Skip to content

Commit a2cc202

Browse files
hvitvedhvitved
committed
temp
1 parent 31d4d1b commit a2cc202

File tree

13 files changed

+58
-76
lines changed

13 files changed

+58
-76
lines changed

‎ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll

+1
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ private module LambdaFlow {
182182
boolean toJump, DataFlowCallOption lastCall
183183
) {
184184
revLambdaFlow0(lambdaCall, kind, node, t, toReturn, toJump, lastCall) and
185+
not expectsContent(node, _) and
185186
if castNode(node) or node instanceof ArgNode or node instanceof ReturnNode
186187
then compatibleTypes(t, getNodeDataFlowType(node))
187188
else any()

‎ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll

+15-6
Original file line numberDiff line numberDiff line change
@@ -472,9 +472,6 @@ private module Cached {
472472
or
473473
// Needed for stores in type tracking
474474
TypeTrackerSpecific::storeStepIntoSourceNode(_, n, _)
475-
or
476-
n.asExpr().(CfgNodes::ExprNodes::LocalVariableReadAccessCfgNode).getVariable() instanceof
477-
CapturedVariableFlow::CapturedVariable
478475
}
479476

480477
cached
@@ -486,12 +483,13 @@ private module Cached {
486483
FlowSummaryImplSpecific::ParsePositions::isParsedElementLowerBoundPosition(_, includeUnknown,
487484
lower)
488485
} or
486+
TAnyCapturedVariableContent(CapturedVariableFlow::CapturingCallable c) or
489487
TNoContentSet() // Only used by type-tracking
490488

491489
cached
492490
class TContentSet =
493491
TSingletonContent or TAnyElementContent or TKnownOrUnknownElementContent or
494-
TElementLowerBoundContent;
492+
TElementLowerBoundContent or TAnyCapturedVariableContent;
495493

496494
private predicate trackKnownValue(ConstantValue cv) {
497495
not cv.isFloat(_) and
@@ -1270,14 +1268,17 @@ predicate storeStepCommon(Node node1, ContentSet c, Node node2) {
12701268
)
12711269
}
12721270

1271+
pragma[nomagic]
12731272
private predicate capturedVariableStoreStep(
12741273
SsaDefinitionExtNode node1, ContentSet c, CapturedVariableAcccessPostUpdateNode node2
12751274
) {
1276-
exists(BasicBlock bb, int i, LocalVariable v, Ssa::WriteDefinition def |
1275+
exists(BasicBlock bb, int i, Ssa::WriteDefinition def |
12771276
def = node1.getDefinitionExt() and
12781277
bb.getNode(i).getNode() = def.getWriteAccess() and // TODO: splitting
12791278
node2.getAccess().isRead(bb, i, _) and
1280-
c.isSingleton(any(Content::CapturedVariableContent cvc | cvc.getVariable() = v))
1279+
c.isSingleton(any(Content::CapturedVariableContent cvc |
1280+
cvc.getVariable() = def.getSourceVariable()
1281+
))
12811282
)
12821283
}
12831284

@@ -1397,6 +1398,14 @@ predicate clearsContent(Node n, ContentSet c) {
13971398
*/
13981399
predicate expectsContent(Node n, ContentSet c) {
13991400
FlowSummaryImpl::Private::Steps::summaryExpectsContent(n, c)
1401+
or
1402+
exists(
1403+
CapturedVariableFlow::CaptureAccess access, CapturedVariableFlow::CapturingCallable callable
1404+
|
1405+
n = TCapturedVariableAcccessNode(access, _) and
1406+
access.isReadOrWrite(_, _, callable) and
1407+
c.isAnyCapturedVariable(callable)
1408+
)
14001409
}
14011410

14021411
private newtype TDataFlowType =

‎ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll

+12
Original file line numberDiff line numberDiff line change
@@ -546,6 +546,8 @@ class ContentSet extends TContentSet {
546546
this = TElementLowerBoundContent(lower, true)
547547
}
548548

549+
predicate isAnyCapturedVariable(Callable c) { this = TAnyCapturedVariableContent(c) }
550+
549551
/** Gets a textual representation of this content set. */
550552
string toString() {
551553
exists(Content c |
@@ -570,6 +572,11 @@ class ContentSet extends TContentSet {
570572
includeUnknown = true and
571573
result = lower + ".."
572574
)
575+
or
576+
exists(Callable c |
577+
this.isAnyCapturedVariable(c) and
578+
result = "any captured variable inside " + c
579+
)
573580
}
574581

575582
/** Gets a content that may be stored into when storing into this set. */
@@ -615,6 +622,11 @@ class ContentSet extends TContentSet {
615622
includeUnknown = true and
616623
result = TUnknownElementContent()
617624
)
625+
or
626+
exists(Callable c |
627+
this.isAnyCapturedVariable(c) and
628+
result.(Content::CapturedVariableContent).getVariable().getAnAccess().getCfgScope() = c
629+
)
618630
}
619631
}
620632

‎ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll

+8-6
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ private import codeql.ruby.AST as Ast
22
private import codeql.ruby.CFG as Cfg
33
private import Cfg::CfgNodes
44
private import codeql.ruby.dataflow.FlowSummary
5+
private import codeql.ruby.dataflow.SSA
56
private import codeql.ruby.dataflow.internal.CapturedVariableFlow as CapturedVariableFlow
67
private import codeql.ruby.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
78
private import codeql.ruby.dataflow.internal.DataFlowPublic as DataFlowPublic
@@ -184,19 +185,20 @@ pragma[nomagic]
184185
private DataFlowPrivate::SsaDefinitionExtNode capturedVariablePredecessor(
185186
CapturedVariableFlow::CapturedVariable v
186187
) {
187-
result.getDefinitionExt().getSourceVariable() = v
188+
result.getDefinitionExt().(Ssa::WriteDefinition).getSourceVariable() = v
188189
}
189190

190191
/**
191192
* Gets a reference to `field` in `mod`, with `instance` indicating if it's
192193
* a field on an instance of `mod` (as opposed to the module object itself).
193194
*/
194195
pragma[nomagic]
195-
private Node capturedVariableSuccessor(CapturedVariableFlow::CapturedVariable v) {
196-
exists(LocalVariableReadAccess access |
197-
access.getVariable() = v and
198-
result.asExpr().getExpr() = access
199-
)
196+
private DataFlowPrivate::SsaDefinitionExtNode capturedVariableSuccessor(
197+
CapturedVariableFlow::CapturedVariable v
198+
) {
199+
result.getDefinitionExt().(Ssa::CapturedCallDefinition).getSourceVariable() = v
200+
or
201+
result.getDefinitionExt().(Ssa::CapturedEntryDefinition).getSourceVariable() = v
200202
}
201203

202204
/**

‎ruby/ql/test/library-tests/dataflow/array-flow/type-tracking-array-flow.expected

-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
| array_flow.rb:376:10:376:13 | ...[...] | Unexpected result: hasValueFlow=42.3 |
1414
| array_flow.rb:377:10:377:13 | ...[...] | Unexpected result: hasValueFlow=42.3 |
1515
| array_flow.rb:378:10:378:13 | ...[...] | Unexpected result: hasValueFlow=42.3 |
16-
| array_flow.rb:407:10:407:10 | x | Fixed missing result:hasValueFlow=45 |
1716
| array_flow.rb:484:10:484:13 | ...[...] | Unexpected result: hasValueFlow=54.3 |
1817
| array_flow.rb:484:10:484:13 | ...[...] | Unexpected result: hasValueFlow=54.4 |
1918
| array_flow.rb:484:10:484:13 | ...[...] | Unexpected result: hasValueFlow=54.5 |

‎ruby/ql/test/library-tests/dataflow/global/Flow.expected

-24
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
failures
2-
| captured_variables.rb:9:14:9:14 | x | Unexpected result: hasValueFlow=1.1 |
32
| captured_variables.rb:23:17:23:36 | # $ hasValueFlow=1.4 | Missing result:hasValueFlow=1.4 |
43
edges
54
| captured_variables.rb:1:24:1:24 | x : | captured_variables.rb:2:10:2:23 | -> { ... } [captured x] : |
@@ -8,18 +7,8 @@ edges
87
| captured_variables.rb:2:10:2:23 | -> { ... } [captured x] : | captured_variables.rb:3:5:3:6 | fn [captured x] : |
98
| captured_variables.rb:3:5:3:6 | fn [captured x] : | captured_variables.rb:2:20:2:20 | x |
109
| captured_variables.rb:3:5:3:6 | fn [captured x] : | captured_variables.rb:2:20:2:20 | x |
11-
| captured_variables.rb:5:1:5:30 | [post] self [captured x] : | captured_variables.rb:12:2:12:35 | self [captured x] : |
12-
| captured_variables.rb:5:1:5:30 | [post] self [captured x] : | captured_variables.rb:12:2:12:35 | self [captured x] : |
1310
| captured_variables.rb:5:20:5:30 | call to source : | captured_variables.rb:1:24:1:24 | x : |
1411
| captured_variables.rb:5:20:5:30 | call to source : | captured_variables.rb:1:24:1:24 | x : |
15-
| captured_variables.rb:5:20:5:30 | call to source : | captured_variables.rb:5:1:5:30 | [post] self [captured x] : |
16-
| captured_variables.rb:5:20:5:30 | call to source : | captured_variables.rb:5:1:5:30 | [post] self [captured x] : |
17-
| captured_variables.rb:12:1:12:36 | ( ... ) [captured x] : | captured_variables.rb:9:14:9:14 | x |
18-
| captured_variables.rb:12:1:12:36 | ( ... ) [captured x] : | captured_variables.rb:9:14:9:14 | x |
19-
| captured_variables.rb:12:2:12:35 | call to capture_escape_return1 [captured x] : | captured_variables.rb:12:1:12:36 | ( ... ) [captured x] : |
20-
| captured_variables.rb:12:2:12:35 | call to capture_escape_return1 [captured x] : | captured_variables.rb:12:1:12:36 | ( ... ) [captured x] : |
21-
| captured_variables.rb:12:2:12:35 | self [captured x] : | captured_variables.rb:12:2:12:35 | call to capture_escape_return1 [captured x] : |
22-
| captured_variables.rb:12:2:12:35 | self [captured x] : | captured_variables.rb:12:2:12:35 | call to capture_escape_return1 [captured x] : |
2312
| captured_variables.rb:29:13:29:14 | fn [captured x] : | captured_variables.rb:30:5:30:6 | fn [captured x] : |
2413
| captured_variables.rb:29:13:29:14 | fn [captured x] : | captured_variables.rb:30:5:30:6 | fn [captured x] : |
2514
| captured_variables.rb:30:5:30:6 | fn [captured x] : | captured_variables.rb:34:14:34:14 | x |
@@ -230,18 +219,8 @@ nodes
230219
| captured_variables.rb:2:20:2:20 | x | semmle.label | x |
231220
| captured_variables.rb:3:5:3:6 | fn [captured x] : | semmle.label | fn [captured x] : |
232221
| captured_variables.rb:3:5:3:6 | fn [captured x] : | semmle.label | fn [captured x] : |
233-
| captured_variables.rb:5:1:5:30 | [post] self [captured x] : | semmle.label | [post] self [captured x] : |
234-
| captured_variables.rb:5:1:5:30 | [post] self [captured x] : | semmle.label | [post] self [captured x] : |
235222
| captured_variables.rb:5:20:5:30 | call to source : | semmle.label | call to source : |
236223
| captured_variables.rb:5:20:5:30 | call to source : | semmle.label | call to source : |
237-
| captured_variables.rb:9:14:9:14 | x | semmle.label | x |
238-
| captured_variables.rb:9:14:9:14 | x | semmle.label | x |
239-
| captured_variables.rb:12:1:12:36 | ( ... ) [captured x] : | semmle.label | ( ... ) [captured x] : |
240-
| captured_variables.rb:12:1:12:36 | ( ... ) [captured x] : | semmle.label | ( ... ) [captured x] : |
241-
| captured_variables.rb:12:2:12:35 | call to capture_escape_return1 [captured x] : | semmle.label | call to capture_escape_return1 [captured x] : |
242-
| captured_variables.rb:12:2:12:35 | call to capture_escape_return1 [captured x] : | semmle.label | call to capture_escape_return1 [captured x] : |
243-
| captured_variables.rb:12:2:12:35 | self [captured x] : | semmle.label | self [captured x] : |
244-
| captured_variables.rb:12:2:12:35 | self [captured x] : | semmle.label | self [captured x] : |
245224
| captured_variables.rb:29:13:29:14 | fn [captured x] : | semmle.label | fn [captured x] : |
246225
| captured_variables.rb:29:13:29:14 | fn [captured x] : | semmle.label | fn [captured x] : |
247226
| captured_variables.rb:30:5:30:6 | fn [captured x] : | semmle.label | fn [captured x] : |
@@ -431,8 +410,6 @@ nodes
431410
| instance_variables.rb:107:6:107:8 | bar | semmle.label | bar |
432411
| instance_variables.rb:107:6:107:8 | bar | semmle.label | bar |
433412
subpaths
434-
| captured_variables.rb:5:20:5:30 | call to source : | captured_variables.rb:1:24:1:24 | x : | captured_variables.rb:1:24:1:24 | x : | captured_variables.rb:5:1:5:30 | [post] self [captured x] : |
435-
| captured_variables.rb:5:20:5:30 | call to source : | captured_variables.rb:1:24:1:24 | x : | captured_variables.rb:1:24:1:24 | x : | captured_variables.rb:5:1:5:30 | [post] self [captured x] : |
436413
| instance_variables.rb:28:20:28:24 | field : | instance_variables.rb:22:20:22:24 | field : | instance_variables.rb:23:9:23:14 | [post] self [@field] : | instance_variables.rb:28:9:28:25 | [post] self [@field] : |
437414
| instance_variables.rb:28:20:28:24 | field : | instance_variables.rb:22:20:22:24 | field : | instance_variables.rb:23:9:23:14 | [post] self [@field] : | instance_variables.rb:28:9:28:25 | [post] self [@field] : |
438415
| instance_variables.rb:39:15:39:23 | call to taint : | instance_variables.rb:10:19:10:19 | x : | instance_variables.rb:11:9:11:14 | [post] self [@field] : | instance_variables.rb:39:1:39:3 | [post] foo [@field] : |
@@ -492,7 +469,6 @@ subpaths
492469
| instance_variables.rb:105:6:105:10 | foo16 [@field] : | instance_variables.rb:13:5:15:7 | self in get_field [@field] : | instance_variables.rb:14:9:14:21 | return : | instance_variables.rb:105:6:105:20 | call to get_field |
493470
#select
494471
| captured_variables.rb:2:20:2:20 | x | captured_variables.rb:5:20:5:30 | call to source : | captured_variables.rb:2:20:2:20 | x | $@ | captured_variables.rb:5:20:5:30 | call to source : | call to source : |
495-
| captured_variables.rb:9:14:9:14 | x | captured_variables.rb:5:20:5:30 | call to source : | captured_variables.rb:9:14:9:14 | x | $@ | captured_variables.rb:5:20:5:30 | call to source : | call to source : |
496472
| captured_variables.rb:34:14:34:14 | x | captured_variables.rb:38:27:38:37 | call to source : | captured_variables.rb:34:14:34:14 | x | $@ | captured_variables.rb:38:27:38:37 | call to source : | call to source : |
497473
| instance_variables.rb:20:10:20:13 | @foo | instance_variables.rb:19:12:19:21 | call to taint : | instance_variables.rb:20:10:20:13 | @foo | $@ | instance_variables.rb:19:12:19:21 | call to taint : | call to taint : |
498474
| instance_variables.rb:40:6:40:18 | call to get_field | instance_variables.rb:39:15:39:23 | call to taint : | instance_variables.rb:40:6:40:18 | call to get_field | $@ | instance_variables.rb:39:15:39:23 | call to taint : | call to taint : |

‎ruby/ql/test/library-tests/dataflow/helpers/dataflow.expected

-4
Original file line numberDiff line numberDiff line change
@@ -131,11 +131,7 @@ getAnImmediateReference
131131
| tst.rb:8:1:11:3 | C2 | tst.rb:27:12:27:13 | C2 |
132132
| tst.rb:13:1:18:3 | Mixin | tst.rb:28:13:28:17 | Mixin |
133133
| tst.rb:20:1:25:3 | Mixin2 | tst.rb:29:13:29:18 | Mixin2 |
134-
| tst.rb:27:1:35:3 | C3 | tst.rb:28:5:28:17 | self |
135-
| tst.rb:27:1:35:3 | C3 | tst.rb:29:5:29:18 | self |
136-
| tst.rb:27:1:35:3 | C3 | tst.rb:31:14:31:17 | self |
137134
| tst.rb:27:1:35:3 | C3 | tst.rb:37:5:37:6 | C3 |
138-
| tst.rb:49:1:51:3 | N2 | tst.rb:50:5:50:13 | self |
139135
getOwnInstanceMethod
140136
| tst.rb:1:1:6:3 | C1 | c1 | tst.rb:2:5:5:7 | c1 |
141137
| tst.rb:8:1:11:3 | C2 | c2 | tst.rb:9:5:10:7 | c2 |

‎ruby/ql/test/query-tests/security/cwe-022/PathInjection.expected

+3-13
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,17 @@
11
edges
2-
| ArchiveApiPathTraversal.rb:5:26:5:31 | call to params : | ArchiveApiPathTraversal.rb:5:26:5:42 | ...[...] : |
3-
| ArchiveApiPathTraversal.rb:5:26:5:42 | ...[...] : | ArchiveApiPathTraversal.rb:49:17:49:27 | destination : |
42
| ArchiveApiPathTraversal.rb:10:11:10:16 | call to params : | ArchiveApiPathTraversal.rb:10:11:10:23 | ...[...] : |
53
| ArchiveApiPathTraversal.rb:10:11:10:23 | ...[...] : | ArchiveApiPathTraversal.rb:67:13:67:16 | file : |
64
| ArchiveApiPathTraversal.rb:15:9:15:14 | call to params : | ArchiveApiPathTraversal.rb:15:9:15:25 | ...[...] : |
75
| ArchiveApiPathTraversal.rb:15:9:15:25 | ...[...] : | ArchiveApiPathTraversal.rb:75:11:75:18 | filename : |
8-
| ArchiveApiPathTraversal.rb:49:17:49:27 | destination : | ArchiveApiPathTraversal.rb:52:38:52:48 | destination : |
9-
| ArchiveApiPathTraversal.rb:52:28:52:67 | call to join : | ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file |
10-
| ArchiveApiPathTraversal.rb:52:38:52:48 | destination : | ArchiveApiPathTraversal.rb:52:28:52:67 | call to join : |
116
| ArchiveApiPathTraversal.rb:67:13:67:16 | file : | ArchiveApiPathTraversal.rb:68:20:68:23 | file |
127
| ArchiveApiPathTraversal.rb:75:11:75:18 | filename : | ArchiveApiPathTraversal.rb:76:19:76:26 | filename |
138
| tainted_path.rb:4:12:4:17 | call to params : | tainted_path.rb:4:12:4:24 | ...[...] : |
149
| tainted_path.rb:4:12:4:24 | ...[...] : | tainted_path.rb:5:26:5:29 | path |
1510
| tainted_path.rb:10:12:10:43 | call to absolute_path : | tainted_path.rb:11:26:11:29 | path |
1611
| tainted_path.rb:10:31:10:36 | call to params : | tainted_path.rb:10:31:10:43 | ...[...] : |
1712
| tainted_path.rb:10:31:10:43 | ...[...] : | tainted_path.rb:10:12:10:43 | call to absolute_path : |
18-
| tainted_path.rb:16:15:16:41 | call to dirname : | tainted_path.rb:17:26:17:29 | path |
13+
| tainted_path.rb:16:12:16:47 | "#{...}/foo" : | tainted_path.rb:17:26:17:29 | path |
14+
| tainted_path.rb:16:15:16:41 | call to dirname : | tainted_path.rb:16:12:16:47 | "#{...}/foo" : |
1915
| tainted_path.rb:16:28:16:33 | call to params : | tainted_path.rb:16:28:16:40 | ...[...] : |
2016
| tainted_path.rb:16:28:16:40 | ...[...] : | tainted_path.rb:16:15:16:41 | call to dirname : |
2117
| tainted_path.rb:22:12:22:41 | call to expand_path : | tainted_path.rb:23:26:23:29 | path |
@@ -51,16 +47,10 @@ edges
5147
| tainted_path.rb:90:40:90:45 | call to params : | tainted_path.rb:90:40:90:52 | ...[...] : |
5248
| tainted_path.rb:90:40:90:52 | ...[...] : | tainted_path.rb:90:12:90:53 | call to new : |
5349
nodes
54-
| ArchiveApiPathTraversal.rb:5:26:5:31 | call to params : | semmle.label | call to params : |
55-
| ArchiveApiPathTraversal.rb:5:26:5:42 | ...[...] : | semmle.label | ...[...] : |
5650
| ArchiveApiPathTraversal.rb:10:11:10:16 | call to params : | semmle.label | call to params : |
5751
| ArchiveApiPathTraversal.rb:10:11:10:23 | ...[...] : | semmle.label | ...[...] : |
5852
| ArchiveApiPathTraversal.rb:15:9:15:14 | call to params : | semmle.label | call to params : |
5953
| ArchiveApiPathTraversal.rb:15:9:15:25 | ...[...] : | semmle.label | ...[...] : |
60-
| ArchiveApiPathTraversal.rb:49:17:49:27 | destination : | semmle.label | destination : |
61-
| ArchiveApiPathTraversal.rb:52:28:52:67 | call to join : | semmle.label | call to join : |
62-
| ArchiveApiPathTraversal.rb:52:38:52:48 | destination : | semmle.label | destination : |
63-
| ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | semmle.label | destination_file |
6454
| ArchiveApiPathTraversal.rb:67:13:67:16 | file : | semmle.label | file : |
6555
| ArchiveApiPathTraversal.rb:68:20:68:23 | file | semmle.label | file |
6656
| ArchiveApiPathTraversal.rb:75:11:75:18 | filename : | semmle.label | filename : |
@@ -72,6 +62,7 @@ nodes
7262
| tainted_path.rb:10:31:10:36 | call to params : | semmle.label | call to params : |
7363
| tainted_path.rb:10:31:10:43 | ...[...] : | semmle.label | ...[...] : |
7464
| tainted_path.rb:11:26:11:29 | path | semmle.label | path |
65+
| tainted_path.rb:16:12:16:47 | "#{...}/foo" : | semmle.label | "#{...}/foo" : |
7566
| tainted_path.rb:16:15:16:41 | call to dirname : | semmle.label | call to dirname : |
7667
| tainted_path.rb:16:28:16:33 | call to params : | semmle.label | call to params : |
7768
| tainted_path.rb:16:28:16:40 | ...[...] : | semmle.label | ...[...] : |
@@ -120,7 +111,6 @@ nodes
120111
| tainted_path.rb:92:11:92:14 | path | semmle.label | path |
121112
subpaths
122113
#select
123-
| ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params : | ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | This path depends on a $@. | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params | user-provided value |
124114
| ArchiveApiPathTraversal.rb:68:20:68:23 | file | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params : | ArchiveApiPathTraversal.rb:68:20:68:23 | file | This path depends on a $@. | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params | user-provided value |
125115
| ArchiveApiPathTraversal.rb:76:19:76:26 | filename | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params : | ArchiveApiPathTraversal.rb:76:19:76:26 | filename | This path depends on a $@. | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params | user-provided value |
126116
| tainted_path.rb:5:26:5:29 | path | tainted_path.rb:4:12:4:17 | call to params : | tainted_path.rb:5:26:5:29 | path | This path depends on a $@. | tainted_path.rb:4:12:4:17 | call to params | user-provided value |

‎ruby/ql/test/query-tests/security/cwe-089/SqlInjection.expected

+3-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ edges
2828
| ActiveRecordInjection.rb:92:21:92:26 | call to params : | ActiveRecordInjection.rb:92:21:92:35 | ...[...] |
2929
| ActiveRecordInjection.rb:98:10:98:15 | call to params : | ActiveRecordInjection.rb:99:11:99:12 | ps : |
3030
| ActiveRecordInjection.rb:99:11:99:12 | ps : | ActiveRecordInjection.rb:99:11:99:17 | ...[...] : |
31-
| ActiveRecordInjection.rb:99:11:99:17 | ...[...] : | ActiveRecordInjection.rb:104:20:104:32 | ... + ... |
31+
| ActiveRecordInjection.rb:99:11:99:17 | ...[...] : | ActiveRecordInjection.rb:100:13:100:24 | "= '#{...}'" : |
32+
| ActiveRecordInjection.rb:100:13:100:24 | "= '#{...}'" : | ActiveRecordInjection.rb:104:20:104:32 | ... + ... |
3233
| ActiveRecordInjection.rb:137:21:137:26 | call to params : | ActiveRecordInjection.rb:137:21:137:44 | ...[...] : |
3334
| ActiveRecordInjection.rb:137:21:137:44 | ...[...] : | ActiveRecordInjection.rb:20:22:20:30 | condition : |
3435
| ActiveRecordInjection.rb:151:59:151:64 | call to params : | ActiveRecordInjection.rb:151:59:151:74 | ...[...] : |
@@ -81,6 +82,7 @@ nodes
8182
| ActiveRecordInjection.rb:98:10:98:15 | call to params : | semmle.label | call to params : |
8283
| ActiveRecordInjection.rb:99:11:99:12 | ps : | semmle.label | ps : |
8384
| ActiveRecordInjection.rb:99:11:99:17 | ...[...] : | semmle.label | ...[...] : |
85+
| ActiveRecordInjection.rb:100:13:100:24 | "= '#{...}'" : | semmle.label | "= '#{...}'" : |
8486
| ActiveRecordInjection.rb:104:20:104:32 | ... + ... | semmle.label | ... + ... |
8587
| ActiveRecordInjection.rb:137:21:137:26 | call to params : | semmle.label | call to params : |
8688
| ActiveRecordInjection.rb:137:21:137:44 | ...[...] : | semmle.label | ...[...] : |

0 commit comments

Comments
 (0)