hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add SqlSanitization to Concepts and turn private

Browse Source
This commit is contained in:
Maiky
2023-05-15 15:56:52 +02:00
parent f46620c455
commit 3c00235375
3 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
ruby/ql/lib/codeql/ruby/Concepts.qll
View File

@@ -78,6 +78,19 @@ module SqlExecution {
}
}
/**
* A data-flow node that performs SQL sanitization.
*/
class SqlSanitization extends DataFlow::Node instanceof SqlSanitization::Range { }
/** Provides a class for modeling new SQL sanitization APIs. */
module SqlSanitization {
/**
* A data-flow node that performs SQL sanitization.
*/
abstract class Range extends DataFlow::Node { }
}
/**
* A data-flow node that executes a regular expression.
*

1
ruby/ql/lib/codeql/ruby/Frameworks.qll
View File

@@ -32,3 +32,4 @@ private import codeql.ruby.frameworks.Slim
private import codeql.ruby.frameworks.Sinatra
private import codeql.ruby.frameworks.Twirp
private import codeql.ruby.frameworks.Sqlite3
private import codeql.ruby.frameworks.Mysql2

4
ruby/ql/lib/codeql/ruby/security/SqlInjectionCustomizations.qll
View File

@@ -57,7 +57,7 @@ module SqlInjection {
/**
* A call to `Mysql2::Client.escape`, considered as a sanitizer.
*/
class Mysql2EscapeSanitization extends Sanitizer {
private class Mysql2EscapeSanitization extends Sanitizer {
Mysql2EscapeSanitization() {
this = API::getTopLevelMember("Mysql2").getMember("Client").getAMethodCall("escape")
}
@@ -66,7 +66,7 @@ module SqlInjection {
/**
* A call to `SQLite3::Database.quote`, considered as a sanitizer.
*/
class SQLite3EscapeSanitization extends Sanitizer {
private class SQLite3EscapeSanitization extends Sanitizer {
SQLite3EscapeSanitization() {
this = API::getTopLevelMember("SQLite3").getMember("Database").getAMethodCall("quote")
}