Ruby: add `rb/sensitive-get-query` query by alexrford · Pull Request #10369 · github/codeql

alexrford · 2022-09-10T16:48:42Z

Finds cases where an HTTP GET request handler takes sensitive input, such as a password or other credential, from the query string of the request. The bulk of this PR concerns porting SensitiveNode to Ruby.

This uses for HTTP::Server::RequestHandlers, which is currently implemented for Rails ActionController and the ruby graphql gem. In the case of GraphQL, both POST and GET requests are by default both accepted and handled uniformly - the string getAnHttpMethod() implementation is trivial here as I couldn't find a documented way to change this behaviour.

github-actions · 2022-09-10T16:49:42Z

QHelp previews:

ruby/ql/src/queries/security/cwe-598/SensitiveGetQuery.qhelp

Sensitive data read from GET request

Sensitive information such as passwords should not be transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing sensitive information into the URL therefore increases the risk that it will be captured by an attacker.

Recommendation

Use HTTP POST to send sensitive information as part of the request body; for example, as form data.

Example

The following example shows two route handlers that both receive a username and a password. The first receives this sensitive information from the query parameters of a GET request, which is transmitted in the URL. The second receives this sensitive information from the request body of a POST request.

Rails.application.routes.draw do
  get "users/login", to: "#login_get" # BAD: sensitive data transmitted through query parameters
  post "users/login", to: "users#login_post" # GOOD: sensitive data transmitted in the request body
end

class UsersController < ActionController::Base
  def login_get
    password = params[:password]
    authenticate_user(params[:username], password)
  end

  def login_post
    password = params[:password]
    authenticate_user(params[:username], password)
  end

  private
  def authenticate_user(username, password)
    # ... authenticate the user here
  end
end

References

CWE: CWE-598: Use of GET Request Method with Sensitive Query Strings
PortSwigger (Burp): Password Submitted using GET Method
OWASP: Information Exposure through Query Strings in URL
Common Weakness Enumeration: CWE-598.

…nsitive

hmac

This looks good to me. I have a few small comments and I also think we should do a DCA run, but otherwise 👍.

hmac · 2022-09-22T16:06:15Z

+  |
+    localFlowWithElementReference(mid, to)
+  )
+}


Would a normal dataflow configuration-style query work here? Or is local flow a better choice?

I should probably try this out with a full TaintTracking configuration as well to see if there's any difference in performance or results. In the JS version it seems like using global dataflow/taint tracking didn't improve results, but this may be different for Ruby. FWIW Java uses full taint tracking for its version of this query.

hmac · 2022-09-22T16:08:24Z

+  CredentialsMethodName() { nameIndicatesSensitiveData(this, classification) }
+
+  override SensitiveDataClassification getClassification() { result = classification }
+}


Since we've ported this from the JS version, it makes me wonder: is there value in these abstract classes being part of some shared Concept? It's a lot of extra work so I'm ok if we don't do it now, but it might be worth talking about.

Yeah, I think that would be sensible. When I was working on this PR I ran into some issues where the JS version of this class had been moved from the AST layer to the DataFlow layer. I only noticed this change by chance, but it would have been easier to notice and stay synched on if there had been some shared Concept used by both.

hmac · 2022-09-22T16:09:42Z


  override string getFramework() { result = "ActionController" }

+  override string getAnHttpMethod() { result = this.getARoute().getHttpMethod() }


Nice to see that the routes modelling is coming in useful in some places!

…tern

…e-get-query (should not be flagged)

alexrford · 2022-10-05T12:40:04Z

Finally got around to updating this PR. There are a couple of main changes:

Switched to using full taint tracking rather than local flow. I've kicked off a DCA run to see how this affects results/performance. I've used the Query/Customization pattern to implement this, which leaves us with an unfortunately named SensitiveGetQueryQuery.qll library. I converted the query to a path-problem as part of this change, which is not consistent with the JS version, but it seems worth using the path graph if we have it.
Fixed an issue where data from headers in the request headers were also treated as if they were transmitted as plaintext, where the other versions of this query are correctly limited to just query params. This required adding a string RequestInputAccess#getKind() predicate.

alexrford · 2022-10-05T17:47:44Z

I've rolled the taint tracking changes back since this had a fairly large performance impact and the results that it found should all be picked up with local flow anyway.

alexrford · 2022-10-05T21:24:29Z

I've rolled the taint tracking changes back since this had a fairly large performance impact and the results that it found should all be picked up with local flow anyway.

I spoke too soon - the performance impact seems to be due to something else. I'll look into this properly tomorrow.

This reverts commit fa58c51.

alexrford · 2022-10-09T17:28:51Z

I think the bulk of the performance impact (~3.5% increase in analysis time) is from computing the new SensitiveNodes. I've not been able to make any significant improvements here. I'm conflicted over if this regression is acceptable - the SensitiveNode supports 5 different queries in JS of which I think 4 can be ported to Ruby whilst reusing this class. As it stands we only use this class for rb/sensitive-get-query in this PR.

aibaars

Good work; I have some comment and questions.

aibaars · 2022-10-13T12:14:19Z

+<qhelp>
+<overview>
+<p>
+Sensitive information such as user passwords should not be transmitted within the query string of the requested URL.


Did you mean passwords or user names and passwords. While user passwords is a correct term, I think transmitting non-user passwords would be equally problematic.

Yeah, just passwords makes more sense here. We don't report user names here as they're not considered sensitive in this context.

aibaars · 2022-10-13T12:21:29Z

+       * Gets the kind of the accessed input,
+       * Can be one of "parameter", "header", "body", "url", "cookie".
+       *
+       * Note that this predicate is functional.


What is the purpose of this Note ? I guess functional in this context indicates that the predicate returns exactly one result. This is kind of implied in the name of the predicate get instead of getA and the Gets the and lack of if any suffix in the comment.

I think the note may confuse users and make them wonder if there are any predicates that do not work/function somehow.

I'm going to back out of the kind related changes here as #10602 implements this in a neater way. FWIW this was more or less copied from the JS version of this, my understanding of functional in this sense was that the return values could be relied on to have a precise semantic meaning. This is in contrast to string getSourceType() which is a bit fuzzier in what it might return.

Sorry for conflicting with your changes here! When we talked about it in the meeting, I misunderstood and thought your changes were already merged, so when I couldn't find them I assumed they were for a different concept and so I would have to add them in my PR.

Sorry for conflicting with your changes here! When we talked about it in the meeting, I misunderstood and thought your changes were already merged, so when I couldn't find them I assumed they were for a different concept and so I would have to add them in my PR.

No worries, thanks for the improved implementation. I've updated this PR to use it.

aibaars · 2022-10-13T12:22:22Z

+         * Gets the kind of the accessed input,
+         * Can be one of "parameter", "header", "body", "url", "cookie".
+         *
+         * Note that this predicate is functional.


This is gone now due to pulling in the changes from the other PR.

aibaars · 2022-10-13T12:26:41Z

+ */
+pragma[nomagic]
+private predicate writesProperty(DataFlow::Node node, string name) {
+  exists(VariableWriteAccess vwa | vwa.getVariable().getName() = name |


If I recall correctly instance and class variables have @ and @@ prefixes in their names, do we need to account for those here?

I don't think it matters in this case since nameIndicatesSensitiveData matches against some fairly permissive regexps (no anchors). This does remind me that at some point we discussed making Variable#getName() strip the prefixes from class/instance variables, but we didn't end up making this change. It's a bit of a shame as I think that's probably better default behaviour.

Sorry, I take that back - the heuristics exclude anything containing non-alphanumerics. It might be worth changing nameIndicatesSensitiveData to ignore leading @ characters as we deal with variable names in multiple places in this file.

nameIndicatesSensitiveData is in a shared file dealing with cross language heuristics, so I've updated the places in this file that deal with variable accesses instead.

aibaars · 2022-10-13T12:31:26Z

+class UsersController < ApplicationController
+
+  def login_get
+    password = params[:password] # BAD: route handler uses GET query parameters to receive sensitive data


could you also add a test case with an instance variable? Like

@password = params[:some_thing] authenticate_user(params[:username], @password)

aibaars · 2022-10-13T12:32:57Z

+class UsersController < ApplicationController
+
+  def login_get
+    password = params[:password] # BAD: route handler uses GET query parameters to receive sensitive data


It think you best change the test case in one that uses params[:password] but with a non-sensitive variable name, and another with a non-sensitive query parameter name and a sensitive variable name.

Co-authored-by: Arthur Baars <aibaars@github.com>

…ables as not sensitive

alexrford · 2022-10-13T21:42:43Z

I'll update this tomorrow to reflect the kind changes from the other PR before running DCA again.

alexrford · 2022-10-14T13:54:37Z

Updated to address review comments. DCA has a couple of FPs that are interesting, as they look to be safe by virtue of appearing in an if statement body that checks for request.post? or request.get?.

aibaars

LGTM, perhaps we should implement some sanitizers/barriers for if request.post? checks.

alexrford · 2022-10-14T15:06:30Z

LGTM, perhaps we should implement some sanitizers/barriers for if request.post? checks.

Do you think that this is a blocker for the current PR?

aibaars · 2022-10-17T07:55:40Z

LGTM, perhaps we should implement some sanitizers/barriers for if request.post? checks.

Do you think that this is a blocker for the current PR?

No problem ;-)

Ruby: add rb/sensitive-get-query query

f84035a

alexrford added the Ruby label Sep 10, 2022

github-actions Bot added the documentation label Sep 10, 2022

github-advanced-security AI found potential problems Sep 10, 2022

View reviewed changes

Comment thread ruby/ql/lib/codeql/ruby/frameworks/GraphQL.qll Fixed

Comment thread ruby/ql/src/queries/security/cwe-598/SensitiveGetQuery.ql Fixed

github deleted a comment from ThanhVy1121 Sep 12, 2022

alexrford added 3 commits September 12, 2022 08:56

Ruby: address QL4QL alerts for rb/sensitive-get-query

0da367f

Ruby: make SensitiveExpr a dataflow node rather than an Expr

79ad7d2

Ruby: stop rb/sensitive-get-query from considering ID type data as se…

08c8db8

…nsitive

alexrford marked this pull request as ready for review September 19, 2022 19:57

alexrford requested a review from a team as a code owner September 19, 2022 19:57

alexrford and others added 2 commits September 19, 2022 20:57

Merge branch 'main' into rb/sensitive-get-query

be1ac17

Ruby: use camelcase verion of Http module

7720d85

calumgrant requested a review from hmac September 20, 2022 08:38

hmac reviewed Sep 22, 2022

View reviewed changes

alexrford and others added 5 commits October 4, 2022 15:04

Ruby: use taint tracking for rb/sensitive-get-query

703829c

Ruby: split out rb/sensitive-get-query using query/customizations pat…

880fb2b

…tern

Ruby: add a test case for sensitive data from cookies for rb/sensitiv…

977e8a8

…e-get-query (should not be flagged)

Ruby: limit rb/sensitive-get-query to data from query params

084efe0

Merge branch 'main' into rb/sensitive-get-query

d64f8c7

github-advanced-security AI found potential problems Oct 5, 2022

View reviewed changes

Comment thread ruby/ql/lib/codeql/ruby/security/SensitiveGetQueryQuery.qll Fixed

Comment thread ruby/ql/src/queries/security/cwe-598/SensitiveGetQuery.ql Fixed

alexrford added 3 commits October 5, 2022 13:06

Ruby: add a note to a test case

f01670f

Ruby: remove some redundant imports of DataFlow

dea53d8

Ruby: add RequestInputAccess#getKind predicate

71670a4

alexrford and others added 2 commits October 5, 2022 15:58

Ruby: switch rb/sensitive-get-query back to using local flow

fa58c51

Merge branch 'main' into rb/sensitive-get-query

a28d7b6

Merge branch 'main' into rb/sensitive-get-query

139d386

Revert "Ruby: switch rb/sensitive-get-query back to using local flow"

43fec9d

This reverts commit fa58c51.

alexrford added the Ruby GA label Oct 11, 2022

aibaars reviewed Oct 13, 2022

View reviewed changes

alexrford and others added 4 commits October 13, 2022 21:43

Update ruby/ql/src/queries/security/cwe-598/SensitiveGetQuery.qhelp

15cab6e

Co-authored-by: Arthur Baars <aibaars@github.com>

Ruby: avoid making notSensitiveRegexp always flag instance/class vari…

9fbd293

…ables as not sensitive

Ruby: clarify qhelp

3d478a3

Ruby: update rb/sensitive-get-query tests

cda7d84

alexrford added 4 commits October 14, 2022 09:19

Ruby: revert SensitiveDataHeuristics changes

36a1b18

Ruby: fix SensitiveNode detection relating to class/instance variables

24dad55

Merge remote-tracking branch 'origin/main' into rb/sensitive-get-query

3baad89

Ruby: fix merge error

b29bf82

aibaars approved these changes Oct 14, 2022

View reviewed changes

alexrford merged commit 2c5129e into github:main Oct 14, 2022

alexrford deleted the rb/sensitive-get-query branch October 14, 2022 21:35


		override string getFramework() { result = "ActionController" }

		override string getAnHttpMethod() { result = this.getARoute().getHttpMethod() }

Conversation

alexrford commented Sep 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sensitive data read from GET request

Recommendation

Example

References

Uh oh!

Uh oh!

Uh oh!

hmac left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexrford Sep 23, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

alexrford commented Oct 5, 2022

Uh oh!

alexrford commented Oct 5, 2022

Uh oh!

alexrford commented Oct 5, 2022

Uh oh!

alexrford commented Oct 9, 2022

Uh oh!

aibaars left a comment

Choose a reason for hiding this comment

Uh oh!

aibaars Oct 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexrford commented Oct 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexrford commented Oct 14, 2022

Uh oh!

aibaars left a comment

Choose a reason for hiding this comment

Uh oh!

alexrford commented Sep 10, 2022 •

edited

Loading

github-actions Bot commented Sep 10, 2022 •

edited

Loading

alexrford Sep 23, 2022 •

edited

Loading

aibaars Oct 13, 2022 •

edited

Loading

alexrford commented Oct 13, 2022 •

edited

Loading