Skip to content

Commit fbe11cf

Browse files
committed
Actions: Refactor logic for identifying quoted strings
Add some doc comments and meaningful variable names.
1 parent 321513c commit fbe11cf

File tree

1 file changed

+37
-15
lines changed

1 file changed

+37
-15
lines changed

actions/ql/lib/codeql/actions/Bash.qll

Lines changed: 37 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -93,23 +93,45 @@ class BashShellScript extends ShellScript {
9393
this.cmdSubstitutionReplacement(result, _, i)
9494
}
9595

96+
/**
97+
* Holds if `quotedStr` is a string in double quotes in
98+
* the line at `lineIndex` in the shell script,
99+
* and `id` is a unique identifier for this quoted string.
100+
*/
101+
private predicate doubleQuotedString(int lineIndex, string quotedStr, string id) {
102+
exists(int occurrenceIndex, int occurrenceOffset |
103+
// double quoted string
104+
quotedStr =
105+
this.cmdSubstitutedLineProducer(lineIndex)
106+
.regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", occurrenceIndex, occurrenceOffset) and
107+
id =
108+
"qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
109+
quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
110+
)
111+
}
112+
113+
/**
114+
* Holds if `quotedStr` is a string in single quotes in
115+
* the line at `lineIndex` in the shell script,
116+
* and `id` is a unique identifier for this quoted string.
117+
*/
118+
private predicate singleQuotedString(int lineIndex, string quotedStr, string id) {
119+
exists(int occurrenceIndex, int occurrenceOffset |
120+
// single quoted string
121+
quotedStr =
122+
this.cmdSubstitutedLineProducer(lineIndex)
123+
.regexpFind("'((?:\\\\.|[^'\\\\])*)'", occurrenceIndex, occurrenceOffset) and
124+
id =
125+
"qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
126+
quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
127+
)
128+
}
129+
96130
private predicate quotedStringReplacement(string quotedStr, string id) {
97-
exists(string line, int k | line = this.cmdSubstitutedLineProducer(k) |
98-
exists(int i, int j |
99-
// double quoted string
100-
quotedStr = line.regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", i, j) and
101-
id =
102-
"qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
103-
quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
104-
)
131+
exists(int lineIndex |
132+
this.doubleQuotedString(lineIndex, quotedStr, id)
105133
or
106-
exists(int i, int j |
107-
// single quoted string
108-
quotedStr = line.regexpFind("'((?:\\\\.|[^'\\\\])*)'", i, j) and
109-
id =
110-
"qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
111-
quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
112-
)
134+
this.singleQuotedString(lineIndex, quotedStr, id)
113135
) and
114136
// Only do this for strings that might otherwise disrupt subsequent parsing
115137
quotedStr.regexpMatch("[\"'].*[$\n\r'\"" + Bash::separator() + "].*[\"']")

0 commit comments

Comments
 (0)