Commit a0555e94 authored by Alex Kalderimis's avatar Alex Kalderimis

Merge branch 'kassio/add-rubocop-for-files-decompressing' into 'master'

Add Rubocop to check system file decompressing

See merge request gitlab-org/gitlab!79075
parents d7dc8503 cde7fe86
# frozen_string_literal: true
module RuboCop
module Cop
# Check for symlinks when extracting files to avoid arbitrary file reading.
class FileDecompression < RuboCop::Cop::Cop
MSG = <<~EOF
While extracting files check for symlink to avoid arbitrary file reading.
https://gitlab.com/gitlab-com/gl-infra/production/-/issues/6132
EOF
def_node_matcher :system?, <<~PATTERN
(send {nil? | const} {:system | :exec | :spawn | :popen}
(str $_))
PATTERN
def_node_matcher :subshell?, <<~PATTERN
(xstr
(str $_))
PATTERN
FORBIDDEN_COMMANDS = %w[gunzip gzip zip tar].freeze
def on_xstr(node)
subshell?(node) do |match|
add_offense(node, message: MSG) if forbidden_command?(match)
end
end
def on_send(node)
system?(node) do |match|
add_offense(node, location: :expression, message: MSG) if forbidden_command?(match)
end
end
private
def forbidden_command?(cmd)
FORBIDDEN_COMMANDS.any? do |forbidden|
cmd.match?(forbidden)
end
end
end
end
end
# frozen_string_literal: true
require 'fast_spec_helper'
require_relative '../../../rubocop/cop/file_decompression'
RSpec.describe RuboCop::Cop::FileDecompression do
subject(:cop) { described_class.new }
it 'does not flag when using a system command not related to file decompression' do
expect_no_offenses('system("ls")')
end
described_class::FORBIDDEN_COMMANDS.map { [_1, '^' * _1.length] }.each do |cmd, len|
it "flags the when using '#{cmd}' system command" do
expect_offense(<<~SOURCE)
system('#{cmd}')
^^^^^^^^#{len}^^ While extracting files check for symlink to avoid arbitrary file reading[...]
SOURCE
expect_offense(<<~SOURCE)
exec('#{cmd}')
^^^^^^#{len}^^ While extracting files check for symlink to avoid arbitrary file reading[...]
SOURCE
expect_offense(<<~SOURCE)
Kernel.spawn('#{cmd}')
^^^^^^^^^^^^^^#{len}^^ While extracting files check for symlink to avoid arbitrary file reading[...]
SOURCE
expect_offense(<<~SOURCE)
IO.popen('#{cmd}')
^^^^^^^^^^#{len}^^ While extracting files check for symlink to avoid arbitrary file reading[...]
SOURCE
end
it "flags the when using '#{cmd}' subshell command" do
expect_offense(<<~SOURCE)
`#{cmd}`
^#{len}^ While extracting files check for symlink to avoid arbitrary file reading[...]
SOURCE
expect_offense(<<~SOURCE)
%x(#{cmd})
^^^#{len}^ While extracting files check for symlink to avoid arbitrary file reading[...]
SOURCE
end
end
end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment