Sha256: b6d22b9f3c56d54c80442984fe2617fb11ef1648c3d4f6053d24340d6fad3160
Contents?: true
Size: 1.93 KB
Versions: 7
Compression:
Stored size: 1.93 KB
Contents
# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true
module Contrast
module Agent
module Assess
module Policy
module Trigger
# This acts a trigger to handle the special cases of the XPath
# library gem and the Oga gem. Untrusted data may come into the
# trigger methods from these classes as an array or hash,
# respectively. Since untrusted user input comes into these triggers
# as a splat argument or an options hash, we need to iterate through
# these objects to see if we were tracking on any of them and report
# a finding if so.
class Xpath
class << self
def xpath_expression_trigger trigger_node, _source, object, ret, *args
return ret unless args
process(trigger_node, object, ret, *args)
end
def xpath_oga_trigger trigger_node, _source, object, ret, *args
return ret unless args
# convert the options arg in Oga::XML::CharacterNode#initialize into an
# array of its values so we can check if any are unsafe
args = args.first.values if args.first.cs__is_a?(Hash)
process(trigger_node, object, ret, *args)
end
private
def process trigger_node, object, ret, *args
args.each do |arg|
next unless arg.cs__is_a?(String) || arg.cs__is_a?(Symbol)
next unless Contrast::Agent::Assess::Tracker.tracked?(arg)
next unless trigger_node.violated?(arg)
Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(trigger_node, arg, object, ret, *args)
end
ret
end
end
end
end
end
end
end
end
Version data entries
7 entries across 7 versions & 1 rubygems