Class: Spektr::Checks::CommandInjection

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/command_injection.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #full_receiver, #model_attribute?, #receivers_for, #should_run?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ CommandInjection

Returns a new instance of CommandInjection.



4
5
6
7
8
9
 
# File 'lib/spektr/checks/command_injection.rb', line 4

def initialize(app, target)
  super
  @name = "Command Injection"
  @type = "Command Injection"
  @targets = ["Spektr::Targets::Base", "Spektr::Targets::Controller", "Spektr::Targets::Model", "Spektr::Targets::Routes", "Spektr::Targets::View"]
end

Instance Method Details

#check_calls(calls) ⇒ Object 



33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/spektr/checks/command_injection.rb', line 33

def check_calls(calls)
  # TODO: might need to exclude tempfile and ActiveStorage::Filename
  return if calls.empty?
  calls.each do |call|
    if call.arguments.is_a?(Prism::ArgumentsNode)
      argument = call.arguments.arguments.first
    else
      argument = call.arguments.first
    end
    next unless argument
    if user_input?(argument) || model_attribute?(argument)
      warn! @target, self, call.location, "Command injection in #{call.name}"
    # TODO: interpolation, but might be safe, we should make this better
    elsif argument.type == :embedded_statements_node
      warn! @target, self, call.location, "Command injection in #{call.name}", :low
    end
  end
end

#run ⇒ Object 



11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
 
# File 'lib/spektr/checks/command_injection.rb', line 11

def run
  return unless super
  # backticks
  @target.interpolated_xstrings.each do |call|
    call.parts.each do |part|
      if user_input?(part)
        warn! @target, self, call.location, "Command injection"
      end
    end
  end

  targets = [:IO, :Open3, :Kernel, :Spawn, :Process, false]
  methods = [:capture2, :capture2e, :capture3, :exec, :pipeline, :pipeline_r,
  :pipeline_rw, :pipeline_start, :pipeline_w, :popen, :popen2, :popen2e,
  :popen3, :spawn, :syscall, :system, :open]
  targets.each do |target|
    methods.each do |method|
      check_calls(@target.find_calls(method, target))
    end
  end
end