Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 98c0d73

Browse files
RasmusWLRasmusWL
authored
Merge pull request #8524 from RasmusWL/ruby-update-ssrf-concept
Ruby: Minor change of SSRF concept
2 parents 005a020 + 6718893 commit 98c0d73

12 files changed

Lines changed: 34 additions & 14 deletions

File tree

‎ruby/ql/lib/change-notes/2022-03-09-http-client-getaurlpart.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: breaking
3+
---
4+
* The `getURL` member-predicates of the `HTTP::Client::Request` and `HTTP::Client::Request::Range` classes from `Concepts.qll` have been renamed to `getAUrlPart`.

‎ruby/ql/lib/codeql/ruby/Concepts.qll‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -485,10 +485,18 @@ module HTTP {
485485
DataFlow::Node getResponseBody() { result = super.getResponseBody() }
486486

487487
/**
488+
* DEPRECATED: Use `getAUrlPart` instead.
489+
*
488490
* Gets a node that contributes to the URL of the request.
489491
* Depending on the framework, a request may have multiple nodes which contribute to the URL.
490492
*/
491-
DataFlow::Node getURL() { result = super.getURL() }
493+
deprecated DataFlow::Node getURL() { result = super.getURL() or result = super.getAUrlPart() }
494+
495+
/**
496+
* Gets a data-flow node that contributes to the URL of the request.
497+
* Depending on the framework, a request may have multiple nodes which contribute to the URL.
498+
*/
499+
DataFlow::Node getAUrlPart() { result = super.getAUrlPart() }
492500

493501
/** Gets a string that identifies the framework used for this request. */
494502
string getFramework() { result = super.getFramework() }
@@ -516,10 +524,18 @@ module HTTP {
516524
abstract DataFlow::Node getResponseBody();
517525

518526
/**
527+
* DEPRECATED: overwrite `getAUrlPart` instead.
528+
*
519529
* Gets a node that contributes to the URL of the request.
520530
* Depending on the framework, a request may have multiple nodes which contribute to the URL.
521531
*/
522-
abstract DataFlow::Node getURL();
532+
deprecated DataFlow::Node getURL() { none() }
533+
534+
/**
535+
* Gets a data-flow node that contributes to the URL of the request.
536+
* Depending on the framework, a request may have multiple nodes which contribute to the URL.
537+
*/
538+
abstract DataFlow::Node getAUrlPart();
523539

524540
/** Gets a string that identifies the framework used for this request. */
525541
abstract string getFramework();

‎ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ class ExconHttpRequest extends HTTP::Client::Request::Range {
5252

5353
override DataFlow::Node getResponseBody() { result = requestNode.getAMethodCall("body") }
5454

55-
override DataFlow::Node getURL() {
55+
override DataFlow::Node getAUrlPart() {
5656
// For one-off requests, the URL is in the first argument of the request method call.
5757
// For connection re-use, the URL is split between the first argument of the `new` call
5858
// and the `path` keyword argument of the request method call.

‎ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ class FaradayHttpRequest extends HTTP::Client::Request::Range {
4545

4646
override DataFlow::Node getResponseBody() { result = requestNode.getAMethodCall("body") }
4747

48-
override DataFlow::Node getURL() {
48+
override DataFlow::Node getAUrlPart() {
4949
result = requestUse.getArgument(0) or
5050
result = connectionUse.(DataFlow::CallNode).getArgument(0) or
5151
result = connectionUse.(DataFlow::CallNode).getKeywordArgument("url")

‎ruby/ql/lib/codeql/ruby/frameworks/http_clients/HttpClient.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ class HttpClientRequest extends HTTP::Client::Request::Range {
3636
this = requestUse.asExpr().getExpr()
3737
}
3838

39-
override DataFlow::Node getURL() { result = requestUse.getArgument(0) }
39+
override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
4040

4141
override DataFlow::Node getResponseBody() {
4242
// The `get_content` and `post_content` methods return the response body as

‎ruby/ql/lib/codeql/ruby/frameworks/http_clients/Httparty.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ class HttpartyRequest extends HTTP::Client::Request::Range {
3535
this = requestUse.asExpr().getExpr()
3636
}
3737

38-
override DataFlow::Node getURL() { result = requestUse.getArgument(0) }
38+
override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
3939

4040
override DataFlow::Node getResponseBody() {
4141
// If HTTParty can recognise the response type, it will parse and return it

‎ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ class NetHttpRequest extends HTTP::Client::Request::Range {
5151
* Gets the node representing the URL of the request.
5252
* Currently unused, but may be useful in future, e.g. to filter out certain requests.
5353
*/
54-
override DataFlow::Node getURL() { result = request.getArgument(0) }
54+
override DataFlow::Node getAUrlPart() { result = request.getArgument(0) }
5555

5656
override DataFlow::Node getResponseBody() { result = responseBody }
5757

‎ruby/ql/lib/codeql/ruby/frameworks/http_clients/OpenURI.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ class OpenUriRequest extends HTTP::Client::Request::Range {
3232
this = requestUse.asExpr().getExpr()
3333
}
3434

35-
override DataFlow::Node getURL() { result = requestUse.getArgument(0) }
35+
override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
3636

3737
override DataFlow::Node getResponseBody() {
3838
result = requestNode.getAMethodCall(["read", "readlines"])
@@ -65,7 +65,7 @@ class OpenUriKernelOpenRequest extends HTTP::Client::Request::Range {
6565
this = requestUse.asExpr().getExpr()
6666
}
6767

68-
override DataFlow::Node getURL() { result = requestUse.getArgument(0) }
68+
override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
6969

7070
override DataFlow::CallNode getResponseBody() {
7171
result.asExpr().getExpr().(MethodCall).getMethodName() in ["read", "readlines"] and

‎ruby/ql/lib/codeql/ruby/frameworks/http_clients/RestClient.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ class RestClientHttpRequest extends HTTP::Client::Request::Range {
3838
)
3939
}
4040

41-
override DataFlow::Node getURL() {
41+
override DataFlow::Node getAUrlPart() {
4242
result = requestUse.getKeywordArgument("url")
4343
or
4444
result = requestUse.getArgument(0) and

‎ruby/ql/lib/codeql/ruby/frameworks/http_clients/Typhoeus.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ class TyphoeusHttpRequest extends HTTP::Client::Request::Range {
2626
this = requestUse.asExpr().getExpr()
2727
}
2828

29-
override DataFlow::Node getURL() { result = requestUse.getArgument(0) }
29+
override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
3030

3131
override DataFlow::Node getResponseBody() { result = requestNode.getAMethodCall("body") }
3232

0 commit comments

Comments
 (0)