Class: Scanny::Checks::ShellExpandingMethodsCheck

Inherits:
Check
  • Object
show all
Defined in:
lib/scanny/checks/shell_expanding_methods_check.rb

Overview

Checks for methods executing external commands that pass the command through shell expansion. This can cause unwanted code execution if the command includes unescaped input.

Instance Method Summary collapse

Methods inherited from Check

#compiled_pattern, #issue, #strict?, #visit

Instance Method Details

#check(node) ⇒ Object 



15
16
17
18
19
 
# File 'lib/scanny/checks/shell_expanding_methods_check.rb', line 15

def check(node)
  # The command goes through shell expansion only if it is passed as one
  # argument.
  issue :high, warning_message(node), :cwe => [88, 78]
end

#pattern ⇒ Object 



7
8
9
10
11
12
13
 
# File 'lib/scanny/checks/shell_expanding_methods_check.rb', line 7

def pattern
  [
    pattern_shell_expanding,
    pattern_popen,
    pattern_execute_string
  ].join("|")
end

#pattern_execute_string ⇒ Object

‘system_command`



49
50
51
 
# File 'lib/scanny/checks/shell_expanding_methods_check.rb', line 49

def pattern_execute_string
  "ExecuteString"
end

#pattern_popen ⇒ Object

IO.popen IO.popen3



39
40
41
42
43
44
45
46
 
# File 'lib/scanny/checks/shell_expanding_methods_check.rb', line 39

def pattern_popen
  <<-EOT
    SendWithArguments<
      name ^= :popen,
      arguments = ActualArguments<array = [any]>
    >
  EOT
end

#pattern_shell_expanding ⇒ Object

system(“rm -rf /”)



27
28
29
30
31
32
33
34
35
 
# File 'lib/scanny/checks/shell_expanding_methods_check.rb', line 27

def pattern_shell_expanding
  <<-EOT
    SendWithArguments<
      receiver  = Self | ConstantAccess<name = :Kernel>,
      name      = :` | :exec | :system | :spawn,
      arguments = ActualArguments<array = [any]>
    >
  EOT
end

#warning_message(node = nil) ⇒ Object 



21
22
23
24
 
# File 'lib/scanny/checks/shell_expanding_methods_check.rb', line 21

def warning_message(node = nil)
  name = node.respond_to?(:name) ? node.name : "`"
  "The \"#{name}\" method passes the executed command through shell expansion."
end