Sha256: 4668d28c9a1f879c9423957f4bfdc2e309f5369966e19f95b811c377a4b00d8c
Contents?: true
Size: 956 Bytes
Versions: 39
Compression:
Stored size: 956 Bytes
Contents
# typed: ignore
# Copyright (c) 2015 Sqreen. All Rights Reserved.
# Please refer to our terms for more information: https://www.sqreen.com/terms.html
require 'sqreen/rules/regexp_rule_cb'
module Sqreen
module Rules
# Callback that detect nifty env in system calls
class ShellEnvCB < RegexpRuleCB
def pre(_inst, args, _budget = nil, &_block)
return if args.size == 0
env = args.first
return unless env.is_a?(Hash)
return if env.size == 0
found = nil
var, value = env.find do |_, val|
next unless val.is_a?(String)
found = match_regexp(val)
end
return unless var
infos = {
:variable_name => var,
:variable_value => value,
:found => found,
}
Sqreen.log.warn { "presence of a shell env tampering: #{infos.inspect}" }
record_event(infos)
advise_action(:raise)
end
end
end
end
Version data entries
39 entries across 39 versions & 1 rubygems