Ruby: Add regression test

This commit is contained in:
Tom Hvitved
2024-04-03 14:51:13 +02:00
parent cccb11f697
commit 137594cf36
3 changed files with 43 additions and 0 deletions

View File

@@ -0,0 +1 @@
| regressions.rb:2:1:2:9 | [post] call to reverse | regressions.rb:3:6:3:6 | x |

View File

@@ -0,0 +1,39 @@
private import codeql.ruby.dataflow.FlowSummary
private class ReverseSummary extends SimpleSummarizedCallable {
ReverseSummary() { this = "reverse" }
override predicate propagatesFlow(string input, string output, boolean preservesValue) {
input = "Argument[self].WithElement[any]" and
output = "ReturnValue" and
preservesValue = true
}
}
private module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source
.(DataFlow::PostUpdateNode)
.getPreUpdateNode()
.asExpr()
.getExpr()
.(MethodCall)
.getMethodName() = "reverse"
}
predicate isSink(DataFlow::Node sink) {
exists(MethodCall mc |
mc.getMethodName() = "sink" and
sink.asExpr().getExpr() = mc.getAnArgument()
)
}
}
/**
* This predicate should not have a result. We check that the flow summary for
* `reverse` does not get picked up by the `reverseStepThroughInputOutputAlias`
* logic in `DataFlowImplCommon.qll`.
*/
query predicate noReverseStepThroughInputOutputAlias(DataFlow::Node source, DataFlow::Node sink) {
DataFlow::Global<Config>::flow(source, sink)
}

View File

@@ -0,0 +1,3 @@
x = foo
x.reverse.bar
sink(x)