search

OrenGitHub / dhscanner

free as in speech container scanner
https://orengithub.github.io/
2 stars 0 forks source link

missing params variable in ruby CVE 2023-45674 #47

Closed OrenGitHub closed 4 months ago

OrenGitHub commented 4 months ago 
$ grep -rn "startloc_36_683_endloc_36_689" kb.pl | wc -l
0 # <--- should appear multiple times ...
OrenGitHub commented 4 months ago 
    "theInstructionInside": {
        "instructionContent": {
            "contents": {
                "fieldReadInput": {
                    "contents": {
                        "tmpVariableFqn": {
                            "content": "int"
                        },
                        "tmpVariableLocation": { # <--- not good ! bug !
                            "colEnd": 0,
                            "colStart": 0,
                            "filename": "",
                            "lineEnd": 0,
                            "lineStart": 0
                        }
                    },
                    "tag": "TmpVariableCtor"
                },
                "fieldReadName": {
                    "content": "to_i",
                    "location": {
                        "colEnd": 699,
                        "colStart": 695,
                        "filename": "workdir/ff02e93b830fa88e2161cd152eb22fc316e2baea969bc0c4803ba477e120b531/farmbot/app/controllers/api/tools_controller.rb",
                        "lineEnd": 36,
                        "lineStart": 36
                    }
                },
OrenGitHub commented 4 months ago

The Ast look perfect - so the bug is in code gen:

    "expSubscriptLhs": {
        "contents": {
            "actualExpVar": {
                "contents": {
                    "varName": {
                        "content": "params",
                        "location": {
                            "colEnd": 689,
                            "colStart": 683,
                            "filename": "workdir/ff02e93b830fa88e2161cd152eb22fc316e2baea969bc0c4803ba477e120b531/farmbot/app/controllers/api/tools_controller.rb",
                            "lineEnd": 36,
                            "lineStart": 36
                        }
                    }
                },
                "tag": "VarSimple"
            }
        },
        "tag": "ExpVar"
    },