Skip to content

Commit 7c5a838

Browse files
hmachmac
authored
Merge pull request #8737 from hmac/hmac/posix-spawn
Ruby: Model the posix-spawn gem
2 parents a38e59a + c80a06a commit 7c5a838

File tree

5 files changed

+146
-0
lines changed

5 files changed

+146
-0
lines changed

‎ruby/ql/lib/codeql/ruby/Frameworks.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@ private import codeql.ruby.frameworks.Files
1515
private import codeql.ruby.frameworks.HttpClients
1616
private import codeql.ruby.frameworks.XmlParsing
1717
private import codeql.ruby.frameworks.ActionDispatch
18+
private import codeql.ruby.frameworks.PosixSpawn

‎ruby/ql/lib/codeql/ruby/frameworks/PosixSpawn.qll

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
/**
2+
* Provides modeling for the `posix-spawn` gem.
3+
* Version: 0.3.15
4+
*/
5+
6+
private import codeql.ruby.Concepts
7+
private import codeql.ruby.ApiGraphs
8+
private import codeql.ruby.DataFlow
9+
private import codeql.ruby.controlflow.CfgNodes
10+
11+
/**
12+
* Provides modeling for the `posix-spawn` gem.
13+
* Version: 0.3.15
14+
*/
15+
module PosixSpawn {
16+
private API::Node posixSpawnModule() {
17+
result = API::getTopLevelMember("POSIX").getMember("Spawn")
18+
}
19+
20+
/**
21+
* A call to `POSIX::Spawn::Child.new` or `POSIX::Spawn::Child.build`.
22+
*/
23+
class ChildCall extends SystemCommandExecution::Range, DataFlow::CallNode {
24+
ChildCall() {
25+
this =
26+
[
27+
posixSpawnModule().getMember("Child").getAMethodCall("build"),
28+
posixSpawnModule().getMember("Child").getAnInstantiation()
29+
]
30+
}
31+
32+
override DataFlow::Node getAnArgument() {
33+
result = this.getArgument(_) and not result.asExpr() instanceof ExprNodes::PairCfgNode
34+
}
35+
36+
override predicate isShellInterpreted(DataFlow::Node arg) { none() }
37+
}
38+
39+
/**
40+
* A call to `POSIX::Spawn.spawn` or a related method.
41+
*/
42+
class SystemCall extends SystemCommandExecution::Range, DataFlow::CallNode {
43+
SystemCall() {
44+
this =
45+
posixSpawnModule()
46+
.getAMethodCall(["spawn", "fspawn", "popen4", "pspawn", "system", "_pspawn", "`"])
47+
}
48+
49+
override DataFlow::Node getAnArgument() { this.argument(result) }
50+
51+
// From the docs:
52+
// When only command is given and includes a space character, the command
53+
// text is executed by the system shell interpreter.
54+
// This means the following signatures are shell interpreted:
55+
//
56+
// spawn(cmd)
57+
// spawn(cmd, opts)
58+
// spawn(env, cmd)
59+
// spawn(env, cmd, opts)
60+
//
61+
// env and opts will be hashes. We over-approximate by assuming the argument
62+
// is shell interpreted unless there is another argument with a string
63+
// constant value.
64+
override predicate isShellInterpreted(DataFlow::Node arg) {
65+
not exists(DataFlow::Node otherArg |
66+
otherArg != arg and
67+
this.argument(arg) and
68+
this.argument(otherArg) and
69+
otherArg.asExpr().getConstantValue().isString(_)
70+
)
71+
}
72+
73+
private predicate argument(DataFlow::Node arg) {
74+
arg = this.getArgument(_) and
75+
not arg.asExpr() instanceof ExprNodes::HashLiteralCfgNode and
76+
not arg.asExpr() instanceof ExprNodes::ArrayLiteralCfgNode and
77+
not arg.asExpr() instanceof ExprNodes::PairCfgNode
78+
}
79+
}
80+
}

‎ruby/ql/test/library-tests/frameworks/PosixSpawn.expected

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
systemCalls
2+
| PosixSpawn.rb:1:1:1:32 | call to popen4 | PosixSpawn.rb:1:22:1:25 | "ls" | false |
3+
| PosixSpawn.rb:1:1:1:32 | call to popen4 | PosixSpawn.rb:1:28:1:31 | "-l" | false |
4+
| PosixSpawn.rb:2:1:2:31 | call to popen4 | PosixSpawn.rb:2:21:2:24 | "ls" | false |
5+
| PosixSpawn.rb:2:1:2:31 | call to popen4 | PosixSpawn.rb:2:27:2:30 | "-l" | false |
6+
| PosixSpawn.rb:7:1:7:40 | call to spawn | PosixSpawn.rb:7:20:7:39 | * ... | true |
7+
| PosixSpawn.rb:8:1:8:30 | call to spawn | PosixSpawn.rb:8:21:8:29 | "sleep 5" | true |
8+
| PosixSpawn.rb:9:1:9:23 | call to spawn | PosixSpawn.rb:9:20:9:22 | call to cmd | true |
9+
| PosixSpawn.rb:10:1:10:29 | call to spawn | PosixSpawn.rb:10:20:10:22 | call to env | false |
10+
| PosixSpawn.rb:10:1:10:29 | call to spawn | PosixSpawn.rb:10:25:10:28 | "ls" | true |
11+
| PosixSpawn.rb:15:1:15:60 | call to system | PosixSpawn.rb:15:21:15:25 | "foo" | false |
12+
| PosixSpawn.rb:15:1:15:60 | call to system | PosixSpawn.rb:15:28:15:32 | "bar" | false |
13+
| PosixSpawn.rb:15:1:15:60 | call to system | PosixSpawn.rb:15:35:15:44 | "--a-flag" | false |
14+
| PosixSpawn.rb:15:1:15:60 | call to system | PosixSpawn.rb:15:47:15:52 | call to before | false |
15+
| PosixSpawn.rb:15:1:15:60 | call to system | PosixSpawn.rb:15:55:15:59 | call to after | false |
16+
| PosixSpawn.rb:17:1:17:28 | call to fspawn | PosixSpawn.rb:17:21:17:27 | call to command | true |
17+
| PosixSpawn.rb:18:1:18:28 | call to pspawn | PosixSpawn.rb:18:21:18:27 | call to command | true |
18+
| PosixSpawn.rb:19:1:19:28 | call to popen4 | PosixSpawn.rb:19:21:19:27 | call to command | true |
19+
| PosixSpawn.rb:21:1:21:28 | call to ` | PosixSpawn.rb:21:16:21:20 | "foo" | false |
20+
| PosixSpawn.rb:21:1:21:28 | call to ` | PosixSpawn.rb:21:23:21:27 | "bar" | false |
21+
childCalls
22+
| PosixSpawn.rb:4:1:4:77 | call to new | PosixSpawn.rb:4:25:4:39 | call to [] | false |
23+
| PosixSpawn.rb:4:1:4:77 | call to new | PosixSpawn.rb:4:42:4:51 | ... + ... | false |
24+
| PosixSpawn.rb:4:1:4:77 | call to new | PosixSpawn.rb:4:54:4:58 | * ... | false |
25+
| PosixSpawn.rb:5:1:5:80 | call to new | PosixSpawn.rb:5:25:5:32 | * ... | false |
26+
| PosixSpawn.rb:12:1:12:35 | call to new | PosixSpawn.rb:12:25:12:28 | "ls" | false |
27+
| PosixSpawn.rb:12:1:12:35 | call to new | PosixSpawn.rb:12:31:12:34 | "-l" | false |
28+
| PosixSpawn.rb:13:1:13:38 | call to build | PosixSpawn.rb:13:27:13:32 | "echo" | false |
29+
| PosixSpawn.rb:13:1:13:38 | call to build | PosixSpawn.rb:13:35:13:37 | call to msg | false |

‎ruby/ql/test/library-tests/frameworks/PosixSpawn.ql

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import ruby
2+
import codeql.ruby.frameworks.PosixSpawn
3+
import codeql.ruby.DataFlow
4+
5+
query predicate systemCalls(
6+
PosixSpawn::SystemCall call, DataFlow::Node arg, boolean shellInterpreted
7+
) {
8+
arg = call.getAnArgument() and
9+
if call.isShellInterpreted(arg) then shellInterpreted = true else shellInterpreted = false
10+
}
11+
12+
query predicate childCalls(PosixSpawn::ChildCall call, DataFlow::Node arg, boolean shellInterpreted) {
13+
arg = call.getAnArgument() and
14+
if call.isShellInterpreted(arg) then shellInterpreted = true else shellInterpreted = false
15+
}

‎ruby/ql/test/library-tests/frameworks/PosixSpawn.rb

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
POSIX::Spawn::popen4("ls", "-l")
2+
POSIX::Spawn.popen4("ls", "-l")
3+
4+
POSIX::Spawn::Child.new({'ENV' => @var}, "foo/"+cmd, *argv, :chdir=>root_dir)
5+
POSIX::Spawn::Child.new(*command, input: options[:stdin].to_s, timeout: timeout)
6+
7+
POSIX::Spawn.spawn(*(argv+[{:in => f}]))
8+
POSIX::Spawn::spawn('sleep 5')
9+
POSIX::Spawn.spawn(cmd)
10+
POSIX::Spawn.spawn(env, "ls")
11+
12+
POSIX::Spawn::Child.new("ls", "-l")
13+
POSIX::Spawn::Child.build("echo", msg)
14+
15+
POSIX::Spawn.system("foo", "bar", "--a-flag", before, after)
16+
17+
POSIX::Spawn.fspawn(command)
18+
POSIX::Spawn.pspawn(command)
19+
POSIX::Spawn.popen4(command)
20+
21+
POSIX::Spawn.`("foo", "bar")

0 commit comments

Comments
 (0)