Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
CoCo_Code_Op2
brakeman
提交
4fe533e6
B
brakeman
项目概览
CoCo_Code_Op2
/
brakeman
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
B
brakeman
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
4fe533e6
编写于
10月 25, 2013
作者:
J
Justin Collins
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Add tests for command injection of literals
上级
c2e7483c
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
78 addition
and
2 deletion
+78
-2
test/apps/rails3.1/app/controllers/admin_controller.rb
test/apps/rails3.1/app/controllers/admin_controller.rb
+19
-0
test/tests/rails31.rb
test/tests/rails31.rb
+57
-1
test/to_test.rb
test/to_test.rb
+2
-1
未找到文件。
test/apps/rails3.1/app/controllers/admin_controller.rb
浏览文件 @
4fe533e6
...
...
@@ -29,4 +29,23 @@ class AdminController < ApplicationController
def
show_detailed_exceptions?
yeah_sure_they_are_an_admin_right?
current_user
end
def
make_system_calls
`
#{
"blah
#{
why?
}
"
}
`
# Some command injection of literals
# which should not raise warnings
or_input
=
if
admin
"rm -rf"
else
:symbol
end
system
"cd / &&
#{
or_input
}
"
`cd / &&
#{
or_input
}
`
system
"echo
#{
1
}
"
exec
"nmap 192.168.
#{
1
}
.1"
end
end
test/tests/rails31.rb
浏览文件 @
4fe533e6
...
...
@@ -15,7 +15,7 @@ class Rails31Tests < Test::Unit::TestCase
:model
=>
3
,
:template
=>
23
,
:controller
=>
4
,
:generic
=>
7
3
}
:generic
=>
7
4
}
end
def
test_without_protection
...
...
@@ -1086,4 +1086,60 @@ class Rails31Tests < Test::Unit::TestCase
:confidence
=>
1
,
:relative_path
=>
"app/controllers/admin_controller.rb"
end
def
test_command_injection_interpolation_inside_interpolation
assert_warning
:type
=>
:warning
,
:warning_code
=>
14
,
:fingerprint
=>
"5ef09b79bf1d08ccd42e376238f9a618227da4990ea7702a1d4da2e83f4820fe"
,
:warning_type
=>
"Command Injection"
,
:line
=>
34
,
:message
=>
/^Possible\ command\ injection/
,
:confidence
=>
1
,
:relative_path
=>
"app/controllers/admin_controller.rb"
,
:user_input
=>
s
(
:call
,
nil
,
:why?
)
end
def
test_command_injection_or_literal_system
assert_no_warning
:type
=>
:warning
,
:warning_code
=>
14
,
:fingerprint
=>
"7de48cc753c090a61ac49a6885bc87198b1a7a72e5629eb2a188b671b95c7f13"
,
:warning_type
=>
"Command Injection"
,
:line
=>
42
,
:message
=>
/^Possible\ command\ injection/
,
:confidence
=>
1
,
:relative_path
=>
"app/controllers/admin_controller.rb"
end
def
test_command_injection_or_literal_backticks
assert_no_warning
:type
=>
:warning
,
:warning_code
=>
14
,
:fingerprint
=>
"a9ec8db240351f05e084a6acc9f7980d97718eb4cb386d9ea8079d224dfecef9"
,
:warning_type
=>
"Command Injection"
,
:line
=>
43
,
:message
=>
/^Possible\ command\ injection/
,
:confidence
=>
1
,
:relative_path
=>
"app/controllers/admin_controller.rb"
end
def
test_command_injection_integer_command
assert_no_warning
:type
=>
:warning
,
:warning_code
=>
14
,
:fingerprint
=>
"44d7403b6d2dfe4b74c32b80d924fed3d034637f0e13b3c31193ef9279a674f3"
,
:warning_type
=>
"Command Injection"
,
:line
=>
45
,
:message
=>
/^Possible\ command\ injection/
,
:confidence
=>
1
,
:relative_path
=>
"app/controllers/admin_controller.rb"
end
def
test_command_injection_integer_exec
assert_no_warning
:type
=>
:warning
,
:warning_code
=>
14
,
:fingerprint
=>
"11ab37cedddb3b4c9cd1c29db6b6ab8cd8a6a0063862448075cc22e9cd8b0882"
,
:warning_type
=>
"Command Injection"
,
:line
=>
46
,
:message
=>
/^Possible\ command\ injection/
,
:confidence
=>
1
,
:relative_path
=>
"app/controllers/admin_controller.rb"
end
end
test/to_test.rb
浏览文件 @
4fe533e6
...
...
@@ -57,7 +57,8 @@ class #{name}Tests < Test::Unit::TestCase
#{
w
.
line
?
":line => "
:
"#noline"
}#{
w
.
line
}
,
:message => /^
#{
Regexp
.
escape
w
.
message
[
0
,
40
]
}
/,
:confidence =>
#{
w
.
confidence
}
,
:relative_path =>
#{
w
.
relative_path
.
inspect
}
:relative_path =>
#{
w
.
relative_path
.
inspect
}
,
:user_input =>
#{
w
.
user_input
}
end
RUBY
end
.
join
(
"
\n
"
)
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录