Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2d12ad6

Browse files
hmachmac
committed
Ruby: Model IO.popen
This method is very similar to `Kernel.system`: it executes its arguments as a system command in various ways.
1 parent b8fd07c commit 2d12ad6

5 files changed

Lines changed: 168 additions & 0 deletions

File tree

‎ruby/ql/lib/codeql/ruby/frameworks/Core.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import core.Module
1212
import core.Array
1313
import core.String
1414
import core.Regexp
15+
import core.IO
1516

1617
/**
1718
* A system command executed via subshell literal syntax.

‎ruby/ql/lib/codeql/ruby/frameworks/core/IO.qll‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/**
2+
* Provides modeling for the `IO` module.
3+
*/
4+
5+
private import codeql.ruby.ApiGraphs
6+
private import codeql.ruby.Concepts
7+
private import codeql.ruby.DataFlow
8+
private import codeql.ruby.controlflow.CfgNodes
9+
10+
/** Provides modeling for the `IO` class. */
11+
module IO {
12+
/**
13+
* A system command executed via the `IO.popen` method.
14+
* Signature:
15+
* ```
16+
* popen([env,] cmd, mode="r" [, opt]) -> io
17+
* popen([env,] cmd, mode="r" [, opt]) {|io| block } -> obj
18+
* ```
19+
* `IO.popen` does different things based on the the value of `cmd`:
20+
* ```
21+
* "-" : fork
22+
* commandline : command line string which is passed to a shell
23+
* [env, cmdname, arg1, ..., opts] : command name and zero or more arguments (no shell)
24+
* [env, [cmdname, argv0], arg1, ..., opts] : command name, argv[0] and zero or more arguments (no shell)
25+
* (env and opts are optional.)
26+
* ```
27+
* ```ruby
28+
* IO.popen("cat foo.txt | tail")
29+
* IO.popen({some_env_var: "123"}, "cat foo.txt | tail")
30+
* IO.popen(["cat", "foo.txt"])
31+
* IO.popen([{some_env_var: "123"}, "cat", "foo.txt"])
32+
* IO.popen([["cat", "argv0"], "foo.txt"])
33+
* IO.popen([{some_env_var: "123"}, ["cat", "argv0"], "foo.txt"])
34+
* ```
35+
* Ruby documentation: https://docs.ruby-lang.org/en/3.1.0/IO.html#method-c-popen
36+
*/
37+
class POpenCall extends SystemCommandExecution::Range, DataFlow::CallNode {
38+
POpenCall() { this = API::getTopLevelMember("IO").getAMethodCall("popen") }
39+
40+
override DataFlow::Node getAnArgument() { this.argument(result, _) }
41+
42+
override predicate isShellInterpreted(DataFlow::Node arg) { this.argument(arg, true) }
43+
44+
/**
45+
* A helper predicate that holds if `arg` is an argument to this call. `shell` is true if the argument is passed to a subshell.
46+
*/
47+
private predicate argument(DataFlow::Node arg, boolean shell) {
48+
exists(ExprCfgNode n | n = arg.asExpr() |
49+
// Exclude any hash literal arguments, which are likely to be environment variables or options.
50+
not n instanceof ExprNodes::HashLiteralCfgNode and
51+
not n instanceof ExprNodes::ArrayLiteralCfgNode and
52+
(
53+
// IO.popen({var: "a"}, "cmd", {some: :opt})
54+
arg = this.getArgument([0, 1]) and
55+
// We over-approximate by assuming a subshell if the argument isn't an array or "-".
56+
// This increases the sensitivity of the CommandInjection query at the risk of some FPs.
57+
if n.getConstantValue().getString() = "-" then shell = false else shell = true
58+
or
59+
// IO.popen({var: "a"}, [{var: "b"}, "cmd", "arg1", "arg2", {some: :opt}])
60+
shell = false and
61+
exists(ExprNodes::ArrayLiteralCfgNode arr | this.getArgument([0, 1]).asExpr() = arr |
62+
n = arr.getAnArgument()
63+
or
64+
// IO.popen({var: "a"}, [{var: "b"}, ["cmd", "argv0"], "arg1", "arg2", {some: :opt}])
65+
n = arr.getArgument(0).(ExprNodes::ArrayLiteralCfgNode).getArgument(0)
66+
)
67+
)
68+
)
69+
}
70+
}
71+
}

‎ruby/ql/test/library-tests/frameworks/core/IO.expected‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
ioPOpenCalls
2+
| IO.rb:1:1:1:30 | call to popen |
3+
| IO.rb:2:1:2:53 | call to popen |
4+
| IO.rb:3:1:3:67 | call to popen |
5+
| IO.rb:5:1:5:28 | call to popen |
6+
| IO.rb:6:1:6:51 | call to popen |
7+
| IO.rb:7:1:7:65 | call to popen |
8+
| IO.rb:9:1:9:39 | call to popen |
9+
| IO.rb:10:1:10:62 | call to popen |
10+
| IO.rb:11:1:11:76 | call to popen |
11+
| IO.rb:13:1:13:13 | call to popen |
12+
| IO.rb:14:1:14:36 | call to popen |
13+
| IO.rb:15:1:15:50 | call to popen |
14+
| IO.rb:18:1:18:13 | call to popen |
15+
| IO.rb:19:1:19:36 | call to popen |
16+
| IO.rb:20:1:20:50 | call to popen |
17+
| IO.rb:23:1:23:13 | call to popen |
18+
| IO.rb:24:1:24:36 | call to popen |
19+
| IO.rb:25:1:25:50 | call to popen |
20+
| IO.rb:28:1:28:13 | call to popen |
21+
| IO.rb:29:1:29:36 | call to popen |
22+
| IO.rb:30:1:30:50 | call to popen |
23+
| IO.rb:33:3:33:15 | call to popen |
24+
ioPOpenCallArguments
25+
| IO.rb:1:1:1:30 | call to popen | true | IO.rb:1:10:1:29 | "cat foo.txt \| tail" |
26+
| IO.rb:2:1:2:53 | call to popen | true | IO.rb:2:33:2:52 | "cat foo.txt \| tail" |
27+
| IO.rb:3:1:3:67 | call to popen | true | IO.rb:3:33:3:52 | "cat foo.txt \| tail" |
28+
| IO.rb:5:1:5:28 | call to popen | false | IO.rb:5:11:5:15 | "cat" |
29+
| IO.rb:5:1:5:28 | call to popen | false | IO.rb:5:18:5:26 | "foo.txt" |
30+
| IO.rb:6:1:6:51 | call to popen | false | IO.rb:6:34:6:38 | "cat" |
31+
| IO.rb:6:1:6:51 | call to popen | false | IO.rb:6:41:6:49 | "foo.txt" |
32+
| IO.rb:7:1:7:65 | call to popen | false | IO.rb:7:34:7:38 | "cat" |
33+
| IO.rb:7:1:7:65 | call to popen | false | IO.rb:7:41:7:49 | "foo.txt" |
34+
| IO.rb:9:1:9:39 | call to popen | false | IO.rb:9:12:9:16 | "cat" |
35+
| IO.rb:9:1:9:39 | call to popen | false | IO.rb:9:29:9:37 | "foo.txt" |
36+
| IO.rb:10:1:10:62 | call to popen | false | IO.rb:10:52:10:60 | "foo.txt" |
37+
| IO.rb:11:1:11:76 | call to popen | false | IO.rb:11:52:11:60 | "foo.txt" |
38+
| IO.rb:13:1:13:13 | call to popen | false | IO.rb:13:10:13:12 | "-" |
39+
| IO.rb:14:1:14:36 | call to popen | false | IO.rb:14:33:14:35 | "-" |
40+
| IO.rb:15:1:15:50 | call to popen | false | IO.rb:15:33:15:35 | "-" |
41+
| IO.rb:18:1:18:13 | call to popen | true | IO.rb:18:10:18:12 | cmd |
42+
| IO.rb:19:1:19:36 | call to popen | true | IO.rb:19:33:19:35 | cmd |
43+
| IO.rb:20:1:20:50 | call to popen | true | IO.rb:20:33:20:35 | cmd |
44+
| IO.rb:23:1:23:13 | call to popen | true | IO.rb:23:10:23:12 | cmd |
45+
| IO.rb:24:1:24:36 | call to popen | true | IO.rb:24:33:24:35 | cmd |
46+
| IO.rb:25:1:25:50 | call to popen | true | IO.rb:25:33:25:35 | cmd |
47+
| IO.rb:28:1:28:13 | call to popen | true | IO.rb:28:10:28:12 | cmd |
48+
| IO.rb:29:1:29:36 | call to popen | true | IO.rb:29:33:29:35 | cmd |
49+
| IO.rb:30:1:30:50 | call to popen | true | IO.rb:30:33:30:35 | cmd |
50+
| IO.rb:33:3:33:15 | call to popen | true | IO.rb:33:12:33:14 | cmd |

‎ruby/ql/test/library-tests/frameworks/core/IO.ql‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
import codeql.ruby.frameworks.core.IO::IO
2+
import codeql.ruby.DataFlow
3+
4+
query predicate ioPOpenCalls(POpenCall c) { any() }
5+
6+
query DataFlow::Node ioPOpenCallArguments(POpenCall c, boolean shellInterpreted) {
7+
result = c.getAnArgument() and
8+
if c.isShellInterpreted(result) then shellInterpreted = true else shellInterpreted = false
9+
}

‎ruby/ql/test/library-tests/frameworks/core/IO.rb‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
IO.popen("cat foo.txt | tail")
2+
IO.popen({some_env_var: "123"}, "cat foo.txt | tail")
3+
IO.popen({some_env_var: "123"}, "cat foo.txt | tail", {some: :opt})
4+
5+
IO.popen(["cat", "foo.txt"])
6+
IO.popen([{some_env_var: "123"}, "cat", "foo.txt"])
7+
IO.popen([{some_env_var: "123"}, "cat", "foo.txt"], {some: :opt})
8+
9+
IO.popen([["cat", "argv0"], "foo.txt"])
10+
IO.popen([{some_env_var: "123"}, ["cat", "argv0"], "foo.txt"])
11+
IO.popen([{some_env_var: "123"}, ["cat", "argv0"], "foo.txt"], {some: :opt})
12+
13+
IO.popen("-")
14+
IO.popen({some_env_var: "123"}, "-")
15+
IO.popen({some_env_var: "123"}, "-", {some: :opt})
16+
17+
cmd = "cat foo.txt | tail"
18+
IO.popen(cmd)
19+
IO.popen({some_env_var: "123"}, cmd)
20+
IO.popen({some_env_var: "123"}, cmd, {some: :opt})
21+
22+
cmd = ["cat", "foo.txt"]
23+
IO.popen(cmd)
24+
IO.popen({some_env_var: "123"}, cmd)
25+
IO.popen({some_env_var: "123"}, cmd, {some: :opt})
26+
27+
cmd = [["cat", "argv0"], "foo.txt"]
28+
IO.popen(cmd)
29+
IO.popen({some_env_var: "123"}, cmd)
30+
IO.popen({some_env_var: "123"}, cmd, {some: :opt})
31+
32+
def popen(cmd)
33+
IO.popen(cmd)
34+
end
35+
36+
popen("cat foo.txt | tail")
37+
popen(["cat", "foo.txt"])

0 commit comments

Comments
 (0)