Include some more types of expressions as possible active record SQL sink arguments

alexrford · alexrford · commit bf43a77df542 · 2021-06-15T12:41:42.000+01:00
diff --git a/ql/src/codeql_ruby/frameworks/ActiveRecord.qll b/ql/src/codeql_ruby/frameworks/ActiveRecord.qll
@@ -53,6 +53,14 @@ class ActiveRecordModelClassMethodCall extends MethodCall {
   }
 }
 
+private predicate methodCanTakeSqlFragmentAsFirstArg(string methodName) {
+  methodName =
+    [
+      "delete_all", "destroy_all", "exists?", "find_by", "find_by_sql", "from", "group", "having",
+      "joins", "lock", "not", "order", "pluck", "where"
+    ]
+}
+
 class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMethodCall {
   // The name of the method invoked
   private string methodName;
@@ -61,10 +69,6 @@ class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMeth
   // The SQL fragment argument itself
   private Expr sqlFragmentExpr;
 
-  // TODO: This is slightly too restricted, we only look for StringlikeLiterals
-  // as arguments, but we could instead have a variable read, a string
-  // concatenation, certain arrays, etc. and still have a potentially
-  // vulnerable call
   // TODO: `find` with `lock:` option also takes an SQL fragment
   PotentiallyUnsafeSqlExecutingMethodCall() {
     methodName = this.getMethodName() and
@@ -73,37 +77,20 @@ class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMeth
       methodName = "calculate" and sqlFragmentArgumentIndex = 1
       or
       sqlFragmentArgumentIndex = 0 and
-      (
-        methodName = "delete_all"
-        or
-        methodName = "destroy_all"
-        or
-        methodName = "exists?"
-        or
-        methodName = "find_by"
-        or
-        methodName = "find_by_sql"
-        or
-        methodName = "from"
-        or
-        methodName = "group"
-        or
-        methodName = "having"
-        or
-        methodName = "joins"
-        or
-        methodName = "lock"
-        or
-        methodName = "not"
-        or
-        methodName = "order"
-        or
-        methodName = "pluck"
-        or
-        methodName = "where"
-      )
+      methodCanTakeSqlFragmentAsFirstArg(methodName)
     ) and
-    sqlFragmentExpr instanceof StringlikeLiteral
+    (
+      // select only literals containing an interpolated value...
+      exists(StringInterpolationComponent interpolated |
+        interpolated = sqlFragmentExpr.(StringlikeLiteral).getComponent(_)
+      )
+      or
+      // ...or string concatenations...
+      sqlFragmentExpr instanceof AddExpr
+      or
+      // ...or variable reads
+      sqlFragmentExpr instanceof VariableReadAccess
+    )
   }
 
   Expr getSqlFragmentSinkArgument() { result = sqlFragmentExpr }
diff --git a/ql/test/library-tests/frameworks/ActiveRecord.expected b/ql/test/library-tests/frameworks/ActiveRecord.expected
@@ -5,17 +5,18 @@ activeRecordModelClasses
 activeRecordSqlExecutionRanges
 | ActiveRecordInjection.rb:22:21:22:41 | "id = #{...}" |
 | ActiveRecordInjection.rb:28:16:28:21 | <<-SQL |
-| ActiveRecordInjection.rb:32:21:32:26 | :users |
 | ActiveRecordInjection.rb:32:35:32:60 | "user.id = #{...}" |
+| ActiveRecordInjection.rb:45:21:45:33 | ... + ... |
 activeRecordModelClassMethodCalls
 | ActiveRecordInjection.rb:19:5:19:45 | call to calculate |
 | ActiveRecordInjection.rb:22:5:22:42 | call to delete_all |
 | ActiveRecordInjection.rb:25:5:25:45 | call to destroy_all |
 | ActiveRecordInjection.rb:28:5:28:35 | call to where |
 | ActiveRecordInjection.rb:32:5:32:27 | call to joins |
 | ActiveRecordInjection.rb:32:5:32:61 | call to where |
+| ActiveRecordInjection.rb:45:5:45:34 | call to delete_all |
 potentiallyUnsafeSqlExecutingMethodCall
 | ActiveRecordInjection.rb:22:5:22:42 | call to delete_all |
 | ActiveRecordInjection.rb:28:5:28:35 | call to where |
-| ActiveRecordInjection.rb:32:5:32:27 | call to joins |
 | ActiveRecordInjection.rb:32:5:32:61 | call to where |
+| ActiveRecordInjection.rb:45:5:45:34 | call to delete_all |
diff --git a/ql/test/library-tests/frameworks/ActiveRecordInjection.rb b/ql/test/library-tests/frameworks/ActiveRecordInjection.rb
@@ -9,7 +9,7 @@ class User < ApplicationRecord
 class Admin < User
 end
 
-class FooController < ApplicationController
+class FooController < ActionController::Base
 
   MAX_USER_ID = 100_000
 
@@ -32,3 +32,20 @@ def some_request_handler
     UserGroup.joins(:users).where("user.id = #{params[:id]}")
   end
 end
+
+
+class BarController < ApplicationController
+
+  def some_other_request_handler
+    ps = params
+    # TODO: we don't pick up on this indirect params field reference
+    uid = ps[:id]
+
+    # DELETE FROM "users" WHERE (id = #{uid})
+    User.delete_all("id = " + uid)
+  end
+
+end
+
+class BazController < BarController
+end
