nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.69k stars 95 forks source link

error when printing variable in `map.key` format #50

Closed calvin-kargo closed 5 years ago

calvin-kargo commented 5 years ago

sobelow throw error when printing variable in format of map.key Example:

# in lib/my_web/router.ex
# 
# 
# 
# other code

defmodule RunElixir do
  import Plug.Conn

  def init(_opts), do: []

  # sobelow_skip ["RCE.CodeModule"]
  def call(conn, _opts) do
    {res, _} = Code.eval_string(conn.body_params["code"])

    conn
    |> put_status(200)
    |> Phoenix.Controller.json(%{result: Poison.encode!(res)})
  end
end
when run mix sobelow

-----------------------------------------------

DOS.StringToAtom: Unsafe `String.to_atom` - Low Confidence
File: lib/my_web/some_component/some_file.ex
Line: 333
Function: query_rendered_sql_map:331
Variable: col

-----------------------------------------------

RCE.CodeModule: Code Execution in `Code.eval_string` - Low Confidence
File: lib/my_web/router.ex
Line: 240
Function: call:239
** (Protocol.UndefinedError) protocol String.Chars not implemented for {:., [line: 240], [{:conn, [line: 240], nil}, :body_params]} of type Tuple
    (elixir) lib/string/chars.ex:3: String.Chars.impl_for!/1
    (elixir) lib/string/chars.ex:22: String.Chars.to_string/1
    lib/sobelow/print.ex:180: Sobelow.Print.finding_variable/1
    lib/sobelow/print.ex:83: Sobelow.Print.do_print_finding_metadata/9
    (elixir) lib/enum.ex:783: Enum."-each/2-lists^foreach/1-0-"/2
    (elixir) lib/enum.ex:783: Enum.each/2
    (elixir) lib/enum.ex:783: Enum."-each/2-lists^foreach/1-0-"/2
    (elixir) lib/enum.ex:783: Enum.each/2
GriffinMB commented 5 years ago

Thanks for opening this issue! I’ll release an update to address the error this weekend.

GriffinMB commented 5 years ago

I pushed an update to master, you can test by installing with mix archive.install github nccgroup/sobelow. Let me know if you have any problems with the update!

This fix will be available on Hex.pm in the next release (this Sunday) with a number of other improvements!

I'll close the issue once the release is live.

GriffinMB commented 5 years ago

This is now live! Thanks again for reporting.