|
11 | 11 |
|
12 | 12 | private import codeql.ruby.AST |
13 | 13 | private import codeql.ruby.DataFlow |
| 14 | +import codeql.ruby.security.internal.SensitiveDataHeuristics |
| 15 | +private import HeuristicNames |
| 16 | + |
| 17 | +/** An expression that might contain sensitive data. */ |
| 18 | +cached |
| 19 | +abstract class SensitiveExpr extends Expr { |
| 20 | + /** Gets a human-readable description of this expression for use in alert messages. */ |
| 21 | + cached |
| 22 | + abstract string describe(); |
| 23 | + |
| 24 | + /** Gets a classification of the kind of sensitive data this expression might contain. */ |
| 25 | + cached |
| 26 | + abstract SensitiveDataClassification getClassification(); |
| 27 | +} |
| 28 | + |
| 29 | +/** A method call that might produce sensitive data. */ |
| 30 | +class SensitiveCall extends SensitiveExpr, MethodCall { |
| 31 | + SensitiveDataClassification classification; |
| 32 | + |
| 33 | + SensitiveCall() { |
| 34 | + classification = this.getMethodName().(SensitiveDataMethodName).getClassification() |
| 35 | + or |
| 36 | + // This is particularly to pick up methods with an argument like "password", which |
| 37 | + // may indicate a lookup. |
| 38 | + exists(string s | this.getAnArgument().getConstantValue().isStringlikeValue(s) | |
| 39 | + nameIndicatesSensitiveData(s, classification) |
| 40 | + ) |
| 41 | + } |
| 42 | + |
| 43 | + override string describe() { result = "a call to " + this.getMethodName() } |
| 44 | + |
| 45 | + override SensitiveDataClassification getClassification() { result = classification } |
| 46 | +} |
| 47 | + |
| 48 | +/** An access to a variable or hash value that might contain sensitive data. */ |
| 49 | +abstract class SensitiveVariableAccess extends SensitiveExpr { |
| 50 | + string name; |
| 51 | + |
| 52 | + SensitiveVariableAccess() { |
| 53 | + this.(VariableAccess).getVariable().hasName(name) |
| 54 | + or |
| 55 | + this.(ElementReference).getAnArgument().getConstantValue().isStringlikeValue(name) |
| 56 | + } |
| 57 | + |
| 58 | + override string describe() { result = "an access to " + name } |
| 59 | +} |
| 60 | + |
| 61 | +/** A write to a location that might contain sensitive data. */ |
| 62 | +abstract class SensitiveWrite extends DataFlow::Node { } |
| 63 | + |
| 64 | +/** |
| 65 | + * Holds if `node` is a write to a variable or hash value named `name`. |
| 66 | + * |
| 67 | + * Helper predicate factored out for performance, |
| 68 | + * to filter `name` as much as possible before using it in |
| 69 | + * regex matching. |
| 70 | + */ |
| 71 | +pragma[nomagic] |
| 72 | +private predicate writesProperty(DataFlow::Node node, string name) { |
| 73 | + exists(VariableWriteAccess vwa | vwa.getVariable().getName() = name | |
| 74 | + node.asExpr().getExpr() = vwa |
| 75 | + ) |
| 76 | + or |
| 77 | + // hash value assignment |
| 78 | + node.(DataFlow::CallNode).getMethodName() = "[]=" and |
| 79 | + node.(DataFlow::CallNode).getArgument(0).asExpr().getConstantValue().isStringlikeValue(name) |
| 80 | +} |
| 81 | + |
| 82 | +/** A write to a variable or property that might contain sensitive data. */ |
| 83 | +private class BasicSensitiveWrite extends SensitiveWrite { |
| 84 | + SensitiveDataClassification classification; |
| 85 | + |
| 86 | + BasicSensitiveWrite() { |
| 87 | + exists(string name | |
| 88 | + /* |
| 89 | + * PERFORMANCE OPTIMISATION: |
| 90 | + * `nameIndicatesSensitiveData` performs a `regexpMatch` on `name`. |
| 91 | + * To carry out a regex match, we must first compute the Cartesian product |
| 92 | + * of all possible `name`s and regexes, then match. |
| 93 | + * To keep this product as small as possible, |
| 94 | + * we want to filter `name` as much as possible before the product. |
| 95 | + * |
| 96 | + * Do this by factoring out a helper predicate containing the filtering |
| 97 | + * logic that restricts `name`. This helper predicate will get picked first |
| 98 | + * in the join order, since it is the only call here that binds `name`. |
| 99 | + */ |
| 100 | + |
| 101 | + writesProperty(this, name) and |
| 102 | + nameIndicatesSensitiveData(name, classification) |
| 103 | + ) |
| 104 | + } |
| 105 | + |
| 106 | + /** Gets a classification of the kind of sensitive data the write might handle. */ |
| 107 | + SensitiveDataClassification getClassification() { result = classification } |
| 108 | +} |
| 109 | + |
| 110 | +/** An access to a variable or hash value that might contain sensitive data. */ |
| 111 | +private class BasicSensitiveVariableAccess extends SensitiveVariableAccess { |
| 112 | + SensitiveDataClassification classification; |
| 113 | + |
| 114 | + BasicSensitiveVariableAccess() { nameIndicatesSensitiveData(name, classification) } |
| 115 | + |
| 116 | + override SensitiveDataClassification getClassification() { result = classification } |
| 117 | +} |
| 118 | + |
| 119 | +/** A method name that suggests it may be sensitive. */ |
| 120 | +abstract class SensitiveMethodName extends string { |
| 121 | + SensitiveMethodName() { this = any(MethodBase m).getName() } |
| 122 | +} |
| 123 | + |
| 124 | +/** A method name that suggests it may produce sensitive data. */ |
| 125 | +abstract class SensitiveDataMethodName extends SensitiveMethodName { |
| 126 | + /** Gets a classification of the kind of sensitive data this method may produce. */ |
| 127 | + abstract SensitiveDataClassification getClassification(); |
| 128 | +} |
| 129 | + |
| 130 | +/** A method name that might return sensitive credential data. */ |
| 131 | +class CredentialsMethodName extends SensitiveDataMethodName { |
| 132 | + SensitiveDataClassification classification; |
| 133 | + |
| 134 | + CredentialsMethodName() { nameIndicatesSensitiveData(this, classification) } |
| 135 | + |
| 136 | + override SensitiveDataClassification getClassification() { result = classification } |
| 137 | +} |
14 | 138 |
|
15 | 139 | /** |
16 | 140 | * A sensitive action, such as transfer of sensitive data. |
|
0 commit comments