Skip to content

Commit 40cf099

Browse files
alexrfordalexrford
authored
Merge pull request #13066 from maikypedia/maikypedia/sqli-sink-2
Ruby: Add Sequel as SQL Injection Sink
2 parents 96a720c + 7d943c7 commit 40cf099

File tree

7 files changed

+174
-0
lines changed

7 files changed

+174
-0
lines changed

‎ruby/ql/lib/change-notes/2023-05-07-sequel.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Support for the `sequel` gem has been added. Method calls that execute queries against a database that may be vulnerable to injection attacks will now be recognized.

‎ruby/ql/lib/codeql/ruby/Frameworks.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,4 @@ private import codeql.ruby.frameworks.Sinatra
3333
private import codeql.ruby.frameworks.Twirp
3434
private import codeql.ruby.frameworks.Sqlite3
3535
private import codeql.ruby.frameworks.Pg
36+
private import codeql.ruby.frameworks.Sequel

‎ruby/ql/lib/codeql/ruby/frameworks/Sequel.qll‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/**
2+
* Provides modeling for `Sequel`, the database toolkit for Ruby.
3+
* https://github.com/jeremyevans/sequel
4+
*/
5+
6+
private import ruby
7+
private import codeql.ruby.ApiGraphs
8+
private import codeql.ruby.dataflow.FlowSummary
9+
private import codeql.ruby.Concepts
10+
11+
/**
12+
* Provides modeling for `Sequel`, the database toolkit for Ruby.
13+
* https://github.com/jeremyevans/sequel
14+
*/
15+
module Sequel {
16+
/** Flow Summary for `Sequel`. */
17+
private class SqlSummary extends SummarizedCallable {
18+
SqlSummary() { this = "Sequel.connect" }
19+
20+
override MethodCall getACall() { result = any(SequelConnection c).asExpr().getExpr() }
21+
22+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
23+
input = "Argument[0]" and output = "ReturnValue" and preservesValue = false
24+
}
25+
}
26+
27+
/** A call to establish a connection to a database */
28+
private class SequelConnection extends DataFlow::CallNode {
29+
SequelConnection() {
30+
this =
31+
API::getTopLevelMember("Sequel").getAMethodCall(["connect", "sqlite", "mysql2", "jdbc"])
32+
}
33+
}
34+
35+
/** A call that constructs SQL statements */
36+
private class SequelConstruction extends SqlConstruction::Range, DataFlow::CallNode {
37+
DataFlow::Node query;
38+
39+
SequelConstruction() {
40+
this = API::getTopLevelMember("Sequel").getAMethodCall("cast") and query = this.getArgument(1)
41+
or
42+
this = API::getTopLevelMember("Sequel").getAMethodCall("function") and
43+
query = this.getArgument(0)
44+
}
45+
46+
override DataFlow::Node getSql() { result = query }
47+
}
48+
49+
/** A call that executes SQL statements against a database */
50+
private class SequelExecution extends SqlExecution::Range, DataFlow::CallNode {
51+
SequelExecution() {
52+
exists(SequelConnection sequelConnection |
53+
this =
54+
sequelConnection
55+
.getAMethodCall([
56+
"execute", "execute_ddl", "execute_dui", "execute_insert", "run", "<<", "fetch",
57+
"fetch_rows", "[]", "log_connection_yield"
58+
]) or
59+
this =
60+
sequelConnection
61+
.getAMethodCall("dataset")
62+
.getAMethodCall([
63+
"with_sql", "with_sql_all", "with_sql_delete", "with_sql_each", "with_sql_first",
64+
"with_sql_insert", "with_sql_single_value", "with_sql_update"
65+
])
66+
)
67+
}
68+
69+
override DataFlow::Node getSql() { result = this.getArgument(0) }
70+
}
71+
}

‎ruby/ql/test/library-tests/dataflow/local/TaintStep.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2815,6 +2815,7 @@
28152815
| file://:0:0:0:0 | parameter position 0 of File.realpath | file://:0:0:0:0 | [summary] to write: return (return) in File.realpath |
28162816
| file://:0:0:0:0 | parameter position 0 of Hash[] | file://:0:0:0:0 | [summary] read: argument position 0.any element in Hash[] |
28172817
| file://:0:0:0:0 | parameter position 0 of PG.new() | file://:0:0:0:0 | [summary] to write: return (return) in PG.new() |
2818+
| file://:0:0:0:0 | parameter position 0 of Sequel.connect | file://:0:0:0:0 | [summary] to write: return (return) in Sequel.connect |
28182819
| file://:0:0:0:0 | parameter position 0 of String.try_convert | file://:0:0:0:0 | [summary] to write: return (return) in String.try_convert |
28192820
| file://:0:0:0:0 | parameter position 0 of \| | file://:0:0:0:0 | [summary] read: argument position 0.any element in \| |
28202821
| file://:0:0:0:0 | parameter position 1.. of File.join | file://:0:0:0:0 | [summary] to write: return (return) in File.join |

‎ruby/ql/test/library-tests/frameworks/sequel/Sequel.expected‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
sequelSqlConstruction
2+
| sequel.rb:62:29:62:49 | call to cast | sequel.rb:62:45:62:48 | name |
3+
| sequel.rb:65:29:65:49 | call to function | sequel.rb:65:45:65:48 | name |
4+
sequelSqlExecution
5+
| sequel.rb:9:9:9:60 | ...[...] | sequel.rb:9:14:9:59 | "SELECT * FROM users WHERE use..." |
6+
| sequel.rb:12:9:12:64 | call to run | sequel.rb:12:18:12:63 | "SELECT * FROM users WHERE use..." |
7+
| sequel.rb:15:9:17:11 | call to fetch | sequel.rb:15:20:15:65 | "SELECT * FROM users WHERE use..." |
8+
| sequel.rb:20:9:20:65 | ...[...] | sequel.rb:20:14:20:64 | "SELECT * FROM users WHERE use..." |
9+
| sequel.rb:23:9:23:65 | call to execute | sequel.rb:23:22:23:65 | "SELECT * FROM users WHERE use..." |
10+
| sequel.rb:26:9:26:71 | call to execute_ddl | sequel.rb:26:26:26:71 | "SELECT * FROM users WHERE use..." |
11+
| sequel.rb:29:9:29:71 | call to execute_dui | sequel.rb:29:26:29:71 | "SELECT * FROM users WHERE use..." |
12+
| sequel.rb:32:9:32:74 | call to execute_insert | sequel.rb:32:29:32:74 | "SELECT * FROM users WHERE use..." |
13+
| sequel.rb:35:9:35:62 | ... << ... | sequel.rb:35:17:35:62 | "SELECT * FROM users WHERE use..." |
14+
| sequel.rb:38:9:38:79 | call to fetch_rows | sequel.rb:38:25:38:70 | "SELECT * FROM users WHERE use..." |
15+
| sequel.rb:41:9:41:81 | call to with_sql_all | sequel.rb:41:35:41:80 | "SELECT * FROM users WHERE use..." |
16+
| sequel.rb:44:9:44:84 | call to with_sql_delete | sequel.rb:44:38:44:83 | "SELECT * FROM users WHERE use..." |
17+
| sequel.rb:47:9:47:90 | call to with_sql_each | sequel.rb:47:36:47:81 | "SELECT * FROM users WHERE use..." |
18+
| sequel.rb:50:9:50:83 | call to with_sql_first | sequel.rb:50:37:50:82 | "SELECT * FROM users WHERE use..." |
19+
| sequel.rb:53:9:53:84 | call to with_sql_insert | sequel.rb:53:38:53:83 | "SELECT * FROM users WHERE use..." |
20+
| sequel.rb:56:9:56:90 | call to with_sql_single_value | sequel.rb:56:44:56:89 | "SELECT * FROM users WHERE use..." |
21+
| sequel.rb:59:9:59:84 | call to with_sql_update | sequel.rb:59:38:59:83 | "SELECT * FROM users WHERE use..." |
22+
| sequel.rb:62:9:62:20 | ...[...] | sequel.rb:62:14:62:19 | :table |
23+
| sequel.rb:65:9:65:20 | ...[...] | sequel.rb:65:14:65:19 | :table |

‎ruby/ql/test/library-tests/frameworks/sequel/Sequel.ql‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
private import codeql.ruby.DataFlow
2+
private import codeql.ruby.Concepts
3+
private import codeql.ruby.frameworks.Sequel
4+
5+
query predicate sequelSqlConstruction(SqlConstruction c, DataFlow::Node sql) { sql = c.getSql() }
6+
7+
query predicate sequelSqlExecution(SqlExecution e, DataFlow::Node sql) { sql = e.getSql() }

‎ruby/ql/test/library-tests/frameworks/sequel/sequel.rb‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
require 'sequel'
2+
3+
class UsersController < ActionController::Base
4+
def sequel_handler(event:, context:)
5+
name = params[:name]
6+
conn = Sequel.sqlite("sqlite://example.db")
7+
8+
# BAD: SQL statement constructed from user input
9+
conn["SELECT * FROM users WHERE username='#{name}'"]
10+
11+
# BAD: SQL statement constructed from user input
12+
conn.run("SELECT * FROM users WHERE username='#{name}'")
13+
14+
# BAD: SQL statement constructed from user input
15+
conn.fetch("SELECT * FROM users WHERE username='#{name}'") do |row|
16+
puts row[:name]
17+
end
18+
19+
# GOOD: SQL statement is not constructed from user input
20+
conn["SELECT * FROM users WHERE username='im_not_input'"]
21+
22+
# BAD: SQL statement constructed from user input
23+
conn.execute "SELECT * FROM users WHERE username=#{name}"
24+
25+
# BAD: SQL statement constructed from user input
26+
conn.execute_ddl "SELECT * FROM users WHERE username='#{name}'"
27+
28+
# BAD: SQL statement constructed from user input
29+
conn.execute_dui "SELECT * FROM users WHERE username='#{name}'"
30+
31+
# BAD: SQL statement constructed from user input
32+
conn.execute_insert "SELECT * FROM users WHERE username='#{name}'"
33+
34+
# BAD: SQL statement constructed from user input
35+
conn << "SELECT * FROM users WHERE username='#{name}'"
36+
37+
# BAD: SQL statement constructed from user input
38+
conn.fetch_rows("SELECT * FROM users WHERE username='#{name}'"){|row| }
39+
40+
# BAD: SQL statement constructed from user input
41+
conn.dataset.with_sql_all("SELECT * FROM users WHERE username='#{name}'")
42+
43+
# BAD: SQL statement constructed from user input
44+
conn.dataset.with_sql_delete("SELECT * FROM users WHERE username='#{name}'")
45+
46+
# BAD: SQL statement constructed from user input
47+
conn.dataset.with_sql_each("SELECT * FROM users WHERE username='#{name}'"){|row| }
48+
49+
# BAD: SQL statement constructed from user input
50+
conn.dataset.with_sql_first("SELECT * FROM users WHERE username='#{name}'")
51+
52+
# BAD: SQL statement constructed from user input
53+
conn.dataset.with_sql_insert("SELECT * FROM users WHERE username='#{name}'")
54+
55+
# BAD: SQL statement constructed from user input
56+
conn.dataset.with_sql_single_value("SELECT * FROM users WHERE username='#{name}'")
57+
58+
# BAD: SQL statement constructed from user input
59+
conn.dataset.with_sql_update("SELECT * FROM users WHERE username='#{name}'")
60+
61+
# BAD: SQL statement constructed from user input
62+
conn[:table].select(Sequel.cast(:a, name))
63+
64+
# BAD: SQL statement constructed from user input
65+
conn[:table].select(Sequel.function(name))
66+
end
67+
end

0 commit comments

Comments
 (0)