Ruby: configsig rb/kernel-open

alexrford · alexrford · commit d46eceb5f4c6 · 2023-09-03T17:20:04.000+01:00
diff --git a/ruby/ql/lib/codeql/ruby/security/KernelOpenQuery.qll b/ruby/ql/lib/codeql/ruby/security/KernelOpenQuery.qll
@@ -4,10 +4,12 @@
 
 private import codeql.ruby.AST
 private import codeql.ruby.DataFlow
-private import codeql.ruby.AST
 private import codeql.ruby.ApiGraphs
+private import codeql.ruby.dataflow.BarrierGuards
+private import codeql.ruby.dataflow.RemoteFlowSources
 private import codeql.ruby.frameworks.core.Kernel::Kernel
 private import codeql.ruby.frameworks.Files
+private import codeql.ruby.TaintTracking
 
 /** A call to a method that might access a file or start a process. */
 class AmbiguousPathCall extends DataFlow::CallNode {
@@ -72,3 +74,20 @@ abstract class Sanitizer extends DataFlow::Node { }
 private class FileJoinSanitizer extends Sanitizer {
   FileJoinSanitizer() { this = any(File::FileJoinSummary s).getParameter("1..") }
 }
+
+private module KernelOpenConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  predicate isSink(DataFlow::Node sink) { sink = any(AmbiguousPathCall r).getPathArgument() }
+
+  predicate isBarrier(DataFlow::Node node) {
+    node instanceof StringConstCompareBarrier or
+    node instanceof StringConstArrayInclusionCallBarrier or
+    node instanceof Sanitizer
+  }
+}
+
+/**
+ * Taint-tracking for detecting insecure uses of `Kernel.open` and similar sinks.
+ */
+module KernelOpenFlow = TaintTracking::Global<KernelOpenConfig>;
diff --git a/ruby/ql/src/queries/security/cwe-078/KernelOpen.ql b/ruby/ql/src/queries/security/cwe-078/KernelOpen.ql
@@ -16,33 +16,14 @@
  */
 
 import codeql.ruby.DataFlow
-import codeql.ruby.TaintTracking
-import codeql.ruby.dataflow.RemoteFlowSources
-import codeql.ruby.dataflow.BarrierGuards
-import DataFlow::PathGraph
 import codeql.ruby.security.KernelOpenQuery
-
-class Configuration extends TaintTracking::Configuration {
-  Configuration() { this = "KernelOpen" }
-
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) {
-    sink = any(AmbiguousPathCall r).getPathArgument()
-  }
-
-  override predicate isSanitizer(DataFlow::Node node) {
-    node instanceof StringConstCompareBarrier or
-    node instanceof StringConstArrayInclusionCallBarrier or
-    node instanceof Sanitizer
-  }
-}
+import KernelOpenFlow::PathGraph
 
 from
-  Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink,
-  DataFlow::Node sourceNode, DataFlow::CallNode call
+  KernelOpenFlow::PathNode source, KernelOpenFlow::PathNode sink, DataFlow::Node sourceNode,
+  DataFlow::CallNode call
 where
-  config.hasFlowPath(source, sink) and
+  KernelOpenFlow::flowPath(source, sink) and
   sourceNode = source.getNode() and
   call.getArgument(0) = sink.getNode()
 select sink.getNode(), source, sink,
