CFG: Handle ensure blocks without body/rescues

ql/src/codeql_ruby/controlflow/internal/ControlFlowGraphImpl.qll

@@ -1101,12 +1101,26 @@ module Trees {
               .lastEnsure(last, nec.getAnInnerCompatibleCompletion(), nec.getOuterCompletion(),
                 nec.getNestLevel())
         )
+      or
+      not exists(this.getBodyChild(_, _)) and
+      not exists(this.getRescue(_)) and
+      this.lastEnsure0(last, c)
     }
 
     final override predicate succ(AstNode pred, AstNode succ, Completion c) {
       pred = this and
-      first(this.getBodyChild(0, _), succ) and
-      c instanceof SimpleCompletion
+      c instanceof SimpleCompletion and
+      (
+        first(this.getBodyChild(0, _), succ)
+        or
+        not exists(this.getBodyChild(_, _)) and
+        (
+          first(this.getRescue(0), succ)
+          or
+          not exists(this.getRescue(_)) and
+          first(this.getEnsure(), succ)
+        )
+      )
       or
       // Normal left-to-right evaluation in the body
       exists(int i |

ql/test/library-tests/controlflow/graph/Cfg.expected

@@ -134,6 +134,9 @@ raise.rb:
 #  142| enter m12
 #-----|  -> b
 
+#  150| enter m13
+#-----|  -> Ensure
+
 break_ensure.rb:
 #    1| elements
 #-----|  -> elements
@@ -3271,6 +3274,9 @@ raise.rb:
 #  147| [ensure: raise] 3
 #-----|  -> [ensure: raise] Return
 
+#  151| Ensure
+#-----|  -> exit m13 (normal)
+
 break_ensure.rb:
 #    1| exit m1
 
@@ -3362,6 +3368,8 @@ raise.rb:
 
 #  142| exit m12
 
+#  150| exit m13
+
 break_ensure.rb:
 #    1| exit m1 (normal)
 #-----|  -> exit m1
@@ -3527,3 +3535,6 @@ raise.rb:
 
 #  142| exit m12 (normal)
 #-----|  -> exit m12
+
+#  150| exit m13 (normal)
+#-----|  -> exit m13