Skip to content

Commit 7c5c8b0

Browse files
andrewandrew
authored
Merge pull request #27 from git-pkgs/seed-framework-orm-sinks
Seed sinks for web frameworks and ORMs
2 parents cd23b96 + fe27838 commit 7c5c8b0

47 files changed

Lines changed: 1240 additions & 12 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎detect/threat_test.go‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -292,26 +292,38 @@ func TestSinksRubyProject(t *testing.T) {
292292
sr := engine.Sinks(r)
293293

294294
if len(sr.Sinks) == 0 {
295-
t.Fatal("expected sinks from Ruby language def")
295+
t.Fatal("expected sinks from detected tools")
296296
}
297297

298-
// All sinks in this fixture come from Ruby (only ruby/language.toml has sinks).
299-
bySymbol := make(map[string]brief.SinkEntry)
298+
// Index by tool+symbol since multiple tools can have a sink with the same name.
299+
type key struct{ tool, symbol string }
300+
idx := make(map[key]brief.SinkEntry)
300301
for _, s := range sr.Sinks {
301-
if s.Tool != "Ruby" {
302-
t.Errorf("unexpected sink from %q: %v", s.Tool, s)
303-
}
304-
bySymbol[s.Symbol] = s
302+
idx[key{s.Tool, s.Symbol}] = s
305303
}
306304

307-
if e, ok := bySymbol["eval"]; !ok {
308-
t.Error("expected eval sink")
305+
// Ruby stdlib sinks
306+
if e, ok := idx[key{"Ruby", "eval"}]; !ok {
307+
t.Error("expected Ruby eval sink")
309308
} else if e.Threat != "code_injection" || e.CWE != "CWE-95" {
310-
t.Errorf("eval sink = %+v", e)
309+
t.Errorf("Ruby eval sink = %+v", e)
310+
}
311+
if _, ok := idx[key{"Ruby", "Marshal.load"}]; !ok {
312+
t.Error("expected Ruby Marshal.load sink")
313+
}
314+
315+
// Rails framework sinks
316+
if e, ok := idx[key{"Rails", "html_safe"}]; !ok {
317+
t.Error("expected Rails html_safe sink")
318+
} else if e.Threat != "xss" {
319+
t.Errorf("Rails html_safe threat = %q, want xss", e.Threat)
311320
}
312321

313-
if _, ok := bySymbol["Marshal.load"]; !ok {
314-
t.Error("expected Marshal.load sink")
322+
// ActiveRecord ORM sinks
323+
if e, ok := idx[key{"ActiveRecord", "find_by_sql"}]; !ok {
324+
t.Error("expected ActiveRecord find_by_sql sink")
325+
} else if e.Threat != "sql_injection" {
326+
t.Errorf("ActiveRecord find_by_sql threat = %q, want sql_injection", e.Threat)
315327
}
316328
}
317329

‎knowledge/elixir/ecto.toml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,31 @@ run = "mix ecto.migrate"
2020
role = ["library"]
2121
function = ["data-mapping", "validation"]
2222
layer = ["data-layer"]
23+
24+
[[security.sinks]]
25+
symbol = "Repo.query"
26+
threat = "sql_injection"
27+
cwe = "CWE-89"
28+
note = "With interpolation; $1 placeholders are safe"
29+
30+
[[security.sinks]]
31+
symbol = "Repo.query!"
32+
threat = "sql_injection"
33+
cwe = "CWE-89"
34+
35+
[[security.sinks]]
36+
symbol = "fragment"
37+
threat = "sql_injection"
38+
cwe = "CWE-89"
39+
note = "With ^ pinned interpolation outside the fragment"
40+
41+
[[security.sinks]]
42+
symbol = "Ecto.Adapters.SQL.query"
43+
threat = "sql_injection"
44+
cwe = "CWE-89"
45+
46+
[[security.sinks]]
47+
symbol = "cast"
48+
threat = "mass_assignment"
49+
cwe = "CWE-915"
50+
note = "Without explicit field allowlist as second arg"

‎knowledge/elixir/phoenix.toml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,31 @@ role = ["framework"]
2323
function = ["api-development", "templating"]
2424
layer = ["backend", "full-stack"]
2525
domain = ["web-development"]
26+
27+
[[security.sinks]]
28+
symbol = "raw"
29+
threat = "xss"
30+
cwe = "CWE-79"
31+
note = "Phoenix.HTML.raw bypasses escaping"
32+
33+
[[security.sinks]]
34+
symbol = "safe_to_string"
35+
threat = "xss"
36+
cwe = "CWE-79"
37+
38+
[[security.sinks]]
39+
symbol = "redirect"
40+
threat = "open_redirect"
41+
cwe = "CWE-601"
42+
note = "With external: target"
43+
44+
[[security.sinks]]
45+
symbol = "send_file"
46+
threat = "path_traversal"
47+
cwe = "CWE-22"
48+
note = "Plug.Conn.send_file"
49+
50+
[[security.sinks]]
51+
symbol = "send_download"
52+
threat = "path_traversal"
53+
cwe = "CWE-22"

‎knowledge/go/echo.toml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,29 @@ role = ["framework"]
1818
function = ["api-development"]
1919
layer = ["backend"]
2020
domain = ["web-development"]
21+
22+
[[security.sinks]]
23+
symbol = "c.HTML"
24+
threat = "xss"
25+
cwe = "CWE-79"
26+
note = "Renders raw HTML string"
27+
28+
[[security.sinks]]
29+
symbol = "c.HTMLBlob"
30+
threat = "xss"
31+
cwe = "CWE-79"
32+
33+
[[security.sinks]]
34+
symbol = "c.Redirect"
35+
threat = "open_redirect"
36+
cwe = "CWE-601"
37+
38+
[[security.sinks]]
39+
symbol = "c.File"
40+
threat = "path_traversal"
41+
cwe = "CWE-22"
42+
43+
[[security.sinks]]
44+
symbol = "c.Attachment"
45+
threat = "path_traversal"
46+
cwe = "CWE-22"

‎knowledge/go/ent.toml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,15 @@ files = ["ent/schema/"]
2121

2222
[taxonomy]
2323
function = ["code-generation"]
24+
25+
[[security.sinks]]
26+
symbol = "sql.Raw"
27+
threat = "sql_injection"
28+
cwe = "CWE-89"
29+
note = "Generated code is safe; raw escape hatch is not"
30+
31+
[[security.sinks]]
32+
symbol = "ExecContext"
33+
threat = "sql_injection"
34+
cwe = "CWE-89"
35+
note = "Direct driver access"

‎knowledge/go/fiber.toml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,24 @@ role = ["framework"]
1818
function = ["api-development"]
1919
layer = ["backend"]
2020
domain = ["web-development"]
21+
22+
[[security.sinks]]
23+
symbol = "c.SendString"
24+
threat = "xss"
25+
cwe = "CWE-79"
26+
note = "When Content-Type is text/html"
27+
28+
[[security.sinks]]
29+
symbol = "c.Redirect"
30+
threat = "open_redirect"
31+
cwe = "CWE-601"
32+
33+
[[security.sinks]]
34+
symbol = "c.SendFile"
35+
threat = "path_traversal"
36+
cwe = "CWE-22"
37+
38+
[[security.sinks]]
39+
symbol = "c.Download"
40+
threat = "path_traversal"
41+
cwe = "CWE-22"

‎knowledge/go/gin.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,30 @@ role = ["framework"]
1717
function = ["api-development"]
1818
layer = ["backend"]
1919
domain = ["web-development"]
20+
21+
[[security.sinks]]
22+
symbol = "c.String"
23+
threat = "xss"
24+
cwe = "CWE-79"
25+
note = "No HTML escaping; use c.HTML for templated output"
26+
27+
[[security.sinks]]
28+
symbol = "c.Data"
29+
threat = "xss"
30+
cwe = "CWE-79"
31+
note = "When Content-Type is text/html"
32+
33+
[[security.sinks]]
34+
symbol = "c.Redirect"
35+
threat = "open_redirect"
36+
cwe = "CWE-601"
37+
38+
[[security.sinks]]
39+
symbol = "c.File"
40+
threat = "path_traversal"
41+
cwe = "CWE-22"
42+
43+
[[security.sinks]]
44+
symbol = "c.FileAttachment"
45+
threat = "path_traversal"
46+
cwe = "CWE-22"

‎knowledge/go/gorm.toml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,42 @@ ecosystems = ["go"]
1616
role = ["library"]
1717
function = ["data-mapping"]
1818
layer = ["data-layer"]
19+
20+
[[security.sinks]]
21+
symbol = "Raw"
22+
threat = "sql_injection"
23+
cwe = "CWE-89"
24+
note = "db.Raw with Sprintf; placeholders are safe"
25+
26+
[[security.sinks]]
27+
symbol = "Exec"
28+
threat = "sql_injection"
29+
cwe = "CWE-89"
30+
31+
[[security.sinks]]
32+
symbol = "Where"
33+
threat = "sql_injection"
34+
cwe = "CWE-89"
35+
note = "With Sprintf string; struct/map forms are safe"
36+
37+
[[security.sinks]]
38+
symbol = "Order"
39+
threat = "sql_injection"
40+
cwe = "CWE-89"
41+
note = "Column name not parameterizable"
42+
43+
[[security.sinks]]
44+
symbol = "Select"
45+
threat = "sql_injection"
46+
cwe = "CWE-89"
47+
note = "With string from user input"
48+
49+
[[security.sinks]]
50+
symbol = "Group"
51+
threat = "sql_injection"
52+
cwe = "CWE-89"
53+
54+
[[security.sinks]]
55+
symbol = "Having"
56+
threat = "sql_injection"
57+
cwe = "CWE-89"

‎knowledge/go/pgx.toml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,19 @@ ecosystems = ["go"]
1414
role = ["library"]
1515
function = ["data-mapping"]
1616
layer = ["data-layer"]
17+
18+
[[security.sinks]]
19+
symbol = "Query"
20+
threat = "sql_injection"
21+
cwe = "CWE-89"
22+
note = "When query built via Sprintf; use $1 placeholders"
23+
24+
[[security.sinks]]
25+
symbol = "QueryRow"
26+
threat = "sql_injection"
27+
cwe = "CWE-89"
28+
29+
[[security.sinks]]
30+
symbol = "Exec"
31+
threat = "sql_injection"
32+
cwe = "CWE-89"

‎knowledge/go/sqlx.toml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,29 @@ ecosystems = ["go"]
1414
role = ["library"]
1515
function = ["data-mapping"]
1616
layer = ["data-layer"]
17+
18+
[[security.sinks]]
19+
symbol = "Query"
20+
threat = "sql_injection"
21+
cwe = "CWE-89"
22+
note = "When query built via Sprintf; use bindvars"
23+
24+
[[security.sinks]]
25+
symbol = "Queryx"
26+
threat = "sql_injection"
27+
cwe = "CWE-89"
28+
29+
[[security.sinks]]
30+
symbol = "Exec"
31+
threat = "sql_injection"
32+
cwe = "CWE-89"
33+
34+
[[security.sinks]]
35+
symbol = "Get"
36+
threat = "sql_injection"
37+
cwe = "CWE-89"
38+
39+
[[security.sinks]]
40+
symbol = "Select"
41+
threat = "sql_injection"
42+
cwe = "CWE-89"

0 commit comments

Comments
 (0)