Skip to content

Commit 91a7e94

Browse files
hmachmac
committed
Share HttpToFileAccessQuery between JS and Ruby
There's so little in this query that it may not be worth sharing, but it's an interesting exercise in figuring out how we do it nicely.
1 parent 130d93d commit 91a7e94

File tree

8 files changed

+55
-44
lines changed

8 files changed

+55
-44
lines changed

‎config/identical-files.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -533,5 +533,13 @@
533533
"TaintedFormatStringCustomizations Ruby/JS": [
534534
"javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringCustomizations.qll",
535535
"ruby/ql/lib/codeql/ruby/security/TaintedFormatStringCustomizations.qll"
536+
],
537+
"HttpToFileAccessQuery JS/Ruby": [
538+
"javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessQuery.qll",
539+
"ruby/ql/lib/codeql/ruby/security/HttpToFileAccessQuery.qll"
540+
],
541+
"HttpToFileAccessCustomizations JS/Ruby": [
542+
"javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessCustomizations.qll",
543+
"ruby/ql/lib/codeql/ruby/security/HttpToFileAccessCustomizations.qll"
536544
]
537545
}

‎javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessCustomizations.qll

Lines changed: 2 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,9 @@
33
* writing user-controlled data to files, as well as extension points
44
* for adding your own.
55
*/
6-
7-
import javascript
8-
import semmle.javascript.security.dataflow.RemoteFlowSources
9-
106
module HttpToFileAccess {
7+
import HttpToFileAccessSpecific
8+
119
/**
1210
* A data flow source for writing user-controlled data to files.
1311
*/
@@ -23,18 +21,6 @@ module HttpToFileAccess {
2321
*/
2422
abstract class Sanitizer extends DataFlow::Node { }
2523

26-
/**
27-
* An access to a user-controlled HTTP request input, considered as a flow source for writing user-controlled data to files
28-
*/
29-
private class RequestInputAccessAsSource extends Source {
30-
RequestInputAccessAsSource() { this instanceof HTTP::RequestInputAccess }
31-
}
32-
33-
/** A response from a server, considered as a flow source for writing user-controlled data to files. */
34-
private class ServerResponseAsSource extends Source {
35-
ServerResponseAsSource() { this = any(ClientRequest r).getAResponseDataNode() }
36-
}
37-
3824
/** A sink that represents file access method (write, append) argument */
3925
class FileAccessAsSink extends Sink {
4026
FileAccessAsSink() { exists(FileSystemWriteAccess src | this = src.getADataNode()) }

‎javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessQuery.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@
66
* `HttpToFileAccessCustomizations` should be imported instead.
77
*/
88

9-
import javascript
10-
import HttpToFileAccessCustomizations::HttpToFileAccess
9+
private import HttpToFileAccessCustomizations::HttpToFileAccess
1110

1211
/**
1312
* A taint tracking configuration for writing user-controlled data to files.

‎javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessSpecific.qll

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Provides imports and classes needed for `HttpToFileAccessQuery` and `HttpToFileAccessCustomizations`.
3+
*/
4+
5+
import javascript
6+
import semmle.javascript.security.dataflow.RemoteFlowSources
7+
private import HttpToFileAccessCustomizations::HttpToFileAccess
8+
9+
/**
10+
* An access to a user-controlled HTTP request input, considered as a flow source for writing user-controlled data to files
11+
*/
12+
private class RequestInputAccessAsSource extends Source {
13+
RequestInputAccessAsSource() { this instanceof HTTP::RequestInputAccess }
14+
}
15+
16+
/** A response from a server, considered as a flow source for writing user-controlled data to files. */
17+
private class ServerResponseAsSource extends Source {
18+
ServerResponseAsSource() { this = any(ClientRequest r).getAResponseDataNode() }
19+
}

‎ruby/ql/lib/codeql/ruby/security/HttpToFileAccessCustomizations.qll

Lines changed: 2 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,11 @@
1-
/**
2-
* Provides default sources, sinks and sanitizers for reasoning about
3-
* writing user-controlled data to files, as well as extension points
4-
* for adding your own.
5-
*/
6-
7-
import ruby
8-
import codeql.ruby.DataFlow
9-
import codeql.ruby.dataflow.RemoteFlowSources
10-
import codeql.ruby.Concepts
11-
121
/**
132
* Provides default sources, sinks and sanitizers for reasoning about
143
* writing user-controlled data to files, as well as extension points
154
* for adding your own.
165
*/
176
module HttpToFileAccess {
7+
import HttpToFileAccessSpecific
8+
189
/**
1910
* A data flow source for writing user-controlled data to files.
2011
*/
@@ -30,17 +21,6 @@ module HttpToFileAccess {
3021
*/
3122
abstract class Sanitizer extends DataFlow::Node { }
3223

33-
/**
34-
* An access to a user-controlled HTTP request input, considered as a flow source for writing user-controlled data to files
35-
*/
36-
private class RequestInputAccessAsSource extends Source instanceof HTTP::Server::RequestInputAccess {
37-
}
38-
39-
/** A response from an outgoing HTTP request, considered as a flow source for writing user-controlled data to files. */
40-
private class HttpResponseAsSource extends Source {
41-
HttpResponseAsSource() { this = any(HTTP::Client::Request r).getResponseBody() }
42-
}
43-
4424
/** A sink that represents file access method (write, append) argument */
4525
class FileAccessAsSink extends Sink {
4626
FileAccessAsSink() { exists(FileSystemWriteAccess src | this = src.getADataNode()) }

‎ruby/ql/lib/codeql/ruby/security/HttpToFileAccessQuery.qll

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,7 @@
66
* `HttpToFileAccessCustomizations` should be imported instead.
77
*/
88

9-
import ruby
10-
import codeql.ruby.TaintTracking
11-
import codeql.ruby.DataFlow
12-
import codeql.ruby.security.HttpToFileAccessCustomizations::HttpToFileAccess
9+
private import HttpToFileAccessCustomizations::HttpToFileAccess
1310

1411
/**
1512
* A taint tracking configuration for writing user-controlled data to files.

‎ruby/ql/lib/codeql/ruby/security/HttpToFileAccessSpecific.qll

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/**
2+
* Provides imports and classes needed for `HttpToFileAccessQuery` and `HttpToFileAccessCustomizations`.
3+
*/
4+
5+
import ruby
6+
import codeql.ruby.DataFlow
7+
import codeql.ruby.dataflow.RemoteFlowSources
8+
import codeql.ruby.Concepts
9+
import codeql.ruby.TaintTracking
10+
private import HttpToFileAccessCustomizations::HttpToFileAccess
11+
12+
/**
13+
* An access to a user-controlled HTTP request input, considered as a flow source for writing user-controlled data to files
14+
*/
15+
private class RequestInputAccessAsSource extends Source instanceof HTTP::Server::RequestInputAccess {
16+
}
17+
18+
/** A response from an outgoing HTTP request, considered as a flow source for writing user-controlled data to files. */
19+
private class HttpResponseAsSource extends Source {
20+
HttpResponseAsSource() { this = any(HTTP::Client::Request r).getResponseBody() }
21+
}

‎ruby/ql/src/queries/security/cwe-912/HttpToFileAccess.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
*/
1313

1414
import ruby
15+
import codeql.ruby.DataFlow
1516
import codeql.ruby.DataFlow::DataFlow::PathGraph
1617
import codeql.ruby.security.HttpToFileAccessQuery
1718

0 commit comments

Comments
 (0)