Packages
sobelow
0.14.1
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/traversal/file_module.ex
defmodule Sobelow.Traversal.FileModule do
@moduledoc """
# Directory Traversal in `File` function
This submodule checks for directory traversal vulnerabilities in the `File`
module.
Ensure that the path passed to `File` functions is not user-controlled.
File checks can be ignored with the following command:
$ mix sobelow -i Traversal.FileModule
"""
@uid 19
@finding_type "Traversal.FileModule: Directory Traversal in `File` function"
use Sobelow.Finding
@file_funcs [
:read,
:read!,
:write,
:write!,
:rm,
:rm!,
:rm_rf,
:open,
:open!,
:chmod,
:chmod!,
:chown,
:chown!,
:mkdir,
:mkdir!,
:mkdir_p,
:mkdir_p!,
:stream,
:stream!
]
@double_file_funcs [:cp, :copy, :cp!, :copy!, :cp_r, :cp_r!, :ln, :ln!, :ln_s, :ln_s!]
def run(fun, meta_file) do
confidence = if !meta_file.controller?, do: :low
Enum.each(@file_funcs ++ @double_file_funcs, fn file_func ->
"Traversal.FileModule: Directory Traversal in `File.#{file_func}`"
|> Finding.init(meta_file.filename, confidence)
|> Finding.multi_from_def(fun, parse_def(fun, file_func))
|> Enum.each(&Print.add_finding(&1))
end)
Enum.each(@double_file_funcs, fn file_func ->
"Traversal.FileModule: Directory Traversal in `File.#{file_func}`"
|> Finding.init(meta_file.filename, confidence)
|> Finding.multi_from_def(fun, parse_second_def(fun, file_func))
|> Enum.each(&Print.add_finding(&1))
end)
end
def parse_def(fun, type) do
Parse.get_fun_vars_and_meta(fun, 0, type, [:File])
end
def parse_second_def(fun, type) do
Parse.get_fun_vars_and_meta(fun, 1, type, [:File])
end
end