fix(ruby): only consider inline disposition as xss for send_data (#358)

Bearer · Apr 2, 2024 · 0a40950 · 0a40950
1 parent 43741ab
commit 0a40950
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 3 deletions.
diff --git a/rules/ruby/rails/render_using_user_input.yml b/rules/ruby/rails/render_using_user_input.yml
@@ -15,11 +15,23 @@ patterns:
       - variable: USER_INPUT
         detection: ruby_shared_common_html_user_input
         scope: result
-  - pattern: send_data($<USER_INPUT>$<...>)
+  - pattern: |
+      send_data($<USER_INPUT>, disposition: $<DISPOSITION>)
     filters:
       - variable: USER_INPUT
         detection: ruby_shared_common_html_user_input
         scope: result
+      - not:
+          variable: DISPOSITION
+          detection: ruby_rails_render_using_user_input_attachment
+          scope: cursor
+auxiliary:
+  - id: ruby_rails_render_using_user_input_attachment
+    patterns:
+      - pattern: $<VALUE>
+        filters:
+          - variable: VALUE
+            string_regex: \Aattachment\z
 severity: high
 metadata:
   description: "Unsanitized user input in raw HTML strings (XSS)"

diff --git a/tests/ruby/rails/render_using_user_input/testdata/ok_not_unsafe.rb b/tests/ruby/rails/render_using_user_input/testdata/ok_not_unsafe.rb
@@ -4,4 +4,5 @@
 render html: sanitize(params[:oops])
 render inline: "<h1>#{strip_tags(params[:oops])}</h1>"
 
-send_data "ok", type: content_type
+send_data params[:user_input], type: content_type
+send_data params[:user_input], type: content_type, disposition: "attachment"
diff --git a/tests/ruby/rails/render_using_user_input/testdata/unsafe.rb b/tests/ruby/rails/render_using_user_input/testdata/unsafe.rb
@@ -4,4 +4,6 @@
 render inline: "<h1>#{params[:oops]}</h1>"
 
 # bearer:expected ruby_rails_render_using_user_input
-send_data params[:oops], type: content_type
+send_data params[:user_input], type: content_type, disposition: "inline"
+# bearer:expected ruby_rails_render_using_user_input
+send_data params[:user_input], type: content_type, disposition: unknown