seaworthycode 1.1.2 → 1.1.4

package/rules/internal/taint/ruby.test.yaml

@@ -0,0 +1,148 @@
+language: ruby
+cases:
+  - name: "SQLi from params to find_by_sql"
+    language: ruby
+    code: |
+      id = params[:id]
+      User.find_by_sql("SELECT * FROM users WHERE id = #{id}")
+    expect:
+      count: 1
+      flows:
+        - sourceId: params
+          sinkId: ruby.sqli_find
+
+  - name: "SQLi sanitised by to_i"
+    language: ruby
+    code: |
+      id = params[:id].to_i
+      User.find_by_sql("SELECT * FROM users WHERE id = #{id}")
+    expect:
+      count: 0
+
+  - name: "SQLi from params to connection.execute"
+    language: ruby
+    code: |
+      sql = params[:q]
+      ActiveRecord::Base.connection.execute(sql)
+    expect:
+      count: 1
+      flows:
+        - sourceId: params
+          sinkId: ruby.sqli_conn
+
+  - name: "Command injection from request.params to system"
+    language: ruby
+    code: |
+      cmd = request.params["cmd"]
+      system(cmd)
+    expect:
+      count: 1
+      flows:
+        - sourceId: params
+          sinkId: ruby.cmd_call
+
+  - name: "Command injection via backticks"
+    language: ruby
+    code: |
+      cmd = request.params["cmd"]
+      `#{cmd}`
+    expect:
+      count: 1
+      flows:
+        - sourceId: params
+          sinkId: ruby.cmd_subshell
+
+  - name: "Command injection sanitised by Shellwords.escape"
+    language: ruby
+    code: |
+      system(Shellwords.escape(params[:cmd]))
+    expect:
+      count: 0
+
+  - name: "XSS from cookies to raw"
+    language: ruby
+    code: |
+      html = cookies[:html]
+      raw(html)
+    expect:
+      count: 1
+      flows:
+        - sourceId: cookies_or_session
+          sinkId: rails.xss_raw
+
+  - name: "XSS sanitised by html_escape"
+    language: ruby
+    code: |
+      html = html_escape(cookies[:html])
+      raw(html)
+    expect:
+      count: 0
+
+  - name: "Code execution from ARGV to eval"
+    language: ruby
+    code: |
+      code = ARGV[0]
+      eval(code)
+    expect:
+      count: 1
+      flows:
+        - sourceId: ruby.argv
+          sinkId: ruby.eval
+
+  - name: "Path traversal from ENV to File.read"
+    language: ruby
+    code: |
+      path = ENV["PATH"]
+      File.read(path)
+    expect:
+      count: 1
+      flows:
+        - sourceId: ruby.env
+          sinkId: ruby.path
+
+  - name: "Path traversal sanitised by basename"
+    language: ruby
+    code: |
+      path = File.basename(params[:path])
+      File.read(path)
+    expect:
+      count: 0
+
+  - name: "URL redirection from params to redirect_to"
+    language: ruby
+    code: |
+      url = params[:url]
+      redirect_to(url)
+    expect:
+      count: 1
+      flows:
+        - sourceId: params
+          sinkId: ruby.url
+
+  - name: "URL redirection sanitised by url_encode"
+    language: ruby
+    code: |
+      url = ERB::Util.url_encode(params[:url])
+      redirect_to(url)
+    expect:
+      count: 0
+
+  - name: "Code execution avoided when params only logged"
+    language: ruby
+    code: |
+      name = params[:name]
+      puts(name)
+    expect:
+      count: 0
+
+  - name: "Command injection via pipe open"
+    language: ruby
+    code: |
+      cmd = params[:cmd]
+      open("|#{cmd}")
+    expect:
+      count: 1
+      flows:
+        - sourceId: params
+          sinkId: ruby.cmd_pipe_open
+

package/rules/internal/taint/ruby.yaml

@@ -0,0 +1,233 @@
+# Documented exclusion: Prototype-pollution is excluded as Ruby has no prototype chain.
+# attribution: CWE-79
+attribution: CWE-79
+language: ruby
+applies-to: []
+
+sources:
+  - id: params
+    class: http-params
+    query: |
+      [
+        (identifier) @name (#eq? @name "params")
+        (call method: (identifier) @name (#eq? @name "params"))
+      ] @source
+
+  - id: cookies_or_session
+    class: http-params
+    query: |
+      [
+        (identifier) @name (#match? @name "^(cookies|session)$")
+        (call method: (identifier) @name (#match? @name "^(cookies|session)$"))
+      ] @source
+
+  - id: request.body
+    class: http-body
+    query: |
+      (call
+        receiver: (identifier) @recv (#eq? @recv "request")
+        method: (identifier) @method (#match? @method "^(body|raw_post)$")) @source
+
+  - id: request.headers
+    class: header
+    query: |
+      [
+        (call
+          receiver: (call
+            receiver: (identifier) @recv (#eq? @recv "request")
+            method: (identifier) @m1 (#eq? @m1 "headers"))
+          method: (identifier) @m2 (#match? @m2 "^(\\[\\]|get)$")) @source
+        (element_reference
+          object: (call
+            receiver: (identifier) @recv (#eq? @recv "request")
+            method: (identifier) @m1 (#eq? @m1 "headers"))
+          [(_)]) @source
+      ]
+
+  - id: request.env.http
+    class: header
+    query: |
+      (element_reference
+        object: (call
+          receiver: (identifier) @recv (#eq? @recv "request")
+          method: (identifier) @m (#eq? @m "env"))
+        [(string) @key (#match? @key "^HTTP_")])
+
+  - id: ruby.argv
+    class: process-argv
+    query: |
+      ((constant) @source (#eq? @source "ARGV"))
+
+  - id: ruby.env
+    class: env-var
+    query: |
+      ((constant) @source (#eq? @source "ENV"))
+
+  - id: ruby.file_read
+    class: fs-read
+    query: |
+      (call
+        receiver: (constant) @recv (#match? @recv "^(File|IO)$")
+        method: (identifier) @method (#match? @method "^(read|readlines|sysread)$")) @source
+
+  - id: ruby.net_response
+    class: network-response
+    query: |
+      (call
+        receiver: (identifier) @recv (#match? @recv "^(response|res)$")
+        method: (identifier) @method (#eq? @method "body")) @source
+
+sinks:
+  - id: ruby.eval
+    sink-class: code-execution
+    query: |
+      (call
+        method: (identifier) @method (#match? @method "^(eval|instance_eval|class_eval)$")
+        arguments: (argument_list (_) @sink))
+
+  - id: rails.xss_raw
+    sink-class: xss
+    query: |
+      (call
+        method: (identifier) @method1 (#eq? @method1 "raw")
+        arguments: (argument_list (_) @sink))
+
+  - id: rails.xss_html_safe
+    sink-class: xss
+    query: |
+      (call
+        receiver: (_) @sink
+        method: (identifier) @method2 (#eq? @method2 "html_safe"))
+
+  - id: rails.xss_render_html
+    sink-class: xss
+    query: |
+      (call
+        method: (identifier) @method (#eq? @method "render")
+        arguments: (argument_list
+          (pair
+            key: (hash_key_symbol) @k (#match? @k "^(html|inline)$")
+            value: (_) @sink)))
+
+  - id: ruby.sqli_find
+    sink-class: sql-injection
+    query: |
+      (call
+        method: (identifier) @method1 (#match? @method1 "^(find_by_sql|where|select_all|find_by)$")
+        arguments: (argument_list (_) @sink))
+
+  - id: ruby.sqli_conn
+    sink-class: sql-injection
+    query: |
+      (call
+        receiver: (call method: (identifier) @method2 (#eq? @method2 "connection"))
+        method: (identifier) @method3 (#eq? @method3 "execute")
+        arguments: (argument_list (_) @sink))
+
+  - id: ruby.cmd_call
+    sink-class: command-injection
+    query: |
+      (call
+        method: (identifier) @method1 (#match? @method1 "^(system|exec|spawn)$")
+        arguments: (argument_list (_) @sink))
+
+  - id: ruby.cmd_subshell
+    sink-class: command-injection
+    query: |
+      (subshell) @sink
+
+  - id: ruby.cmd_pipe_open
+    sink-class: command-injection
+    query: |
+      (call
+        method: (identifier) @method (#eq? @method "open")
+        arguments: (argument_list
+          (string
+            (string_content) @s (#match? @s "^\\|")) @sink))
+
+  - id: ruby.path
+    sink-class: path-traversal
+    query: |
+      (call
+        receiver: (constant) @recv1 (#match? @recv1 "^(File|Dir|IO)$")
+        method: (identifier) @method1 (#match? @method1 "^(read|write|open|glob|delete|rmdir|mkdir)$")
+        arguments: (argument_list (_) @sink))
+
+  - id: ruby.path_send_file
+    sink-class: path-traversal
+    query: |
+      (call
+        method: (identifier) @method (#match? @method "^(send_file|send_data)$")
+        arguments: (argument_list (_) @sink))
+
+  - id: ruby.path_require
+    sink-class: path-traversal
+    query: |
+      (call
+        method: (identifier) @method2 (#match? @method2 "^(require|load)$")
+        arguments: (argument_list (_) @sink))
+
+  - id: ruby.url
+    sink-class: url-injection
+    query: |
+      (call
+        method: (identifier) @method (#eq? @method "redirect_to")
+        arguments: (argument_list (_) @sink))
+
+sanitisers:
+  - id: html_escape
+    sanitises:
+      - xss
+    autofix-safety: global
+    query: |
+      (call
+        method: (identifier) @method (#match? @method "^(html_escape|escape_html|escape)$")) @sanitiser
+
+  - id: numeric_cast
+    sanitises:
+      - xss
+      - sql-injection
+      - command-injection
+      - path-traversal
+      - url-injection
+    query: |
+      (call
+        receiver: (_)
+        method: (identifier) @method (#match? @method "^(to_i|to_f)$")) @sanitiser
+
+  - id: shell_escape
+    sanitises:
+      - command-injection
+    query: |
+      (call
+        receiver: (constant) @recv (#eq? @recv "Shellwords")
+        method: (identifier) @method (#eq? @method "escape")) @sanitiser
+
+  - id: path_sanitise
+    sanitises:
+      - path-traversal
+    query: |
+      (call
+        method: (identifier) @method (#eq? @method "basename")) @sanitiser
+
+  - id: url_sanitise
+    sanitises:
+      - url-injection
+    query: |
+      (call
+        method: (identifier) @method (#match? @method "^(escape|url_encode)$")) @sanitiser
+
+  - id: sql_quote
+    sanitises:
+      - sql-injection
+    query: |
+      (call
+        receiver: (call method: (identifier) @m (#eq? @m "connection"))
+        method: (identifier) @method (#eq? @method "quote")) @sanitiser
+
+  - id: sql_sanitize_array
+    sanitises:
+      - sql-injection
+    query: |
+      (call
+        method: (identifier) @method (#eq? @method "sanitize_sql_array")) @sanitiser