Skip to content

Commit 5c32c8b

Browse files
authored
Merge pull request #10560 from alexrford/ruby/yaml-load_file
Ruby: treat `Psych` and `YAML` as aliases for rb/unsafe-deserialization
2 parents 17e6b2a + 4ed4d31 commit 5c32c8b

File tree

3 files changed

+16
-3
lines changed

3 files changed

+16
-3
lines changed

ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,13 @@ module UnsafeDeserialization {
4848
}
4949

5050
/**
51-
* An argument in a call to `YAML.load`, considered a sink for unsafe
52-
* deserialization.
51+
* An argument in a call to `YAML.load`, considered a sink
52+
* for unsafe deserialization. The `YAML` module is an alias of `Psych` in
53+
* recent versions of Ruby.
5354
*/
5455
class YamlLoadArgument extends Sink {
5556
YamlLoadArgument() {
56-
this = API::getTopLevelMember("YAML").getAMethodCall("load").getArgument(0)
57+
this = API::getTopLevelMember(["YAML", "Psych"]).getAMethodCall("load").getArgument(0)
5758
}
5859
}
5960

ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ edges
1616
| UnsafeDeserialization.rb:58:17:58:28 | ...[...] : | UnsafeDeserialization.rb:68:23:68:31 | json_data |
1717
| UnsafeDeserialization.rb:80:11:80:16 | call to params : | UnsafeDeserialization.rb:80:11:80:22 | ...[...] : |
1818
| UnsafeDeserialization.rb:80:11:80:22 | ...[...] : | UnsafeDeserialization.rb:81:34:81:36 | xml |
19+
| UnsafeDeserialization.rb:86:17:86:22 | call to params : | UnsafeDeserialization.rb:86:17:86:28 | ...[...] : |
20+
| UnsafeDeserialization.rb:86:17:86:28 | ...[...] : | UnsafeDeserialization.rb:87:25:87:33 | yaml_data |
1921
nodes
2022
| UnsafeDeserialization.rb:9:39:9:44 | call to params : | semmle.label | call to params : |
2123
| UnsafeDeserialization.rb:9:39:9:50 | ...[...] : | semmle.label | ...[...] : |
@@ -42,6 +44,9 @@ nodes
4244
| UnsafeDeserialization.rb:80:11:80:16 | call to params : | semmle.label | call to params : |
4345
| UnsafeDeserialization.rb:80:11:80:22 | ...[...] : | semmle.label | ...[...] : |
4446
| UnsafeDeserialization.rb:81:34:81:36 | xml | semmle.label | xml |
47+
| UnsafeDeserialization.rb:86:17:86:22 | call to params : | semmle.label | call to params : |
48+
| UnsafeDeserialization.rb:86:17:86:28 | ...[...] : | semmle.label | ...[...] : |
49+
| UnsafeDeserialization.rb:87:25:87:33 | yaml_data | semmle.label | yaml_data |
4550
subpaths
4651
#select
4752
| UnsafeDeserialization.rb:10:27:10:41 | serialized_data | UnsafeDeserialization.rb:9:39:9:44 | call to params : | UnsafeDeserialization.rb:10:27:10:41 | serialized_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:9:39:9:44 | call to params | user-provided value |
@@ -53,3 +58,4 @@ subpaths
5358
| UnsafeDeserialization.rb:53:22:53:30 | json_data | UnsafeDeserialization.rb:51:17:51:22 | call to params : | UnsafeDeserialization.rb:53:22:53:30 | json_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:51:17:51:22 | call to params | user-provided value |
5459
| UnsafeDeserialization.rb:68:23:68:31 | json_data | UnsafeDeserialization.rb:58:17:58:22 | call to params : | UnsafeDeserialization.rb:68:23:68:31 | json_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:58:17:58:22 | call to params | user-provided value |
5560
| UnsafeDeserialization.rb:81:34:81:36 | xml | UnsafeDeserialization.rb:80:11:80:16 | call to params : | UnsafeDeserialization.rb:81:34:81:36 | xml | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:80:11:80:16 | call to params | user-provided value |
61+
| UnsafeDeserialization.rb:87:25:87:33 | yaml_data | UnsafeDeserialization.rb:86:17:86:22 | call to params : | UnsafeDeserialization.rb:87:25:87:33 | yaml_data | Unsafe deserialization depends on a $@. | UnsafeDeserialization.rb:86:17:86:22 | call to params | user-provided value |

ruby/ql/test/query-tests/security/cwe-502/unsafe-deserialization/UnsafeDeserialization.rb

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,4 +80,10 @@ def route10
8080
xml = params[:key]
8181
hash = Hash.from_trusted_xml(xml)
8282
end
83+
84+
# BAD
85+
def route11
86+
yaml_data = params[:key]
87+
object = Psych.load yaml_data
88+
end
8389
end

0 commit comments

Comments
 (0)