mirror of
https://github.com/github/codeql.git
synced 2026-02-17 23:43:42 +01:00
Ruby: remove YAML.load_file arg0 as an unsafe deserialization sink
This commit is contained in:
@@ -48,16 +48,13 @@ module UnsafeDeserialization {
|
||||
}
|
||||
|
||||
/**
|
||||
* An argument in a call to `YAML.load` or `YAML.load_file`, considered a sink
|
||||
* An argument in a call to `YAML.load`, considered a sink
|
||||
* for unsafe deserialization. The `YAML` module is an alias of `Psych` in
|
||||
* recent versions of Ruby.
|
||||
*/
|
||||
class YamlLoadArgument extends Sink {
|
||||
YamlLoadArgument() {
|
||||
this =
|
||||
API::getTopLevelMember(["YAML", "Psych"])
|
||||
.getAMethodCall(["load", "load_file"])
|
||||
.getArgument(0)
|
||||
this = API::getTopLevelMember(["YAML", "Psych"]).getAMethodCall("load").getArgument(0)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user