Ruby: Add `rb/weak-cookie-configuration` query #7313

This PR adds a query to check for potential weak cookie configuration options for Rails - in theory we could extend this to cover other frameworks.

The defaults for Rails seem quite safe here, so we only look for cases where these defaults are overriden. In particular, we check for three settings in non-test configuration:

config.action_dispatch.encrypted_cookie_cipher set to a cipher that we believe to be weak
config.action_dispatch.use_authenticated_cookie_encryption set to false
config.action_dispatch.cookies_same_site_protection set to either :none/"none"/etc. or nil

In the last of these, the option can also be set to a proc that can take a request and behave differently depending on this request - this PR doesn't cover that case.

I'll hold off on merging this until #7273 is in.

QHelp previews:

ruby/ql/src/queries/security/cwe-732/WeakCookieConfiguration.qhelp

Weak cookie configuration

Cookies can be used for security measures, such as authenticating a user based on cookies sent with a request. Misconfiguration of cookie settings in a web application can expose users to attacks that compromise these security measures.

Recommendation

Modern web frameworks typically have good default configuration for cookie settings. If an application overrides these settings, then take care to ensure that these changes are necessary and that they don't weaken the cookie configuration.

Example

In the first example, the value of config.action_dispatch.cookies_same_site_protection is set to :none. This has the effect of setting the default SameSite attribute sent by the server when setting a cookie to None rather than the default of Lax. This may make the application more vulnerable to cross-site request forgery attacks.

In the second example, this option is instead set to :strict. This is a stronger restriction than the default of :lax, and doesn't compromise on cookie security.

module App
  class Application < Rails::Application
    # Sets default `Set-Cookie` `SameSite` attribute to `None`
    config.action_dispatch.cookies_same_site_protection = :none

    # Sets default `Set-Cookie` `SameSite` attribute to `Strict`
    config.action_dispatch.cookies_same_site_protection = :strict
  end
end

References

OWASP: SameSite.
Rails: Configuring Action Dispatch.
Common Weakness Enumeration: CWE-732.
Common Weakness Enumeration: CWE-1275.

Leaving a note-to-self to double check this, as the merge conflict resolution for Rails.qll was a little bit hairy.

QHelp previews:

ruby/ql/src/queries/security/cwe-732/WeakCookieConfiguration.qhelp

Weak cookie configuration

Cookies can be used for security measures, such as authenticating a user based on cookies sent with a request. Misconfiguration of cookie settings in a web application can expose users to attacks that compromise these security measures.

Recommendation

Modern web frameworks typically have good default configuration for cookie settings. If an application overrides these settings, then take care to ensure that these changes are necessary and that they don't weaken the cookie configuration.

Example

In the first example, the value of config.action_dispatch.cookies_same_site_protection is set to :none. This has the effect of setting the default SameSite attribute sent by the server when setting a cookie to None rather than the default of Lax. This may make the application more vulnerable to cross-site request forgery attacks.

In the second example, this option is instead set to :strict. This is a stronger restriction than the default of :lax, and doesn't compromise on cookie security.

module App
  class Application < Rails::Application
    # Sets default `Set-Cookie` `SameSite` attribute to `None`
    config.action_dispatch.cookies_same_site_protection = :none

    # Sets default `Set-Cookie` `SameSite` attribute to `Strict`
    config.action_dispatch.cookies_same_site_protection = :strict
  end
end

References

OWASP: SameSite.
Rails: Configuring Action Dispatch.
Common Weakness Enumeration: CWE-732.
Common Weakness Enumeration: CWE-1275.

QHelp previews:

ruby/ql/src/queries/security/cwe-732/WeakCookieConfiguration.qhelp

Weak cookie configuration

Cookies can be used for security measures, such as authenticating a user based on cookies sent with a request. Misconfiguration of cookie settings in a web application can expose users to attacks that compromise these security measures.

Recommendation

Modern web frameworks typically have good default configuration for cookie settings. If an application overrides these settings, then take care to ensure that these changes are necessary and that they don't weaken the cookie configuration.

Example

In the first example, the value of config.action_dispatch.cookies_same_site_protection is set to :none. This has the effect of setting the default SameSite attribute sent by the server when setting a cookie to None rather than the default of Lax. This may make the application more vulnerable to cross-site request forgery attacks.

In the second example, this option is instead set to :strict. This is a stronger restriction than the default of :lax, and doesn't compromise on cookie security.

module App
  class Application < Rails::Application
    # Sets default `Set-Cookie` `SameSite` attribute to `None`
    config.action_dispatch.cookies_same_site_protection = :none

    # Sets default `Set-Cookie` `SameSite` attribute to `Strict`
    config.action_dispatch.cookies_same_site_protection = :strict
  end
end

References

OWASP: SameSite.
Rails: Configuring Action Dispatch.
Common Weakness Enumeration: CWE-732.
Common Weakness Enumeration: CWE-1275.

QHelp previews:

ruby/ql/src/queries/security/cwe-732/WeakCookieConfiguration.qhelp

Weak cookie configuration

Cookies can be used for security measures, such as authenticating a user based on cookies sent with a request. Misconfiguration of cookie settings in a web application can expose users to attacks that compromise these security measures.

Recommendation

Modern web frameworks typically have good default configuration for cookie settings. If an application overrides these settings, then take care to ensure that these changes are necessary and that they don't weaken the cookie configuration.

Example

In the first example, the value of config.action_dispatch.cookies_same_site_protection is set to :none. This has the effect of setting the default SameSite attribute sent by the server when setting a cookie to None rather than the default of Lax. This may make the application more vulnerable to cross-site request forgery attacks.

In the second example, this option is instead set to :strict. This is a stronger restriction than the default of :lax, and doesn't compromise on cookie security.

module App
  class Application < Rails::Application
    # Sets default `Set-Cookie` `SameSite` attribute to `None`
    config.action_dispatch.cookies_same_site_protection = :none

    # Sets default `Set-Cookie` `SameSite` attribute to `Strict`
    config.action_dispatch.cookies_same_site_protection = :strict
  end
end

References

OWASP: SameSite.
Rails: Configuring Action Dispatch.
Common Weakness Enumeration: CWE-732.
Common Weakness Enumeration: CWE-1275.

It's not clear to me why this needs a review from the Python team. Am I missing something?

It's not clear to me why this needs a review from the Python team. Am I missing something?

Thanks for noticing this, the Python and JS review requests weren't necessary. They were left over from before the merge conflict was resolved (as this PR included changes to CryptoAlgorithms.qll that were merged in #7273).

QHelp previews:

ruby/ql/src/queries/security/cwe-732/WeakCookieConfiguration.qhelp

Weak cookie configuration

Cookies can be used for security measures, such as authenticating a user based on cookies sent with a request. Misconfiguration of cookie settings in a web application can expose users to attacks that compromise these security measures.

Recommendation

Modern web frameworks typically have good default configuration for cookie settings. If an application overrides these settings, then take care to ensure that these changes are necessary and that they don't weaken the cookie configuration.

Example

In the first example, the value of config.action_dispatch.cookies_same_site_protection is set to :none. This has the effect of setting the default SameSite attribute sent by the server when setting a cookie to None rather than the default of Lax. This may make the application more vulnerable to cross-site request forgery attacks.

In the second example, this option is instead set to :strict. This is a stronger restriction than the default of :lax, and doesn't compromise on cookie security.

module App
  class Application < Rails::Application
    # Sets default `Set-Cookie` `SameSite` attribute to `None`
    config.action_dispatch.cookies_same_site_protection = :none

    # Sets default `Set-Cookie` `SameSite` attribute to `Strict`
    config.action_dispatch.cookies_same_site_protection = :strict
  end
end

References

OWASP: SameSite.
Rails: Configuring Action Dispatch.
Common Weakness Enumeration: CWE-732.
Common Weakness Enumeration: CWE-1275.

Dec	JAN	Feb
	06
2021	2022	2023

		@@ -0,0 +1,2 @@
		lgtm,codescanning

github / codeql Public

Ruby: Add rb/weak-cookie-configuration query #7313

Ruby: Add rb/weak-cookie-configuration query #7313

Conversation

alexrford commented Dec 5, 2021

nickrolfe left a comment

nickrolfe Dec 15, 2021

Choose a reason for hiding this comment

dbartol Dec 15, 2021 • edited

Choose a reason for hiding this comment

alexrford Dec 16, 2021

Choose a reason for hiding this comment

nickrolfe Dec 15, 2021

Choose a reason for hiding this comment

alexrford Dec 16, 2021

Choose a reason for hiding this comment

nickrolfe left a comment

alexrford commented Dec 16, 2021

github-actions bot commented Dec 22, 2021

Weak cookie configuration

Recommendation

Example

References

alexrford commented Dec 22, 2021

github-actions bot commented Jan 4, 2022

Weak cookie configuration

Recommendation

Example

References

github-actions bot commented Jan 4, 2022

Weak cookie configuration

Recommendation

Example

References

github-actions bot commented Jan 4, 2022

Weak cookie configuration

Recommendation

Example

References

tausbn commented Jan 4, 2022

alexrford commented Jan 4, 2022 • edited

nickrolfe Jan 5, 2022

Choose a reason for hiding this comment

alexrford Jan 5, 2022

Choose a reason for hiding this comment

github-actions bot commented Jan 5, 2022

Weak cookie configuration

Recommendation

Example

References

nickrolfe left a comment

Ruby: Add `rb/weak-cookie-configuration` query #7313

Ruby: Add `rb/weak-cookie-configuration` query #7313

dbartol Dec 15, 2021 •

edited

alexrford commented Jan 4, 2022 •

edited