Ruby: configsig rb/path-injection

alexrford · alexrford · commit ad2bbfb2652a · 2023-09-03T17:20:05.000+01:00
diff --git a/ruby/ql/lib/codeql/ruby/security/PathInjectionQuery.qll b/ruby/ql/lib/codeql/ruby/security/PathInjectionQuery.qll
@@ -3,7 +3,7 @@
  * path injection vulnerabilities.
  *
  * Note, for performance reasons: only import this file if
- * `PathInjection::Configuration` is needed, otherwise
+ * `PathInjectionFlow` is needed, otherwise
  * `PathInjectionCustomizations` should be imported instead.
  */
 
@@ -15,8 +15,9 @@ private import codeql.ruby.TaintTracking
 /**
  * A taint-tracking configuration for reasoning about path injection
  * vulnerabilities.
+ * DEPRECATED: Use `PathInjectionFlow`
  */
-class Configuration extends TaintTracking::Configuration {
+deprecated class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "PathInjection" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof PathInjection::Source }
@@ -31,3 +32,18 @@ class Configuration extends TaintTracking::Configuration {
     guard instanceof PathInjection::SanitizerGuard
   }
 }
+
+private module PathInjectionConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof PathInjection::Source }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof PathInjection::Sink }
+
+  predicate isBarrier(DataFlow::Node node) {
+    node instanceof Path::PathSanitization or node instanceof PathInjection::Sanitizer
+  }
+}
+
+/**
+ * Taint-tracking for detecting path injection vulnerabilities.
+ */
+module PathInjectionFlow = TaintTracking::Global<PathInjectionConfig>;
diff --git a/ruby/ql/src/queries/security/cwe-022/PathInjection.ql b/ruby/ql/src/queries/security/cwe-022/PathInjection.ql
@@ -17,9 +17,9 @@
 
 import ruby
 import codeql.ruby.security.PathInjectionQuery
-import DataFlow::PathGraph
+import PathInjectionFlow::PathGraph
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
-where cfg.hasFlowPath(source, sink)
+from PathInjectionFlow::PathNode source, PathInjectionFlow::PathNode sink
+where PathInjectionFlow::flowPath(source, sink)
 select sink.getNode(), source, sink, "This path depends on a $@.", source.getNode(),
   "user-provided value"
