html_escape params[:baz]
42+
@logger.debug unsanitized # GOOD: sanitized user input
43+
@logger.debug "input: " + unsanitized # GOOD: sanitized user input
44+
end
45+
end

0 commit comments

Comments
 (0)