Model the HTTParty http client

We currently model direct calls like

    HTTParty.get("http://example.com")

but we don't yet handle calls on other classes that have included the
`HTTParty` module, like

    class MyClient
      include HTTParty
    end
    MyClient.get("http://example.com")
This commit is contained in:
Harry Maclean
2021-09-27 13:06:47 +01:00
parent 2a4747b27e
commit 3a4ddc4b4e
5 changed files with 89 additions and 0 deletions

View File

@@ -0,0 +1,7 @@
| HTTParty.rb:5:1:5:35 | call to get | HTTParty.rb:5:1:5:35 | call to get |
| HTTParty.rb:7:1:7:55 | call to post | HTTParty.rb:7:1:7:55 | call to post |
| HTTParty.rb:9:1:9:54 | call to put | HTTParty.rb:9:1:9:54 | call to put |
| HTTParty.rb:11:1:11:56 | call to patch | HTTParty.rb:11:1:11:56 | call to patch |
| HTTParty.rb:15:9:15:46 | call to delete | HTTParty.rb:16:1:16:10 | call to body |
| HTTParty.rb:18:9:18:44 | call to head | HTTParty.rb:19:1:19:10 | call to body |
| HTTParty.rb:21:9:21:47 | call to options | HTTParty.rb:22:1:22:10 | call to body |

View File

@@ -0,0 +1,4 @@
import codeql.ruby.frameworks.http_clients.HTTParty
import codeql.ruby.DataFlow
query DataFlow::Node httpartyRequests(HTTPartyRequest e) { result = e.getResponseBody() }

View File

@@ -0,0 +1,31 @@
require "httparty"
# If the response body is not nil or an empty string, it will be parsed and returned directly.
HTTParty.get("http://example.com/")
HTTParty.post("http://example.com/", body: "some_data")
HTTParty.put("http://example.com/", body: "some_data")
HTTParty.patch("http://example.com/", body: "some_data")
# Otherwise, `HTTParty::Response` will be returned, which has a `#body` method.
resp5 = HTTParty.delete("http://example.com/")
resp5.body
resp6 = HTTParty.head("http://example.com/")
resp6.body
resp7 = HTTParty.options("http://example.com/")
resp7.body
# HTTParty methods can also be included in other classes.
# This is not yet modelled.
class MyClient
inlcude HTTParty
end
MyClient.get("http://example.com")