Skip to content

Commit 7e17a91

Browse files
erik-krogherik-krogh
authored
Merge pull request #10304 from erik-krogh/rb-followMsg
RB: make the alert messages of taint-tracking queries more consistent
2 parents 18a8a33 + 063c76b commit 7e17a91

36 files changed

+200
-199
lines changed

‎ruby/ql/lib/codeql/ruby/security/CommandInjectionCustomizations.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ module CommandInjection {
3333
class RemoteFlowSourceAsSource extends Source {
3434
RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
3535

36-
override string getSourceType() { result = "a user-provided value" }
36+
override string getSourceType() { result = "user-provided value" }
3737
}
3838

3939
/**

‎ruby/ql/src/experimental/cwe-807/ConditionalBypass.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,5 +78,5 @@ predicate isTaintedGuardForSensitiveAction(
7878

7979
from DataFlow::PathNode source, DataFlow::PathNode sink, SensitiveAction action
8080
where isTaintedGuardForSensitiveAction(sink, source, action)
81-
select sink.getNode(), source, sink, "This condition guards a sensitive $@, but $@ controls it.",
82-
action, "action", source.getNode(), "a user-provided value"
81+
select sink.getNode(), source, sink, "This condition guards a sensitive $@, but a $@ controls it.",
82+
action, "action", source.getNode(), "user-provided value"

‎ruby/ql/src/queries/security/cwe-022/PathInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,5 @@ import DataFlow::PathGraph
2222

2323
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2424
where cfg.hasFlowPath(source, sink)
25-
select sink.getNode(), source, sink, "$@ flows to here and is used in a path.", source.getNode(),
26-
"User-provided value"
25+
select sink.getNode(), source, sink, "This path depends on a $@.", source.getNode(),
26+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-078/CommandInjection.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,5 +21,5 @@ from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink, S
2121
where
2222
config.hasFlowPath(source, sink) and
2323
sourceNode = source.getNode()
24-
select sink.getNode(), source, sink, "This command depends on $@.", sourceNode,
24+
select sink.getNode(), source, sink, "This command depends on a $@.", sourceNode,
2525
sourceNode.getSourceType()

‎ruby/ql/src/queries/security/cwe-079/ReflectedXSS.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919

2020
from ReflectedXss::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
2121
where config.hasFlowPath(source, sink)
22-
select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
22+
select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to a $@.",
2323
source.getNode(), "user-provided value"

‎ruby/ql/src/queries/security/cwe-089/SqlInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,5 @@ class SqlInjectionConfiguration extends TaintTracking::Configuration {
3434

3535
from SqlInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
3636
where config.hasFlowPath(source, sink)
37-
select sink.getNode(), source, sink, "This SQL query depends on $@.", source.getNode(),
38-
"a user-provided value"
37+
select sink.getNode(), source, sink, "This SQL query depends on a $@.", source.getNode(),
38+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-094/CodeInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,5 @@ from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink, S
2222
where
2323
config.hasFlowPath(source, sink) and
2424
sourceNode = source.getNode()
25-
select sink.getNode(), source, sink, "$@ flows to here and is interpreted as code.",
26-
source.getNode(), "User-provided value"
25+
select sink.getNode(), source, sink, "This code execution depends on a $@.", source.getNode(),
26+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-117/LogInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import codeql.ruby.security.LogInjectionQuery
1717

1818
from LogInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where config.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "$@ flows to log entry.", source.getNode(),
21-
"User-provided value"
20+
select sink.getNode(), source, sink, "Log entry depends on a $@.", source.getNode(),
21+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ where
2626
sinkNode = sink.getNode() and
2727
regexp = sinkNode.getRegExp()
2828
select sinkNode.getHighlight(), source, sink,
29-
"This $@ that depends on $@ may run slow on strings " + regexp.getPrefixMessage() +
29+
"This $@ that depends on a $@ may run slow on strings " + regexp.getPrefixMessage() +
3030
"with many repetitions of '" + regexp.getPumpString() + "'.", regexp, "regular expression",
31-
source.getNode(), "a user-provided value"
31+
source.getNode(), "user-provided value"

‎ruby/ql/src/queries/security/cwe-1333/RegExpInjection.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,5 @@ import codeql.ruby.security.regexp.RegExpInjectionQuery
2222

2323
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2424
where cfg.hasFlowPath(source, sink)
25-
select sink.getNode(), source, sink, "This regular expression is constructed from a $@.",
26-
source.getNode(), "user-provided value"
25+
select sink.getNode(), source, sink, "This regular expression depends on a $@.", source.getNode(),
26+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-134/TaintedFormatString.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717

1818
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where cfg.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "$@ flows here and is used in a format string.",
21-
source.getNode(), "User-provided value"
20+
select sink.getNode(), source, sink, "Format string depends on a $@.", source.getNode(),
21+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-312/CleartextStorage.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,5 +21,5 @@ import DataFlow::PathGraph
2121

2222
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
2323
where config.hasFlowPath(source, sink)
24-
select source.getNode(), source, sink, "Sensitive data returned by $@ is stored $@.",
25-
source.getNode(), source.getNode().(Source).describe(), sink.getNode(), "here"
24+
select sink.getNode(), source, sink, "Sensitive data returned by $@ is stored here.",
25+
source.getNode(), source.getNode().(Source).describe()

‎ruby/ql/src/queries/security/cwe-502/UnsafeDeserialization.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,5 @@ import codeql.ruby.security.UnsafeDeserializationQuery
1818

1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
21-
select sink.getNode(), source, sink, "Unsafe deserialization of $@.", source.getNode(), "user input"
21+
select sink.getNode(), source, sink, "Unsafe deserialization depends on a $@.", source.getNode(),
22+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-506/HardcodedDataInterpretedAsCode.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
2121
select sink.getNode(), source, sink,
22-
"Hard-coded data from $@ is interpreted as " + sink.getNode().(Sink).getKind() + ".",
23-
source.getNode(), "here"
22+
"$@ is interpreted as " + sink.getNode().(Sink).getKind() + ".", source.getNode(),
23+
"Hard-coded data"

‎ruby/ql/src/queries/security/cwe-601/UrlRedirect.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,5 @@ import codeql.ruby.DataFlow::DataFlow::PathGraph
1818

1919
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where config.hasFlowPath(source, sink)
21-
select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source.getNode(),
22-
"a user-provided value"
21+
select sink.getNode(), source, sink, "Untrusted URL redirection depends on a $@.", source.getNode(),
22+
"user-provided value"

‎ruby/ql/src/queries/security/cwe-611/Xxe.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,5 +40,5 @@ class XxeConfig extends TaintTracking::Configuration {
4040
from DataFlow::PathNode source, DataFlow::PathNode sink, XxeConfig conf
4141
where conf.hasFlowPath(source, sink)
4242
select sink.getNode(), source, sink,
43-
"A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
44-
"user-provided value"
43+
"XML parsing depends on a $@ without guarding against external entity expansion.",
44+
source.getNode(), "user-provided value"

‎ruby/ql/src/queries/security/cwe-912/HttpToFileAccess.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,4 @@ import codeql.ruby.security.HttpToFileAccessQuery
1818

1919
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
2020
where cfg.hasFlowPath(source, sink)
21-
select sink.getNode(), source, sink, "$@ flows to file system", source.getNode(), "Untrusted data"
21+
select sink.getNode(), source, sink, "$@ flows to file system.", source.getNode(), "Untrusted data"

‎ruby/ql/src/queries/security/cwe-918/ServerSideRequestForgery.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
1717

1818
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
1919
where config.hasFlowPath(source, sink)
20-
select sink.getNode(), source, sink, "The URL of this request depends on $@.", source.getNode(),
21-
"a user-provided value"
20+
select sink.getNode(), source, sink, "The URL of this request depends on a $@.", source.getNode(),
21+
"user-provided value"

‎ruby/ql/test/query-tests/security/cwe-022/PathInjection.expected

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -88,15 +88,15 @@ nodes
8888
| tainted_path.rb:60:26:60:29 | path | semmle.label | path |
8989
subpaths
9090
#select
91-
| ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params : | ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | $@ flows to here and is used in a path. | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params | User-provided value |
92-
| ArchiveApiPathTraversal.rb:68:20:68:23 | file | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params : | ArchiveApiPathTraversal.rb:68:20:68:23 | file | $@ flows to here and is used in a path. | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params | User-provided value |
93-
| ArchiveApiPathTraversal.rb:76:19:76:26 | filename | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params : | ArchiveApiPathTraversal.rb:76:19:76:26 | filename | $@ flows to here and is used in a path. | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params | User-provided value |
94-
| tainted_path.rb:5:26:5:29 | path | tainted_path.rb:4:12:4:17 | call to params : | tainted_path.rb:5:26:5:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:4:12:4:17 | call to params | User-provided value |
95-
| tainted_path.rb:11:26:11:29 | path | tainted_path.rb:10:31:10:36 | call to params : | tainted_path.rb:11:26:11:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:10:31:10:36 | call to params | User-provided value |
96-
| tainted_path.rb:17:26:17:29 | path | tainted_path.rb:16:28:16:33 | call to params : | tainted_path.rb:17:26:17:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:16:28:16:33 | call to params | User-provided value |
97-
| tainted_path.rb:23:26:23:29 | path | tainted_path.rb:22:29:22:34 | call to params : | tainted_path.rb:23:26:23:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:22:29:22:34 | call to params | User-provided value |
98-
| tainted_path.rb:29:26:29:29 | path | tainted_path.rb:28:22:28:27 | call to params : | tainted_path.rb:29:26:29:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:28:22:28:27 | call to params | User-provided value |
99-
| tainted_path.rb:35:26:35:29 | path | tainted_path.rb:34:29:34:34 | call to params : | tainted_path.rb:35:26:35:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:34:29:34:34 | call to params | User-provided value |
100-
| tainted_path.rb:41:26:41:29 | path | tainted_path.rb:40:26:40:31 | call to params : | tainted_path.rb:41:26:41:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:40:26:40:31 | call to params | User-provided value |
101-
| tainted_path.rb:48:26:48:29 | path | tainted_path.rb:47:43:47:48 | call to params : | tainted_path.rb:48:26:48:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:47:43:47:48 | call to params | User-provided value |
102-
| tainted_path.rb:60:26:60:29 | path | tainted_path.rb:59:40:59:45 | call to params : | tainted_path.rb:60:26:60:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:59:40:59:45 | call to params | User-provided value |
91+
| ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params : | ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | This path depends on a $@. | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params | user-provided value |
92+
| ArchiveApiPathTraversal.rb:68:20:68:23 | file | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params : | ArchiveApiPathTraversal.rb:68:20:68:23 | file | This path depends on a $@. | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params | user-provided value |
93+
| ArchiveApiPathTraversal.rb:76:19:76:26 | filename | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params : | ArchiveApiPathTraversal.rb:76:19:76:26 | filename | This path depends on a $@. | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params | user-provided value |
94+
| tainted_path.rb:5:26:5:29 | path | tainted_path.rb:4:12:4:17 | call to params : | tainted_path.rb:5:26:5:29 | path | This path depends on a $@. | tainted_path.rb:4:12:4:17 | call to params | user-provided value |
95+
| tainted_path.rb:11:26:11:29 | path | tainted_path.rb:10:31:10:36 | call to params : | tainted_path.rb:11:26:11:29 | path | This path depends on a $@. | tainted_path.rb:10:31:10:36 | call to params | user-provided value |
96+
| tainted_path.rb:17:26:17:29 | path | tainted_path.rb:16:28:16:33 | call to params : | tainted_path.rb:17:26:17:29 | path | This path depends on a $@. | tainted_path.rb:16:28:16:33 | call to params | user-provided value |
97+
| tainted_path.rb:23:26:23:29 | path | tainted_path.rb:22:29:22:34 | call to params : | tainted_path.rb:23:26:23:29 | path | This path depends on a $@. | tainted_path.rb:22:29:22:34 | call to params | user-provided value |
98+
| tainted_path.rb:29:26:29:29 | path | tainted_path.rb:28:22:28:27 | call to params : | tainted_path.rb:29:26:29:29 | path | This path depends on a $@. | tainted_path.rb:28:22:28:27 | call to params | user-provided value |
99+
| tainted_path.rb:35:26:35:29 | path | tainted_path.rb:34:29:34:34 | call to params : | tainted_path.rb:35:26:35:29 | path | This path depends on a $@. | tainted_path.rb:34:29:34:34 | call to params | user-provided value |
100+
| tainted_path.rb:41:26:41:29 | path | tainted_path.rb:40:26:40:31 | call to params : | tainted_path.rb:41:26:41:29 | path | This path depends on a $@. | tainted_path.rb:40:26:40:31 | call to params | user-provided value |
101+
| tainted_path.rb:48:26:48:29 | path | tainted_path.rb:47:43:47:48 | call to params : | tainted_path.rb:48:26:48:29 | path | This path depends on a $@. | tainted_path.rb:47:43:47:48 | call to params | user-provided value |
102+
| tainted_path.rb:60:26:60:29 | path | tainted_path.rb:59:40:59:45 | call to params : | tainted_path.rb:60:26:60:29 | path | This path depends on a $@. | tainted_path.rb:59:40:59:45 | call to params | user-provided value |

‎ruby/ql/test/query-tests/security/cwe-078/CommandInjection.expected

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,15 +39,15 @@ nodes
3939
| CommandInjection.rb:82:22:82:37 | ...[...] : | semmle.label | ...[...] : |
4040
subpaths
4141
#select
42-
| CommandInjection.rb:7:10:7:15 | #{...} | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:7:10:7:15 | #{...} | This command depends on $@. | CommandInjection.rb:6:15:6:20 | call to params | a user-provided value |
43-
| CommandInjection.rb:8:16:8:18 | cmd | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:8:16:8:18 | cmd | This command depends on $@. | CommandInjection.rb:6:15:6:20 | call to params | a user-provided value |
44-
| CommandInjection.rb:10:14:10:16 | cmd | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:10:14:10:16 | cmd | This command depends on $@. | CommandInjection.rb:6:15:6:20 | call to params | a user-provided value |
45-
| CommandInjection.rb:11:17:11:22 | #{...} | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:11:17:11:22 | #{...} | This command depends on $@. | CommandInjection.rb:6:15:6:20 | call to params | a user-provided value |
46-
| CommandInjection.rb:13:9:13:14 | #{...} | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:13:9:13:14 | #{...} | This command depends on $@. | CommandInjection.rb:6:15:6:20 | call to params | a user-provided value |
47-
| CommandInjection.rb:29:19:29:24 | #{...} | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:29:19:29:24 | #{...} | This command depends on $@. | CommandInjection.rb:6:15:6:20 | call to params | a user-provided value |
48-
| CommandInjection.rb:33:24:33:36 | "echo #{...}" | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:33:24:33:36 | "echo #{...}" | This command depends on $@. | CommandInjection.rb:6:15:6:20 | call to params | a user-provided value |
49-
| CommandInjection.rb:34:39:34:51 | "grep #{...}" | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:34:39:34:51 | "grep #{...}" | This command depends on $@. | CommandInjection.rb:6:15:6:20 | call to params | a user-provided value |
50-
| CommandInjection.rb:50:24:50:36 | "echo #{...}" | CommandInjection.rb:46:15:46:20 | call to params : | CommandInjection.rb:50:24:50:36 | "echo #{...}" | This command depends on $@. | CommandInjection.rb:46:15:46:20 | call to params | a user-provided value |
51-
| CommandInjection.rb:65:14:65:29 | "echo #{...}" | CommandInjection.rb:64:18:64:23 | number : | CommandInjection.rb:65:14:65:29 | "echo #{...}" | This command depends on $@. | CommandInjection.rb:64:18:64:23 | number | a user-provided value |
52-
| CommandInjection.rb:73:14:73:34 | "echo #{...}" | CommandInjection.rb:72:23:72:33 | blah_number : | CommandInjection.rb:73:14:73:34 | "echo #{...}" | This command depends on $@. | CommandInjection.rb:72:23:72:33 | blah_number | a user-provided value |
53-
| CommandInjection.rb:82:14:82:39 | "echo #{...}" | CommandInjection.rb:81:20:81:25 | **args : | CommandInjection.rb:82:14:82:39 | "echo #{...}" | This command depends on $@. | CommandInjection.rb:81:20:81:25 | **args | a user-provided value |
42+
| CommandInjection.rb:7:10:7:15 | #{...} | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:7:10:7:15 | #{...} | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
43+
| CommandInjection.rb:8:16:8:18 | cmd | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:8:16:8:18 | cmd | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
44+
| CommandInjection.rb:10:14:10:16 | cmd | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:10:14:10:16 | cmd | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
45+
| CommandInjection.rb:11:17:11:22 | #{...} | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:11:17:11:22 | #{...} | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
46+
| CommandInjection.rb:13:9:13:14 | #{...} | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:13:9:13:14 | #{...} | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
47+
| CommandInjection.rb:29:19:29:24 | #{...} | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:29:19:29:24 | #{...} | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
48+
| CommandInjection.rb:33:24:33:36 | "echo #{...}" | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:33:24:33:36 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
49+
| CommandInjection.rb:34:39:34:51 | "grep #{...}" | CommandInjection.rb:6:15:6:20 | call to params : | CommandInjection.rb:34:39:34:51 | "grep #{...}" | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
50+
| CommandInjection.rb:50:24:50:36 | "echo #{...}" | CommandInjection.rb:46:15:46:20 | call to params : | CommandInjection.rb:50:24:50:36 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:46:15:46:20 | call to params | user-provided value |
51+
| CommandInjection.rb:65:14:65:29 | "echo #{...}" | CommandInjection.rb:64:18:64:23 | number : | CommandInjection.rb:65:14:65:29 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:64:18:64:23 | number | user-provided value |
52+
| CommandInjection.rb:73:14:73:34 | "echo #{...}" | CommandInjection.rb:72:23:72:33 | blah_number : | CommandInjection.rb:73:14:73:34 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:72:23:72:33 | blah_number | user-provided value |
53+
| CommandInjection.rb:82:14:82:39 | "echo #{...}" | CommandInjection.rb:81:20:81:25 | **args : | CommandInjection.rb:82:14:82:39 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:81:20:81:25 | **args | user-provided value |

0 commit comments

Comments
 (0)