diff --git a/ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll b/ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll index dfe448e7b5b..517ba6fa700 100644 --- a/ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll +++ b/ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll @@ -48,16 +48,13 @@ module UnsafeDeserialization { } /** - * An argument in a call to `YAML.load` or `YAML.load_file`, considered a sink + * An argument in a call to `YAML.load`, considered a sink * for unsafe deserialization. The `YAML` module is an alias of `Psych` in * recent versions of Ruby. */ class YamlLoadArgument extends Sink { YamlLoadArgument() { - this = - API::getTopLevelMember(["YAML", "Psych"]) - .getAMethodCall(["load", "load_file"]) - .getArgument(0) + this = API::getTopLevelMember(["YAML", "Psych"]).getAMethodCall("load").getArgument(0) } }