Packages
sobelow
0.2.5
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/traversal/file_module.ex
defmodule Sobelow.Traversal.FileModule do
alias Sobelow.Utils
use Sobelow.Finding
@file_funcs [:read,
:read!,
:write,
:write!,
:rm,
:rm!,
:rm_rf]
def run(fun, filename) do
severity = if String.ends_with?(filename, "_controller.ex"), do: false, else: :low
Enum.each @file_funcs, fn(file_func) ->
{vars, params, {fun_name, [{_, line_no}]}} = parse_file_def(fun, file_func)
Enum.each vars, fn var ->
if Enum.member?(params, var) || var === "conn.params" do
print_file_finding(line_no, filename, fun_name, fun, var, file_func, severity || :high)
else
print_file_finding(line_no, filename, fun_name, fun, var, file_func, severity || :medium)
end
end
end
end
def parse_file_def(fun, type) do
{params, {fun_name, line_no}} = Utils.get_fun_declaration(fun)
pipefuns = Utils.get_pipe_funs(fun)
|> Enum.map(fn {_, _, opts} -> Enum.at(opts, 1) end)
|> Enum.flat_map(&Utils.get_aliased_funs_of_type(&1, type, [:File]))
pipefiles = Enum.flat_map(pipefuns, &Utils.get_pipe_val(fun, &1))
|> List.flatten
# Can extract_opts at idx 0, because File functions path is
# always the first parameter.
files = Utils.get_aliased_funs_of_type(fun, type, [:File]) -- pipefuns
|> Enum.map(&Utils.extract_opts(&1, 0))
|> List.flatten
{files ++ pipefiles, params, {fun_name, line_no}}
end
def print_file_finding(line_no, filename, fun_name, fun, var, type, severity) do
Utils.print_finding_metadata(line_no, filename, fun,
fun_name, var, severity,
"Directory Traversal in `File.#{type}`", type, [:File])
end
def get_details() do
Sobelow.Traversal.details()
end
end