Skip to content

Ruby: Track types in data flow #15118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hvitved wants to merge 9 commits into from
Closed

Ruby: Track types in data flow #15118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
eb71b1d
Add test for erb flow
hmac Jan 4, 2024
efab388
Add WIP query for erb flow
hmac Jan 16, 2024
fc292cf
Update expected file
hmac Jan 16, 2024
a3a8af6
Ruby: Add basic modeling for ViewComponent
hmac Jan 17, 2024
c26fbab
Add more tests
hvitved Jan 17, 2024
93ab7b5
Ruby: Model flow through `ViewComponent` render methods
hvitved Jan 16, 2024
619fb9e
Add change note
hvitved Jan 22, 2024
d1fa338
Ruby: Track types in data flow
hvitved Dec 13, 2023
102fb65
temp
hvitved Jan 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl1.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl1.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
6 changes: 6 additions & 0 deletions python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,12 @@ deprecated private module Config implements FullStateConfigSig {
}

predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }

predicate isAdditionalTypedLocalFlowStep(Node node1, Node node2) { none() }

predicate isAdditionalTypedLocalFlowStep(Node node1, DataFlowType t1, Node node2, DataFlowType t2) {
none()
}
}

deprecated private import Impl<Config> as I
Expand Down
8 changes: 8 additions & 0 deletions ruby/ql/consistency-queries/DataFlowConsistency.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,14 @@ private module Input implements InputSig<RubyDataFlow> {
n.getASplit() instanceof Split::ConditionalCompletionSplit
)
}

predicate uniqueTypeExclude(Node n) {
n =
any(DataFlow::CallNode call |
Private::isStandardNewCall(call.getExprNode(), _, _) and
not call.getReceiver().asExpr().getExpr() instanceof ConstantReadAccess
)
}
}

import MakeConsistency<RubyDataFlow, RubyTaintTracking, Input>
4 changes: 4 additions & 0 deletions ruby/ql/lib/change-notes/2024-01-22-erb-render-flow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Flow is now tracked through Rails `render` calls, when the argument is a `ViewComponent`. In this case, data flow is tracked into the accompanying `.html.erb` file.
1 change: 1 addition & 0 deletions ruby/ql/lib/codeql/ruby/Frameworks.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,3 +38,4 @@ private import codeql.ruby.frameworks.Yaml
private import codeql.ruby.frameworks.Sequel
private import codeql.ruby.frameworks.Ldap
private import codeql.ruby.frameworks.Jwt
private import codeql.ruby.frameworks.ViewComponent
2 changes: 1 addition & 1 deletion ruby/ql/lib/codeql/ruby/ast/Call.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ class Call extends Expr instanceof CallImpl {
TCfgScope(result) = viableCallableLambda(c, _)
)
or
result = getTarget(this.getAControlFlowNode())
result = getTarget(TNormalCall(this.getAControlFlowNode()))
}

override AstNode getAChild(string pred) {
Expand Down
2 changes: 1 addition & 1 deletion ruby/ql/lib/codeql/ruby/dataflow/FlowSummary.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ deprecated class RequiredSummaryComponentStack = Impl::Private::RequiredSummaryC
*/
private module LibraryCallbackSummaries {
private predicate libraryCall(CfgNodes::ExprNodes::CallCfgNode call) {
not exists(getTarget(call))
not exists(getTarget(TNormalCall(call)))
}

private DataFlow::LocalSourceNode trackLambdaCreation(TypeTracker t) {
Expand Down
Loading