Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 593d9a4

Browse files
alexrfordalexrford
committed
Ruby: configsig rb/reflected-xss
1 parent ad2bbfb commit 593d9a4

3 files changed

Lines changed: 29 additions & 8 deletions

File tree

‎ruby/ql/lib/codeql/ruby/security/ReflectedXSSQuery.qll‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
* Provides a taint-tracking configuration for detecting "reflected server-side cross-site scripting" vulnerabilities.
33
*
44
* Note, for performance reasons: only import this file if
5-
* `ReflectedXSS::Configuration` is needed, otherwise
6-
* `XSS::ReflectedXSS` should be imported instead.
5+
* `ReflectedXssFlow` is needed, otherwise
6+
* `XSS::ReflectedXss` should be imported instead.
77
*/
88

99
private import codeql.ruby.AST
@@ -12,14 +12,16 @@ import codeql.ruby.TaintTracking
1212

1313
/**
1414
* Provides a taint-tracking configuration for detecting "reflected server-side cross-site scripting" vulnerabilities.
15+
* DEPRECATED: Use `ReflectedXssFlow`
1516
*/
16-
module ReflectedXss {
17+
deprecated module ReflectedXss {
1718
import XSS::ReflectedXss
1819

1920
/**
2021
* A taint-tracking configuration for detecting "reflected server-side cross-site scripting" vulnerabilities.
22+
* DEPRECATED: Use `ReflectedXssFlow`
2123
*/
22-
class Configuration extends TaintTracking::Configuration {
24+
deprecated class Configuration extends TaintTracking::Configuration {
2325
Configuration() { this = "ReflectedXSS" }
2426

2527
override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -37,3 +39,22 @@ module ReflectedXss {
3739
}
3840
}
3941
}
42+
43+
private module ReflectedXssConfig implements DataFlow::ConfigSig {
44+
private import XSS::ReflectedXss as RX
45+
46+
predicate isSource(DataFlow::Node source) { source instanceof RX::Source }
47+
48+
predicate isSink(DataFlow::Node sink) { sink instanceof RX::Sink }
49+
50+
predicate isBarrier(DataFlow::Node node) { node instanceof RX::Sanitizer }
51+
52+
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
53+
RX::isAdditionalXssTaintStep(node1, node2)
54+
}
55+
}
56+
57+
/**
58+
* Taint-tracking for detecting "reflected server-side cross-site scripting" vulnerabilities.
59+
*/
60+
module ReflectedXssFlow = TaintTracking::Global<ReflectedXssConfig>;

‎ruby/ql/src/queries/security/cwe-079/ReflectedXSS.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@
1515

1616
import codeql.ruby.AST
1717
import codeql.ruby.security.ReflectedXSSQuery
18-
import DataFlow::PathGraph
18+
import ReflectedXssFlow::PathGraph
1919

20-
from ReflectedXss::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
21-
where config.hasFlowPath(source, sink)
20+
from ReflectedXssFlow::PathNode source, ReflectedXssFlow::PathNode sink
21+
where ReflectedXssFlow::flowPath(source, sink)
2222
select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to a $@.",
2323
source.getNode(), "user-provided value"

‎ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.expected‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ edges
99
| app/controllers/foo/bars_controller.rb:17:21:17:26 | call to params | app/controllers/foo/bars_controller.rb:17:21:17:36 | ...[...] |
1010
| app/controllers/foo/bars_controller.rb:17:21:17:36 | ...[...] | app/views/foo/bars/show.html.erb:2:18:2:30 | @user_website |
1111
| app/controllers/foo/bars_controller.rb:18:5:18:6 | dt | app/controllers/foo/bars_controller.rb:19:22:19:23 | dt |
12-
| app/controllers/foo/bars_controller.rb:18:5:18:6 | dt | app/controllers/foo/bars_controller.rb:26:53:26:54 | dt |
1312
| app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | app/controllers/foo/bars_controller.rb:18:10:18:22 | ...[...] |
1413
| app/controllers/foo/bars_controller.rb:18:10:18:22 | ...[...] | app/controllers/foo/bars_controller.rb:18:5:18:6 | dt |
14+
| app/controllers/foo/bars_controller.rb:19:22:19:23 | dt | app/controllers/foo/bars_controller.rb:26:53:26:54 | dt |
1515
| app/controllers/foo/bars_controller.rb:19:22:19:23 | dt | app/views/foo/bars/show.html.erb:40:3:40:16 | @instance_text |
1616
| app/controllers/foo/bars_controller.rb:24:39:24:44 | call to params | app/controllers/foo/bars_controller.rb:24:39:24:59 | ...[...] |
1717
| app/controllers/foo/bars_controller.rb:24:39:24:59 | ...[...] | app/controllers/foo/bars_controller.rb:24:39:24:59 | ... = ... |

0 commit comments

Comments
 (0)