Ruby: Add Module#const_get as a code execution #7419
Conversation
| */ | ||
| class ModuleConstGetCallCodeExecution extends CodeExecution::Range, DataFlow::CallNode { | ||
| ModuleConstGetCallCodeExecution() { | ||
| this.asExpr().getExpr().(UnknownMethodCall).getMethodName() = "const_get" |
There was a problem hiding this comment.
I'm a little unsure about casting to UnknownMethodCall. Is the idea that all bets are off if the project redefines Module#const_get?
There was a problem hiding this comment.
As far as I know, going via UnknownMethodCall is currently the only way to identify calls to methods inherited from Module, Object, Kernel etc. I think to do better, we'd need to improve API graphs with subclass/inheritance knowledge so that it can determine that something like
module Foo
const_get "A"
end
is a call to Module#const_get.
So that's the reason I used UnknownMethodCall here. I hadn't thought about the case where the project redefines const_get - I think that should be quite rare, though?
There was a problem hiding this comment.
OK, that makes sense.
I think that should be quite rare, though?
Yeah, I expect so.
Module#const_get takes a single string argument and interprets it as the
name of a constant. It then looks up the constant and returns its value.
Object.const_get("Math::PI")
# => 3.141592653589793
By itself, this method is not as dangerous as e.g. eval, but if the
value returned is a class that is then instantiated, this can allow an
attacker to instantiate arbitrary Ruby classes.
As a result, I think it's safe to say that any remote input flowing into
this call is a potential vulnerability. A real-world example of this is
GHSA-52p9-v744-mwjj.
Module#const_gettakes a single string argument and interprets it as thename of a constant. It then looks up the constant and returns its value.
By itself, this method is not as dangerous as e.g.
eval, but if thevalue returned is a class that is then instantiated, this can allow an
attacker to instantiate arbitrary Ruby classes.
As a result, I think it's safe to say that any remote input flowing into
this call is a potential vulnerability. A real-world example of this is
GHSA-52p9-v744-mwjj.
The text was updated successfully, but these errors were encountered: