Ruby: configsig rb/user-controlled-bypass

alexrford · alexrford · commit f760baae90f2 · 2023-08-31T16:20:19.000+01:00
diff --git a/ruby/ql/lib/codeql/ruby/security/ConditionalBypassQuery.qll b/ruby/ql/lib/codeql/ruby/security/ConditionalBypassQuery.qll
@@ -2,7 +2,7 @@
  * Provides a taint tracking configuration for reasoning about bypass of sensitive action guards.
  *
  * Note, for performance reasons: only import this file if
- * `ConditionalBypass::Configuration` is needed, otherwise
+ * `ConditionalBypassFlow` is needed, otherwise
  * `ConditionalBypassCustomizations` should be imported instead.
  */
 
@@ -13,8 +13,9 @@ import ConditionalBypassCustomizations::ConditionalBypass
 
 /**
  * A taint tracking configuration for bypass of sensitive action guards.
+ * DEPRECATED: Use `ConditionalBypassFlow` instead
  */
-class Configuration extends TaintTracking::Configuration {
+deprecated class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "ConditionalBypass" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -26,3 +27,16 @@ class Configuration extends TaintTracking::Configuration {
     node instanceof Sanitizer
   }
 }
+
+private module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+}
+
+/**
+ * Taint-tracking for bypass of sensitive action guards.
+ */
+module ConditionalBypassFlow = TaintTracking::Global<Config>;
diff --git a/ruby/ql/src/experimental/cwe-807/ConditionalBypass.ql b/ruby/ql/src/experimental/cwe-807/ConditionalBypass.ql
@@ -17,7 +17,7 @@ import codeql.ruby.DataFlow
 import codeql.ruby.dataflow.internal.DataFlowPublic
 import codeql.ruby.security.ConditionalBypassQuery
 import codeql.ruby.security.SensitiveActions
-import DataFlow::PathGraph
+import ConditionalBypassFlow::PathGraph
 
 /**
  * Holds if the value of `nd` flows into `guard`.
@@ -69,15 +69,18 @@ class SensitiveActionGuardComparisonOperand extends Sink {
  * control if `action` should be executed or not.
  */
 predicate isTaintedGuardForSensitiveAction(
-  DataFlow::PathNode sink, DataFlow::PathNode source, SensitiveAction action
+  ConditionalBypassFlow::PathNode sink, ConditionalBypassFlow::PathNode source,
+  SensitiveAction action
 ) {
   action = sink.getNode().(Sink).getAction() and
   // exclude the intermediary sink
   not sink.getNode() instanceof SensitiveActionGuardComparisonOperand and
-  exists(Configuration cfg | cfg.hasFlowPath(source, sink))
+  ConditionalBypassFlow::flowPath(source, sink)
 }
 
-from DataFlow::PathNode source, DataFlow::PathNode sink, SensitiveAction action
+from
+  ConditionalBypassFlow::PathNode source, ConditionalBypassFlow::PathNode sink,
+  SensitiveAction action
 where isTaintedGuardForSensitiveAction(sink, source, action)
 select sink.getNode(), source, sink, "This condition guards a sensitive $@, but a $@ controls it.",
   action, "action", source.getNode(), "user-provided value"
