Ruby: configsig rb/clear-text-logging-sensitive-data

alexrford · alexrford · commit 2a2f21d3a996 · 2023-09-03T17:20:04.000+01:00
diff --git a/ruby/ql/lib/codeql/ruby/security/CleartextLoggingQuery.qll b/ruby/ql/lib/codeql/ruby/security/CleartextLoggingQuery.qll
@@ -2,33 +2,51 @@
  * Provides a taint-tracking configuration for "Clear-text logging of sensitive information".
  *
  * Note, for performance reasons: only import this file if
- * `CleartextLogging::Configuration` is needed, otherwise
+ * `CleartextLoggingFlow` is needed, otherwise
  * `CleartextLoggingCustomizations` should be imported instead.
  */
 
 private import codeql.ruby.AST
 private import codeql.ruby.DataFlow
 private import codeql.ruby.TaintTracking
 import CleartextLoggingCustomizations::CleartextLogging
-private import CleartextLoggingCustomizations::CleartextLogging as CleartextLogging
+private import CleartextLoggingCustomizations::CleartextLogging as CL
 
 /**
  * A taint-tracking configuration for detecting "Clear-text logging of sensitive information".
+ * DEPRECATED: Use `CleartextLoggingFlow` instead
  */
-class Configuration extends TaintTracking::Configuration {
+deprecated class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "CleartextLogging" }
 
-  override predicate isSource(DataFlow::Node source) { source instanceof CleartextLogging::Source }
+  override predicate isSource(DataFlow::Node source) { source instanceof CL::Source }
 
-  override predicate isSink(DataFlow::Node sink) { sink instanceof CleartextLogging::Sink }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof CL::Sink }
 
   override predicate isSanitizer(DataFlow::Node node) {
     super.isSanitizer(node)
     or
-    node instanceof CleartextLogging::Sanitizer
+    node instanceof CL::Sanitizer
   }
 
   override predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-    CleartextLogging::isAdditionalTaintStep(nodeFrom, nodeTo)
+    CL::isAdditionalTaintStep(nodeFrom, nodeTo)
   }
 }
+
+private module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof CL::Source }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof CL::Sink }
+
+  predicate isBarrier(DataFlow::Node node) { node instanceof CL::Sanitizer }
+
+  predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+    CL::isAdditionalTaintStep(nodeFrom, nodeTo)
+  }
+}
+
+/**
+ * Taint-tracking for detecting "Clear-text logging of sensitive information".
+ */
+module CleartextLoggingFlow = TaintTracking::Global<Config>;
diff --git a/ruby/ql/src/queries/security/cwe-312/CleartextLogging.ql b/ruby/ql/src/queries/security/cwe-312/CleartextLogging.ql
@@ -15,10 +15,9 @@
 
 import codeql.ruby.AST
 import codeql.ruby.security.CleartextLoggingQuery
-import codeql.ruby.DataFlow
-import DataFlow::PathGraph
+import CleartextLoggingFlow::PathGraph
 
-from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
-where config.hasFlowPath(source, sink)
+from CleartextLoggingFlow::PathNode source, CleartextLoggingFlow::PathNode sink
+where CleartextLoggingFlow::flowPath(source, sink)
 select sink.getNode(), source, sink, "This logs sensitive data returned by $@ as clear text.",
   source.getNode(), source.getNode().(Source).describe()
