-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Ruby: Add YAML unsafe deserialization sinks #13307
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 17 commits
Commits
Show all changes
18 commits
Select commit
Hold shift + click to select a range
486a5ac
v1
am0o0 e4b8a0e
v1.1
am0o0 d96153a
v1.2 change to PascalCase
am0o0 0e343e5
v1.3
am0o0 0521ffe
v1.4 correct dirs uppercase issue
am0o0 4360a56
v2 add plist.parse_xml as a dangerous sink and enhancements on documents
am0o0 b9296d3
v2.1 fix file names
am0o0 ad7e107
add the new YAML/PLIST sinks into the existing rb/unsafe-deserializat…
am0o0 e76ed94
v3 add global taint steps for to_ruby of YAML/Psych
am0o0 335441c
v4: make variable names camelCase, some inhancement, remove some dupl…
am0o0 40e24b6
v4.1 fix file names in qhelp
am0o0 d727d57
v4.2 write exact version of yaml.load default loader change
am0o0 b8c3cba
Ruby: Consolidate unsafe deserialization queries
hmac 562065f
Ruby: Add change note
hmac e515981
Ruby: Remove unused examples
hmac ca1024e
Ruby: Reword unsafe deserialization qhelp
hmac e70e3e5
Ruby: fix typo in qhelp
hmac 7324d17
Merge branch 'main' into amammad-ruby-YAMLunsafeLoad
aibaars File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
4 changes: 4 additions & 0 deletions
4
ruby/ql/lib/change-notes/2023-05-27-unsafe-deserialization.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * Additional sinks for `rb/unsafe-deserialization` have been added. This includes various methods from the `yaml` and `plist` gems, which deserialize YAML and Property List data, respectively. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| /** | ||
| * Provides modeling for the `YAML` and `Psych` libraries. | ||
| */ | ||
|
|
||
| private import codeql.ruby.dataflow.FlowSteps | ||
| private import codeql.ruby.DataFlow | ||
| private import codeql.ruby.ApiGraphs | ||
|
|
||
| /** | ||
| * A taint step related to the result of `YAML.parse` calls, or similar. | ||
| * In the following example, this step will propagate taint from | ||
| * `source` to `sink`: | ||
| * | ||
| * ```rb | ||
| * x = source | ||
| * result = YAML.parse(x) | ||
| * sink result.to_ruby # Unsafe call | ||
| * ``` | ||
| */ | ||
| private class YamlParseStep extends AdditionalTaintStep { | ||
| override predicate step(DataFlow::Node pred, DataFlow::Node succ) { | ||
| exists(DataFlow::CallNode yamlParserMethod | | ||
| succ = yamlParserMethod.getAMethodCall("to_ruby") and | ||
| ( | ||
| yamlParserMethod = yamlNode().getAMethodCall(["parse", "parse_stream"]) and | ||
| pred = [yamlParserMethod.getArgument(0), yamlParserMethod.getKeywordArgument("yaml")] | ||
| or | ||
| yamlParserMethod = yamlNode().getAMethodCall("parse_file") and | ||
| pred = [yamlParserMethod.getArgument(0), yamlParserMethod.getKeywordArgument("filename")] | ||
| ) | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| private API::Node yamlNode() { result = API::getTopLevelMember(["YAML", "Psych"]) } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
13 changes: 13 additions & 0 deletions
13
...ql/test/query-tests/security/cwe-502/unsafe-deserialization/PlistUnsafeDeserialization.rb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| require 'yaml' | ||
| class UsersController < ActionController::Base | ||
| def example | ||
| # not safe | ||
| result = Plist.parse_xml(params[:yaml_string]) | ||
| result = Plist.parse_xml(params[:yaml_string], marshal: true) | ||
|
|
||
| # safe | ||
| result = Plist.parse_xml(params[:yaml_string], marshal: false) | ||
| end | ||
| end | ||
|
|
||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
22 changes: 22 additions & 0 deletions
22
.../ql/test/query-tests/security/cwe-502/unsafe-deserialization/YAMLUnsafeDeserialization.rb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| require 'yaml' | ||
| class UsersController < ActionController::Base | ||
| def example | ||
| # safe | ||
| Psych.load(params[:yaml_string]) | ||
| Psych.load_file(params[:yaml_file]) | ||
| Psych.parse_stream(params[:yaml_string]) | ||
| Psych.parse(params[:yaml_string]) | ||
| Psych.parse_file(params[:yaml_file]) | ||
| # unsafe | ||
| Psych.unsafe_load(params[:yaml_string]) | ||
| Psych.unsafe_load_file(params[:yaml_file]) | ||
| Psych.load_stream(params[:yaml_string]) | ||
| parse_output = Psych.parse_stream(params[:yaml_string]) | ||
| parse_output.to_ruby | ||
| Psych.parse(params[:yaml_string]).to_ruby | ||
| Psych.parse_file(params[:yaml_file]).to_ruby | ||
|
|
||
| end | ||
| end | ||
|
|
||
|
|
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
according to #12301 (comment)
I didn't write following predicate correctly, I think it should be two separate steps:
1.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure about that - the second step should only apply when the return value of
YAML.parse(x)flows tosource, right? We could addto_rubyas a global taint-preserving step but I think that could result in false positives where some other class defines ato_rubymethod. I've requested a review from others in the team; we'll see what they say.Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yes second one can have FP,
please consider the following example too, if you like I can try to write an additional step for such a pattern too:
https://github.com/Shopify/krane/blob/0e1a3a0651ca4a0b234722ea98dae74ca8c65351/lib/krane/renderer.rb#L61-L67
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think adding a separate taint step for the
to_rubymethod makes sense. However, let's leave that for a followup pull request in which we can investigate the impact a bit. I would expectto_rubymethods from other libraries to be mostly taint-preserving too, but we might be mistaken.