tainted_love 0.1.5 → 0.4.0

data/tests/rails/app/controllers/graphql_controller.rb

@@ -0,0 +1,43 @@
+class GraphqlController < ApplicationController
+  def execute
+    variables = ensure_hash(params[:variables])
+    query = params[:query]
+    operation_name = params[:operationName]
+    context = {
+      # Query context goes here, for example:
+      # current_user: current_user,
+    }
+    result = ExampleSchema.execute(query, variables: variables, context: context, operation_name: operation_name)
+    render json: result
+  rescue => e
+    raise e unless Rails.env.development?
+    handle_error_in_development e
+  end
+
+  private
+
+  # Handle form data, JSON body, or a blank value
+  def ensure_hash(ambiguous_param)
+    case ambiguous_param
+    when String
+      if ambiguous_param.present?
+        ensure_hash(JSON.parse(ambiguous_param))
+      else
+        {}
+      end
+    when Hash, ActionController::Parameters
+      ambiguous_param
+    when nil
+      {}
+    else
+      raise ArgumentError, "Unexpected parameter: #{ambiguous_param}"
+    end
+  end
+
+  def handle_error_in_development(e)
+    logger.error e.message
+    logger.error e.backtrace.join("\n")
+
+    render json: { error: { message: e.message, backtrace: e.backtrace }, data: {} }, status: 500
+  end
+end

data/tests/rails/app/controllers/test_cases_controller.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+class TestCasesController < ApplicationController
+  layout false
+
+  def xss
+  end
+
+  def unsafe_render
+    render(params[:file])
+  end
+
+  def render_inline
+    render(inline: params[:template])
+  end
+
+  def unsafe_redirect
+    redirect_to(params[:to])
+  end
+
+  def taint_test
+    cookies[:something] = 'asdf'
+
+    values = {
+      'route_parameter_value' => params[:route_param],
+      'get_parameter' => params[:get_param],
+      'get_array_parameter_0' => params[:get_array_param][0],
+      'get_array_parameter_1' => params[:get_array_param][1],
+      'parameter_name' => params.keys.first,
+      'header_value' => request.headers['Host'],
+      'header_name' => request.headers.to_h.keys.select { |k| k['HTTP_AAA'] }.first,
+      'cookie_value' => cookies[:something],
+      'cookie_name' => cookies.to_h.keys.first,
+      'fullpath' => request.original_fullpath
+    }
+
+    description = values.keys
+    tainted = values.values.map(&:tainted?)
+    sources = values.values.map(&:tainted_love_tags)
+
+    render json: description.zip(values.values, tainted, sources)
+  end
+end

data/tests/rails/app/graphql/example_schema.rb

@@ -0,0 +1,4 @@
+class ExampleSchema < GraphQL::Schema
+  mutation(Types::MutationType)
+  query(Types::QueryType)
+end

data/tests/rails/app/graphql/types/base_enum.rb

@@ -0,0 +1,4 @@
+module Types
+  class BaseEnum < GraphQL::Schema::Enum
+  end
+end

data/tests/rails/app/graphql/types/base_input_object.rb

@@ -0,0 +1,4 @@
+module Types
+  class BaseInputObject < GraphQL::Schema::InputObject
+  end
+end

data/tests/rails/app/graphql/types/base_interface.rb

@@ -0,0 +1,5 @@
+module Types
+  module BaseInterface
+    include GraphQL::Schema::Interface
+  end
+end

data/tests/rails/app/graphql/types/base_object.rb

@@ -0,0 +1,4 @@
+module Types
+  class BaseObject < GraphQL::Schema::Object
+  end
+end

data/tests/rails/app/graphql/types/base_scalar.rb

@@ -0,0 +1,4 @@
+module Types
+  class BaseScalar < GraphQL::Schema::Scalar
+  end
+end

data/tests/rails/app/graphql/types/base_union.rb

@@ -0,0 +1,4 @@
+module Types
+  class BaseUnion < GraphQL::Schema::Union
+  end
+end

data/tests/rails/app/graphql/types/mutation_type.rb

@@ -0,0 +1,10 @@
+module Types
+  class MutationType < Types::BaseObject
+    # TODO: remove me
+    field :test_field, String, null: false,
+      description: "An example field added by the generator"
+    def test_field
+      "Hello World"
+    end
+  end
+end

data/tests/rails/app/graphql/types/product_type.rb

@@ -0,0 +1,10 @@
+module Types
+  class ProductType < Types::BaseObject
+    field :id, Integer, null: false
+    field :name, String, null: true
+    field :price, Integer, null: false
+    field :description, String, null: true
+
+    field :products, [ProductType], null: true
+  end
+end

data/tests/rails/app/graphql/types/query_type.rb

@@ -0,0 +1,46 @@
+module Types
+  class QueryType < Types::BaseObject
+    field :object_argument_taint_test_case, Boolean, null: false do
+      argument :input, TaintTestCaseInput, required: true
+    end
+
+    field :string_argument_taint_test_case, Boolean, null: false do
+      argument :input, String, required: true
+      argument :input_default, String, required: false, default_value: "something"
+    end
+
+    field :mutate_context, Integer, null: true do
+      argument :id, Integer, required: true
+    end
+
+    field :whoami, Integer, null: true
+
+    field :products, [ProductType], null: true
+
+    def object_argument_taint_test_case(input:)
+      [
+        input.top_level_string.tainted?,
+        !input.default_value_untainted.tainted?
+      ].all?
+    end
+
+    def string_argument_taint_test_case(input:, input_default:)
+      [
+        input.tainted?,
+        !input_default.tainted?
+      ].all?
+    end
+
+    def mutate_context(id:)
+      context[:user_id] = id
+    end
+
+    def whoami
+      context[:user_id]
+    end
+
+    def products
+      Product.all
+    end
+  end
+end

data/tests/rails/app/graphql/types/taint_test_case_input.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Types
+  class TaintTestCaseInput < Types::BaseInputObject
+    argument :top_level_string, String, required: true
+    argument :default_value_untainted, String, required: false, default_value: "A value"
+  end
+end

data/{example → tests/rails}/config/routes.rb

@@ -1,10 +1,16 @@
 # frozen_string_literal: true
 
 Rails.application.routes.draw do
+  if Rails.env.development?
+    mount GraphiQL::Rails::Engine, at: "/graphiql", graphql_path: "/graphql"
+  end
+  post "/graphql", to: "graphql#execute"
   get 'test_cases/xss'
   get 'test_cases/unsafe_render'
   get 'test_cases/render_inline'
   get 'test_cases/unsafe_redirect'
+  get 'test_cases/taint_test/:route_param' => 'test_cases#taint_test', as: 'test_cases_taint_test'
+
   resources :products
   # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
 end

data/tests/rails/test.sh

@@ -0,0 +1 @@
+bundle exec rails test

data/tests/rails/test/controllers/graphql_controller_test.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class GraphQLControllerTest < ActionDispatch::IntegrationTest
+  test "string arguments are tainted" do
+    response = run_graphql('{ stringArgumentTaintTestCase(input:"asdf") }')
+
+    assert_equal({ "data" => { "stringArgumentTaintTestCase" => true } }, response)
+  end
+
+  test "string in object arguments are tainted" do
+    response = run_graphql('{ objectArgumentTaintTestCase(input: { topLevelString: "Asdf" }) }')
+
+    assert_equal({ "data" => { "objectArgumentTaintTestCase" => true } }, response)
+  end
+
+  def run_graphql(query)
+    params = {
+      query: query
+    }
+
+    post graphql_url, params: params
+    assert_response :success
+
+    response.parsed_body
+  end
+end