Skip to content

Commit d21d453

Browse files
author
Alvaro Muñoz
committed
Split queries
1 parent d26ead7 commit d21d453

6 files changed

Lines changed: 206 additions & 2 deletions

File tree

‎ql/src/Security/CWE-078/CommandInjection.ql‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* @name Command built from user-controlled sources
3+
* @description Building a system command from user-controlled sources is vulnerable to insertion of
4+
* malicious code by the user.
5+
* @kind path-problem
6+
* @problem.severity warning
7+
* @security-severity 5.0
8+
* @precision high
9+
* @id actions/command-injection
10+
* @tags actions
11+
* security
12+
* external/cwe/cwe-078
13+
*/
14+
15+
import actions
16+
import codeql.actions.TaintTracking
17+
import codeql.actions.dataflow.FlowSources
18+
import codeql.actions.dataflow.ExternalFlow
19+
20+
private class CommandInjectionSink extends DataFlow::Node {
21+
CommandInjectionSink() { externallyDefinedSink(this, "command-injection") }
22+
}
23+
24+
private module MyConfig implements DataFlow::ConfigSig {
25+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
26+
27+
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }
28+
}
29+
30+
module MyFlow = TaintTracking::Global<MyConfig>;
31+
32+
import MyFlow::PathGraph
33+
34+
from MyFlow::PathNode source, MyFlow::PathNode sink
35+
where MyFlow::flowPath(source, sink)
36+
select sink.getNode(), source, sink,
37+
"Potential expression injection in $@, which may be controlled by an external user.", sink,
38+
sink.getNode().asExpr().(Expression).getRawExpression()

‎ql/src/Security/CWE-078/CriticalCommandInjection.ql‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* @name Command built from user-controlled sources
3+
* @description Building a system command from user-controlled sources is vulnerable to insertion of
4+
* malicious code by the user.
5+
* @kind path-problem
6+
* @problem.severity error
7+
* @security-severity 9
8+
* @precision high
9+
* @id actions/command-injection
10+
* @tags actions
11+
* security
12+
* external/cwe/cwe-078
13+
*/
14+
15+
import actions
16+
import codeql.actions.TaintTracking
17+
import codeql.actions.dataflow.FlowSources
18+
import codeql.actions.dataflow.ExternalFlow
19+
20+
private class CommandInjectionSink extends DataFlow::Node {
21+
CommandInjectionSink() { externallyDefinedSink(this, "command-injection") }
22+
}
23+
24+
private module MyConfig implements DataFlow::ConfigSig {
25+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
26+
27+
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }
28+
}
29+
30+
module MyFlow = TaintTracking::Global<MyConfig>;
31+
32+
import MyFlow::PathGraph
33+
34+
from MyFlow::PathNode source, MyFlow::PathNode sink, Workflow w
35+
where
36+
MyFlow::flowPath(source, sink) and
37+
w = source.getNode().asExpr().getEnclosingWorkflow() and
38+
(
39+
w instanceof ReusableWorkflow or
40+
w.hasTriggerEvent(source.getNode().(RemoteFlowSource).getATriggerEvent())
41+
)
42+
select sink.getNode(), source, sink,
43+
"Potential expression injection in $@, which may be controlled by an external user.", sink,
44+
sink.getNode().asExpr().(Expression).getRawExpression()

‎ql/src/Security/CWE-094/CodeInjection.ql‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/**
2+
* @name Code injection
3+
* @description Interpreting unsanitized user input as code allows a malicious user to perform arbitrary
4+
* code execution.
5+
* @kind path-problem
6+
* @problem.severity warning
7+
* @security-severity 5.0
8+
* @precision high
9+
* @id actions/code-injection
10+
* @tags actions
11+
* security
12+
* external/cwe/cwe-094
13+
* external/cwe/cwe-095
14+
* external/cwe/cwe-116
15+
*/
16+
17+
import actions
18+
import codeql.actions.TaintTracking
19+
import codeql.actions.dataflow.FlowSources
20+
import codeql.actions.dataflow.ExternalFlow
21+
22+
private class CodeInjectionSink extends DataFlow::Node {
23+
CodeInjectionSink() { externallyDefinedSink(this, "request-forgery") }
24+
}
25+
26+
private module MyConfig implements DataFlow::ConfigSig {
27+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
28+
29+
predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjectionSink }
30+
}
31+
32+
module MyFlow = TaintTracking::Global<MyConfig>;
33+
34+
import MyFlow::PathGraph
35+
36+
from MyFlow::PathNode source, MyFlow::PathNode sink
37+
where MyFlow::flowPath(source, sink)
38+
select sink.getNode(), source, sink,
39+
"Potential expression injection in $@, which may be controlled by an external user.", sink,
40+
sink.getNode().asExpr().(Expression).getRawExpression()

‎ql/src/Security/CWE-094/CriticalCodeInjection.ql‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* @name Code injection
3+
* @description Interpreting unsanitized user input as code allows a malicious user to perform arbitrary
4+
* code execution.
5+
* @kind path-problem
6+
* @problem.severity error
7+
* @security-severity 9
8+
* @precision high
9+
* @id actions/code-injection
10+
* @tags actions
11+
* security
12+
* external/cwe/cwe-094
13+
* external/cwe/cwe-095
14+
* external/cwe/cwe-116
15+
*/
16+
17+
import actions
18+
import codeql.actions.TaintTracking
19+
import codeql.actions.dataflow.FlowSources
20+
import codeql.actions.dataflow.ExternalFlow
21+
22+
private class CodeInjectionSink extends DataFlow::Node {
23+
CodeInjectionSink() { externallyDefinedSink(this, "request-forgery") }
24+
}
25+
26+
private module MyConfig implements DataFlow::ConfigSig {
27+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
28+
29+
predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjectionSink }
30+
}
31+
32+
module MyFlow = TaintTracking::Global<MyConfig>;
33+
34+
import MyFlow::PathGraph
35+
36+
from MyFlow::PathNode source, MyFlow::PathNode sink, Workflow w
37+
where
38+
MyFlow::flowPath(source, sink) and
39+
w = source.getNode().asExpr().getEnclosingWorkflow() and
40+
(
41+
w instanceof ReusableWorkflow or
42+
w.hasTriggerEvent(source.getNode().(RemoteFlowSource).getATriggerEvent())
43+
)
44+
select sink.getNode(), source, sink,
45+
"Potential expression injection in $@, which may be controlled by an external user.", sink,
46+
sink.getNode().asExpr().(Expression).getRawExpression()

‎ql/src/Security/CWE-094/ExpressionInjection.ql‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,7 @@ import codeql.actions.dataflow.ExternalFlow
2121
private class ExpressionInjectionSink extends DataFlow::Node {
2222
ExpressionInjectionSink() {
2323
exists(Run e | e.getAnScriptExpr() = this.asExpr()) or
24-
externallyDefinedSink(this,
25-
["expression-injection", "command-injection", "request-forgery", "code-injection"])
24+
externallyDefinedSink(this, "expression-injection")
2625
}
2726
}
2827

‎ql/src/Security/CWE-918/RequestForgery.ql‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/**
2+
* @name Uncontrolled data used in network request
3+
* @description Sending network requests with user-controlled data allows for request forgery attacks.
4+
* @kind path-problem
5+
* @problem.severity error
6+
* @security-severity 9.1
7+
* @precision high
8+
* @id actions/request-forgery
9+
* @tags actions
10+
* security
11+
* external/cwe/cwe-918
12+
*/
13+
14+
import actions
15+
import codeql.actions.TaintTracking
16+
import codeql.actions.dataflow.FlowSources
17+
import codeql.actions.dataflow.ExternalFlow
18+
19+
private class RequestForgerySink extends DataFlow::Node {
20+
RequestForgerySink() { externallyDefinedSink(this, "request-forgery") }
21+
}
22+
23+
private module MyConfig implements DataFlow::ConfigSig {
24+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
25+
26+
predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
27+
}
28+
29+
module MyFlow = TaintTracking::Global<MyConfig>;
30+
31+
import MyFlow::PathGraph
32+
33+
from MyFlow::PathNode source, MyFlow::PathNode sink
34+
where MyFlow::flowPath(source, sink)
35+
select sink.getNode(), source, sink,
36+
"Potential expression injection in $@, which may be controlled by an external user.", sink,
37+
sink.getNode().asExpr().(Expression).getRawExpression()

0 commit comments

Comments
 (0)