Ruby: add regex injection query #6978
Conversation
|
QHelp previews: ruby/ql/src/queries/security/cwe-1333/RegExpInjection.qhelp |
|
QHelp previews: ruby/ql/src/queries/security/cwe-1333/RegExpInjection.qhelpRegular expression injectionConstructing a regular expression with unsanitized user input is dangerous, since a malicious user may be able to modify the meaning of the expression. In particular, such a user may be able to provide a regular expression fragment that takes exponential time in the worst case, and use that to perform a Denial of Service attack. RecommendationBefore embedding user input into a regular expression, use a sanitization function such as ExampleThe following examples construct regular expressions from an HTTP request parameter without sanitizing it first: class UsersController < ActionController::Base
def first_example
# BAD: Unsanitized user input is used to construct a regular expression
regex = /#{ params[:key] }/
end
def second_example
# BAD: Unsanitized user input is used to construct a regular expression
regex = Regexp.new(params[:key])
end
endInstead, the request parameter should be sanitized first. This ensures that the user cannot insert characters that have special meanings in regular expressions. class UsersController < ActionController::Base
def example
# GOOD: User input is sanitized before constructing the regular expression
regex = Regexp.new(Regex.escape(params[:key]))
end
endReferences
|
|
I still need to get a successful DCA run to check performance, but otherwise I think this ready for review. |
|
QHelp previews: ruby/ql/src/queries/security/cwe-1333/RegExpInjection.qhelpRegular expression injectionConstructing a regular expression with unsanitized user input is dangerous, since a malicious user may be able to modify the meaning of the expression. In particular, such a user may be able to provide a regular expression fragment that takes exponential time in the worst case, and use that to perform a Denial of Service attack. RecommendationBefore embedding user input into a regular expression, use a sanitization function such as ExampleThe following examples construct regular expressions from an HTTP request parameter without sanitizing it first: class UsersController < ActionController::Base
def first_example
# BAD: Unsanitized user input is used to construct a regular expression
regex = /#{ params[:key] }/
end
def second_example
# BAD: Unsanitized user input is used to construct a regular expression
regex = Regexp.new(params[:key])
end
endInstead, the request parameter should be sanitized first. This ensures that the user cannot insert characters that have special meanings in regular expressions. class UsersController < ActionController::Base
def example
# GOOD: User input is sanitized before constructing the regular expression
regex = Regexp.new(Regex.escape(params[:key]))
end
endReferences
|
No description provided.
The text was updated successfully, but these errors were encountered: