Skip to content

Commit c085d9f

Browse files
hvitvedhvitved
committed
temp
1 parent faf6dd9 commit c085d9f

File tree

6 files changed

+65
-47
lines changed

6 files changed

+65
-47
lines changed

‎ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1005,23 +1005,20 @@ import OutNodes
10051005
predicate jumpStep(Node pred, Node succ) {
10061006
exists(Ssa::Definition def, BasicBlock bb, int i |
10071007
SsaImpl::captureFlowIn(_, def, bb, i, succ.(SsaDefinitionNode).getDefinition())
1008-
or
1009-
SsaImpl::captureFlowOut(_, def, bb, i, succ.(SsaDefinitionNode).getDefinition())
10101008
|
10111009
pred = getSsaRefNode(def, bb, i)
10121010
or
10131011
pred.(PostUpdateNode).getPreUpdateNode() = getSsaRefNode(def, bb, i)
10141012
)
10151013
or
1016-
// TODO: expectsContent
1014+
SsaImpl::captureFlowOut(_, pred.(SsaDefinitionNode).getDefinition(),
1015+
succ.(SsaDefinitionNode).getDefinition())
1016+
or
10171017
exists(
10181018
Ssa::Definition outer, Ssa::Definition inner, BasicBlock bb1, int i1, BasicBlock bb2, int i2
10191019
|
10201020
SsaImpl::captureFlowOutSideEffects(_, outer, bb1, i1, inner, bb2, i2) and
1021-
succ = getSsaRefNode(outer, bb1, i1)
1022-
|
1023-
pred = getSsaRefNode(inner, bb2, i2)
1024-
or
1021+
succ = getSsaRefNode(outer, bb1, i1) and
10251022
pred.(PostUpdateNode).getPreUpdateNode() = getSsaRefNode(inner, bb2, i2)
10261023
)
10271024
or

‎ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImpl.qll

Lines changed: 55 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -297,21 +297,15 @@ private module Cached {
297297

298298
private import codeql.ruby.dataflow.SSA
299299

300-
pragma[nomagic]
300+
pragma[noinline]
301301
private predicate defReachesExitReadInInnerScope(
302-
Definition def, Cfg::BasicBlock bb, int i, LocalVariable v, Cfg::CfgScope scope
302+
Definition def, LocalVariable v, Cfg::CfgScope scope
303303
) {
304-
exists(Cfg::BasicBlock bb2, int i2 |
305-
adjacentDefRead(def, bb, i, bb2, i2) and
306-
def.getSourceVariable() = pragma[only_bind_into](v) and
307-
capturedExitRead(bb2, i2, pragma[only_bind_into](v)) and
308-
scope = bb.getScope().getOuterCfgScope*()
309-
)
310-
or
311-
exists(Cfg::BasicBlock bb2, int i2 |
312-
defReachesExitReadInInnerScope(def, bb2, i2, v, scope) and
313-
adjacentDefRead(def, bb, i, bb2, i2) and
314-
SsaInput::variableRead(bb2, i2, v, false)
304+
exists(Cfg::BasicBlock bb, int i |
305+
ssaDefReachesRead(v, def, bb, i) and
306+
capturedExitRead(bb, i, v) and
307+
scope = bb.getScope().getOuterCfgScope*() and
308+
not def instanceof Ssa::CapturedEntryDefinition
315309
)
316310
}
317311

@@ -337,13 +331,10 @@ private module Cached {
337331
* ```
338332
*/
339333
cached
340-
predicate captureFlowOut(
341-
CallCfgNode call, Definition def, Cfg::BasicBlock bb, int i, Definition exit
342-
) {
334+
predicate captureFlowOut(CallCfgNode call, Definition def, Definition exit) {
343335
exists(LocalVariable v, Cfg::CfgScope scope |
344-
defReachesExitReadInInnerScope(def, bb, i, v, scope) and
345-
not SsaInput::variableRead(bb, i, v, false) and
346-
hasCapturedExitRead(exit, call, v, scope) // ?
336+
defReachesExitReadInInnerScope(def, v, scope) and
337+
hasCapturedExitRead(exit, call, v, scope)
347338
|
348339
// If the read happens inside a block, we restrict to the call that
349340
// contains the block
@@ -353,6 +344,50 @@ private module Cached {
353344
)
354345
}
355346

347+
// /**
348+
// * Holds if there is outgoing flow for a captured variable that is updated in a block.
349+
// * ```rb
350+
// * foo = 0
351+
// * bar {
352+
// * foo += 10
353+
// * }
354+
// * puts foo
355+
// * ```
356+
// */
357+
// cached
358+
// predicate captureFlowOut(
359+
// CallCfgNode call, Definition def, Cfg::BasicBlock bb, int i, Definition exit
360+
// ) {
361+
// exists(LocalVariable v, Cfg::CfgScope scope |
362+
// defReachesExitReadInInnerScope(def, bb, i, v, scope) and
363+
// not SsaInput::variableRead(bb, i, v, false) and
364+
// hasCapturedExitRead(exit, call, v, scope) // ?
365+
// |
366+
// // If the read happens inside a block, we restrict to the call that
367+
// // contains the block
368+
// not scope instanceof Block
369+
// or
370+
// scope = call.getExpr().(MethodCall).getBlock()
371+
// )
372+
// }
373+
pragma[nomagic]
374+
private predicate defReachesExitReadInInnerScope2(
375+
Definition def, Cfg::BasicBlock bb, int i, LocalVariable v, Cfg::CfgScope scope
376+
) {
377+
exists(Cfg::BasicBlock bb2, int i2 |
378+
adjacentDefRead(def, bb, i, bb2, i2) and
379+
def.getSourceVariable() = pragma[only_bind_into](v) and
380+
capturedExitRead(bb2, i2, pragma[only_bind_into](v)) and
381+
scope = bb.getScope().getOuterCfgScope*()
382+
)
383+
or
384+
exists(Cfg::BasicBlock bb2, int i2 |
385+
defReachesExitReadInInnerScope2(def, bb2, i2, v, scope) and
386+
adjacentDefRead(def, bb, i, bb2, i2) and
387+
SsaInput::variableRead(bb2, i2, v, false)
388+
)
389+
}
390+
356391
pragma[noinline]
357392
private predicate hasCapturedExitRead2(
358393
CallCfgNode call, Cfg::BasicBlock bb, int i, LocalVariable v, Cfg::CfgScope scope
@@ -366,7 +401,7 @@ private module Cached {
366401
Cfg::BasicBlock bb2, int i2, LocalVariable v
367402
) {
368403
exists(Cfg::CfgScope scope |
369-
defReachesExitReadInInnerScope(def, bb2, i2, v, scope) and
404+
defReachesExitReadInInnerScope2(def, bb2, i2, v, scope) and
370405
not SsaInput::variableRead(bb2, i2, v, false) and
371406
hasCapturedExitRead2(call, bb1, i1, v, scope) and
372407
ssaDefReachesRead(v, exit, bb1, i1)
@@ -380,7 +415,6 @@ private module Cached {
380415
or
381416
exists(Cfg::BasicBlock bbMid, int iMid |
382417
captureFlowOutSideEffects0(call, exit, bbMid, iMid, def, bb2, i2, v) and
383-
// defReachesExitReadInInnerScope(def, bb2, i2, v, scope) and
384418
adjacentDefRead(exit, bbMid, iMid, bb1, i1) and
385419
SsaInput::variableRead(bbMid, iMid, v, false)
386420
)

‎ruby/ql/test/library-tests/dataflow/array-flow/array-flow.expected

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -710,16 +710,16 @@ edges
710710
| array_flow.rb:399:10:399:10 | b [element 2] : | array_flow.rb:399:10:399:13 | ...[...] |
711711
| array_flow.rb:403:16:403:25 | call to source : | array_flow.rb:404:18:404:18 | a [element 2] : |
712712
| array_flow.rb:403:16:403:25 | call to source : | array_flow.rb:404:18:404:18 | a [element 2] : |
713+
| array_flow.rb:404:9:406:7 | ... = ... : | array_flow.rb:407:10:407:10 | x |
714+
| array_flow.rb:404:9:406:7 | ... = ... : | array_flow.rb:407:10:407:10 | x |
715+
| array_flow.rb:404:9:406:7 | __synth__0__1 : | array_flow.rb:404:9:406:7 | ... = ... : |
716+
| array_flow.rb:404:9:406:7 | __synth__0__1 : | array_flow.rb:404:9:406:7 | ... = ... : |
713717
| array_flow.rb:404:9:406:7 | __synth__0__1 : | array_flow.rb:405:14:405:14 | x |
714718
| array_flow.rb:404:9:406:7 | __synth__0__1 : | array_flow.rb:405:14:405:14 | x |
715-
| array_flow.rb:404:9:406:7 | __synth__0__1 : | array_flow.rb:405:14:405:14 | x : |
716-
| array_flow.rb:404:9:406:7 | __synth__0__1 : | array_flow.rb:405:14:405:14 | x : |
717719
| array_flow.rb:404:18:404:18 | a [element 2] : | array_flow.rb:404:9:406:7 | __synth__0__1 : |
718720
| array_flow.rb:404:18:404:18 | a [element 2] : | array_flow.rb:404:9:406:7 | __synth__0__1 : |
719721
| array_flow.rb:404:18:404:18 | a [element 2] : | array_flow.rb:408:10:408:10 | b [element 2] : |
720722
| array_flow.rb:404:18:404:18 | a [element 2] : | array_flow.rb:408:10:408:10 | b [element 2] : |
721-
| array_flow.rb:405:14:405:14 | x : | array_flow.rb:407:10:407:10 | x |
722-
| array_flow.rb:405:14:405:14 | x : | array_flow.rb:407:10:407:10 | x |
723723
| array_flow.rb:408:10:408:10 | b [element 2] : | array_flow.rb:408:10:408:13 | ...[...] |
724724
| array_flow.rb:408:10:408:10 | b [element 2] : | array_flow.rb:408:10:408:13 | ...[...] |
725725
| array_flow.rb:412:16:412:25 | call to source : | array_flow.rb:413:5:413:5 | a [element 2] : |
@@ -4230,14 +4230,14 @@ nodes
42304230
| array_flow.rb:399:10:399:13 | ...[...] | semmle.label | ...[...] |
42314231
| array_flow.rb:403:16:403:25 | call to source : | semmle.label | call to source : |
42324232
| array_flow.rb:403:16:403:25 | call to source : | semmle.label | call to source : |
4233+
| array_flow.rb:404:9:406:7 | ... = ... : | semmle.label | ... = ... : |
4234+
| array_flow.rb:404:9:406:7 | ... = ... : | semmle.label | ... = ... : |
42334235
| array_flow.rb:404:9:406:7 | __synth__0__1 : | semmle.label | __synth__0__1 : |
42344236
| array_flow.rb:404:9:406:7 | __synth__0__1 : | semmle.label | __synth__0__1 : |
42354237
| array_flow.rb:404:18:404:18 | a [element 2] : | semmle.label | a [element 2] : |
42364238
| array_flow.rb:404:18:404:18 | a [element 2] : | semmle.label | a [element 2] : |
42374239
| array_flow.rb:405:14:405:14 | x | semmle.label | x |
42384240
| array_flow.rb:405:14:405:14 | x | semmle.label | x |
4239-
| array_flow.rb:405:14:405:14 | x : | semmle.label | x : |
4240-
| array_flow.rb:405:14:405:14 | x : | semmle.label | x : |
42414241
| array_flow.rb:407:10:407:10 | x | semmle.label | x |
42424242
| array_flow.rb:407:10:407:10 | x | semmle.label | x |
42434243
| array_flow.rb:408:10:408:10 | b [element 2] : | semmle.label | b [element 2] : |

‎ruby/ql/test/library-tests/dataflow/capture-flow/CaptureFlow.expected

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ edges
2020
| capture_flow.rb:22:16:22:21 | self [@field] : | capture_flow.rb:22:16:22:21 | @field : |
2121
| capture_flow.rb:27:1:27:3 | [post] foo [@field] : | capture_flow.rb:29:10:29:12 | foo [@field] : |
2222
| capture_flow.rb:27:1:27:3 | [post] foo [@field] : | capture_flow.rb:29:10:29:12 | foo [@field] : |
23-
| capture_flow.rb:27:1:27:3 | [post] foo [@field] : | capture_flow.rb:30:5:30:7 | foo [@field] : |
24-
| capture_flow.rb:27:1:27:3 | [post] foo [@field] : | capture_flow.rb:30:5:30:7 | foo [@field] : |
2523
| capture_flow.rb:27:1:27:3 | [post] foo [@field] : | capture_flow.rb:33:6:33:8 | foo [@field] : |
2624
| capture_flow.rb:27:1:27:3 | [post] foo [@field] : | capture_flow.rb:33:6:33:8 | foo [@field] : |
2725
| capture_flow.rb:27:15:27:22 | call to taint : | capture_flow.rb:18:19:18:19 | x : |
@@ -34,8 +32,6 @@ edges
3432
| capture_flow.rb:29:10:29:12 | foo [@field] : | capture_flow.rb:29:10:29:22 | call to get_field |
3533
| capture_flow.rb:30:5:30:7 | [post] foo [@field] : | capture_flow.rb:33:6:33:8 | foo [@field] : |
3634
| capture_flow.rb:30:5:30:7 | [post] foo [@field] : | capture_flow.rb:33:6:33:8 | foo [@field] : |
37-
| capture_flow.rb:30:5:30:7 | foo [@field] : | capture_flow.rb:33:6:33:8 | foo [@field] : |
38-
| capture_flow.rb:30:5:30:7 | foo [@field] : | capture_flow.rb:33:6:33:8 | foo [@field] : |
3935
| capture_flow.rb:30:19:30:26 | call to taint : | capture_flow.rb:18:19:18:19 | x : |
4036
| capture_flow.rb:30:19:30:26 | call to taint : | capture_flow.rb:18:19:18:19 | x : |
4137
| capture_flow.rb:30:19:30:26 | call to taint : | capture_flow.rb:30:5:30:7 | [post] foo [@field] : |
@@ -81,8 +77,6 @@ nodes
8177
| capture_flow.rb:29:10:29:22 | call to get_field | semmle.label | call to get_field |
8278
| capture_flow.rb:30:5:30:7 | [post] foo [@field] : | semmle.label | [post] foo [@field] : |
8379
| capture_flow.rb:30:5:30:7 | [post] foo [@field] : | semmle.label | [post] foo [@field] : |
84-
| capture_flow.rb:30:5:30:7 | foo [@field] : | semmle.label | foo [@field] : |
85-
| capture_flow.rb:30:5:30:7 | foo [@field] : | semmle.label | foo [@field] : |
8680
| capture_flow.rb:30:19:30:26 | call to taint : | semmle.label | call to taint : |
8781
| capture_flow.rb:30:19:30:26 | call to taint : | semmle.label | call to taint : |
8882
| capture_flow.rb:33:6:33:8 | foo [@field] : | semmle.label | foo [@field] : |

‎ruby/ql/test/library-tests/dataflow/string-flow/string-flow.expected

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,9 +211,7 @@ edges
211211
| string_flow.rb:249:5:249:5 | a : | string_flow.rb:250:26:250:26 | a : |
212212
| string_flow.rb:249:16:249:16 | x : | string_flow.rb:249:24:249:24 | x |
213213
| string_flow.rb:250:26:250:26 | a : | string_flow.rb:250:10:250:28 | call to scrub |
214-
| string_flow.rb:250:26:250:26 | a : | string_flow.rb:252:10:252:10 | a : |
215214
| string_flow.rb:252:10:252:10 | a : | string_flow.rb:252:10:252:22 | call to scrub! |
216-
| string_flow.rb:252:10:252:10 | a : | string_flow.rb:253:21:253:21 | a : |
217215
| string_flow.rb:253:21:253:21 | a : | string_flow.rb:253:10:253:22 | call to scrub! |
218216
| string_flow.rb:255:9:255:18 | call to source : | string_flow.rb:256:5:256:5 | a : |
219217
| string_flow.rb:256:5:256:5 | a : | string_flow.rb:256:17:256:17 | x : |

‎ruby/ql/test/query-tests/security/cwe-117/LogInjection.expected

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,9 @@ edges
44
| app/controllers/users_controller.rb:15:19:15:30 | ...[...] : | app/controllers/users_controller.rb:17:19:17:41 | ... + ... |
55
| app/controllers/users_controller.rb:15:19:15:30 | ...[...] : | app/controllers/users_controller.rb:23:20:23:30 | unsanitized : |
66
| app/controllers/users_controller.rb:23:5:23:44 | ... = ... : | app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 |
7-
| app/controllers/users_controller.rb:23:5:23:44 | ... = ... : | app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 : |
87
| app/controllers/users_controller.rb:23:20:23:30 | unsanitized : | app/controllers/users_controller.rb:23:20:23:44 | call to sub : |
98
| app/controllers/users_controller.rb:23:20:23:44 | call to sub : | app/controllers/users_controller.rb:23:5:23:44 | ... = ... : |
109
| app/controllers/users_controller.rb:23:20:23:44 | call to sub : | app/controllers/users_controller.rb:27:16:27:39 | ... + ... |
11-
| app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 : | app/controllers/users_controller.rb:27:28:27:39 | unsanitized2 : |
12-
| app/controllers/users_controller.rb:27:28:27:39 | unsanitized2 : | app/controllers/users_controller.rb:27:16:27:39 | ... + ... |
1310
| app/controllers/users_controller.rb:33:5:33:31 | ... = ... : | app/controllers/users_controller.rb:34:33:34:43 | unsanitized |
1411
| app/controllers/users_controller.rb:33:5:33:31 | ... = ... : | app/controllers/users_controller.rb:35:33:35:55 | ... + ... |
1512
| app/controllers/users_controller.rb:33:19:33:25 | call to cookies : | app/controllers/users_controller.rb:33:19:33:31 | ...[...] : |
@@ -23,9 +20,7 @@ nodes
2320
| app/controllers/users_controller.rb:23:20:23:30 | unsanitized : | semmle.label | unsanitized : |
2421
| app/controllers/users_controller.rb:23:20:23:44 | call to sub : | semmle.label | call to sub : |
2522
| app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 | semmle.label | unsanitized2 |
26-
| app/controllers/users_controller.rb:25:7:25:18 | unsanitized2 : | semmle.label | unsanitized2 : |
2723
| app/controllers/users_controller.rb:27:16:27:39 | ... + ... | semmle.label | ... + ... |
28-
| app/controllers/users_controller.rb:27:28:27:39 | unsanitized2 : | semmle.label | unsanitized2 : |
2924
| app/controllers/users_controller.rb:33:5:33:31 | ... = ... : | semmle.label | ... = ... : |
3025
| app/controllers/users_controller.rb:33:19:33:25 | call to cookies : | semmle.label | call to cookies : |
3126
| app/controllers/users_controller.rb:33:19:33:31 | ...[...] : | semmle.label | ...[...] : |

0 commit comments

Comments
 (0)