hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: mass enable diff-informed data flow

Browse Source
This commit is contained in:
Asger F
2024-12-20 10:10:29 +01:00
parent 498bfd2160
commit 4dc632f742
52 changed files with 159 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ruby/ql/lib/codeql/ruby/experimental/UnicodeBypassValidationQuery.qll
View File

@@ -158,6 +158,8 @@ private module UnicodeBypassValidationConfig implements DataFlow::StateConfigSig
) and
state = PostValidationState()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/experimental/ZipSlipQuery.qll
View File

@@ -29,6 +29,8 @@ private module ZipSlipConfig implements DataFlow::ConfigSig {
}
predicate isBarrier(DataFlow::Node node) { node instanceof ZipSlip::Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

6
ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll
View File

@@ -118,6 +118,12 @@ private module ExconDisablesCertificateValidationConfig implements DataFlow::Con
predicate isSink(DataFlow::Node sink) {
sink = any(ExconHttpRequest req).getCertificateValidationControllingValue()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/http_clients/Excon.qll:74: Flow call outside 'select' clause
none()
}
}
private module ExconDisablesCertificateValidationFlow =

6
ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll
View File

@@ -99,6 +99,12 @@ private module FaradayDisablesCertificateValidationConfig implements DataFlow::S
predicate isSink(DataFlow::Node sink, FlowState state) {
sink = any(FaradayHttpRequest req).getCertificateValidationControllingValue(state)
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/http_clients/Faraday.qll:80: Flow call outside 'select' clause
none()
}
}
private module FaradayDisablesCertificateValidationFlow =

6
ruby/ql/lib/codeql/ruby/frameworks/http_clients/HttpClient.qll
View File

@@ -80,6 +80,12 @@ private module HttpClientDisablesCertificateValidationConfig implements DataFlow
predicate isSink(DataFlow::Node sink) {
sink = any(HttpClientRequest req).getCertificateValidationControllingValue()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/http_clients/HttpClient.qll:67: Flow call outside 'select' clause
none()
}
}
private module HttpClientDisablesCertificateValidationFlow =

6
ruby/ql/lib/codeql/ruby/frameworks/http_clients/Httparty.qll
View File

@@ -70,6 +70,12 @@ private module HttpartyDisablesCertificateValidationConfig implements DataFlow::
predicate isSink(DataFlow::Node sink) {
sink = any(HttpartyRequest req).getCertificateValidationControllingValue()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/http_clients/Httparty.qll:59: Flow call outside 'select' clause
none()
}
}
private module HttpartyDisablesCertificateValidationFlow =

6
ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll
View File

@@ -103,6 +103,12 @@ private module NetHttpDisablesCertificateValidationConfig implements DataFlow::C
predicate isSink(DataFlow::Node sink) {
sink = any(NetHttpRequest req).getCertificateValidationControllingValue()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/http_clients/NetHttp.qll:90: Flow call outside 'select' clause
none()
}
}
private module NetHttpDisablesCertificateValidationFlow =

7
ruby/ql/lib/codeql/ruby/frameworks/http_clients/OpenURI.qll
View File

@@ -110,6 +110,13 @@ private module OpenUriDisablesCertificateValidationConfig implements DataFlow::C
or
sink = any(OpenUriKernelOpenRequest req).getCertificateValidationControllingValue()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/http_clients/OpenURI.qll:48: Flow call outside 'select' clause
// lib/codeql/ruby/frameworks/http_clients/OpenURI.qll:95: Flow call outside 'select' clause
none()
}
}
private module OpenUriDisablesCertificateValidationFlow =

6
ruby/ql/lib/codeql/ruby/frameworks/http_clients/RestClient.qll
View File

@@ -73,6 +73,12 @@ private module RestClientDisablesCertificateValidationConfig implements DataFlow
predicate isSink(DataFlow::Node sink) {
sink = any(RestClientHttpRequest req).getCertificateValidationControllingValue()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/http_clients/RestClient.qll:60: Flow call outside 'select' clause
none()
}
}
private module RestClientDisablesCertificateValidationFlow =

6
ruby/ql/lib/codeql/ruby/frameworks/http_clients/Typhoeus.qll
View File

@@ -64,6 +64,12 @@ private module TyphoeusDisablesCertificateValidationConfig implements DataFlow::
predicate isSink(DataFlow::Node sink) {
sink = any(TyphoeusHttpRequest req).getCertificateValidationControllingValue()
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/http_clients/Typhoeus.qll:53: Flow call outside 'select' clause
none()
}
}
private module TyphoeusDisablesCertificateValidationFlow =

6
ruby/ql/lib/codeql/ruby/frameworks/stdlib/Pathname.qll
View File

@@ -52,6 +52,12 @@ module Pathname {
]
)
}
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/frameworks/stdlib/Pathname.qll:30: Flow call outside 'select' clause
none()
}
}
private module PathnameFlow = DataFlow::Global<PathnameConfig>;

2
ruby/ql/lib/codeql/ruby/security/CleartextLoggingQuery.qll
View File

@@ -27,6 +27,8 @@ private module Config implements DataFlow::ConfigSig {
cs.isAny() and
isSink(node)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/CleartextStorageQuery.qll
View File

@@ -26,6 +26,8 @@ private module Config implements DataFlow::ConfigSig {
cs.isAny() and
isSink(node)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/CodeInjectionQuery.qll
View File

@@ -31,6 +31,8 @@ private module Config implements DataFlow::StateConfigSig {
predicate isBarrierIn(DataFlow::Node node) { node instanceof Source }
int fieldFlowBranchLimit() { result = 10 }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/CommandInjectionQuery.qll
View File

@@ -23,6 +23,8 @@ private module Config implements DataFlow::ConfigSig {
node instanceof StringConstCompareBarrier or
node instanceof StringConstArrayInclusionCallBarrier
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

6
ruby/ql/lib/codeql/ruby/security/ConditionalBypassQuery.qll
View File

@@ -17,6 +17,12 @@ private module Config implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// src/experimental/cwe-807/ConditionalBypass.ql:78: Flow call outside 'select' clause
none()
}
}
/**

2
ruby/ql/lib/codeql/ruby/security/HardcodedDataInterpretedAsCodeQuery.qll
View File

@@ -33,6 +33,8 @@ private module Config implements DataFlow::StateConfigSig {
) and
stateTo = FlowState::Taint()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/HttpToFileAccessQuery.qll
View File

@@ -17,6 +17,8 @@ module HttpToFileAccessConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/ImproperLdapAuthQuery.qll
View File

@@ -13,6 +13,8 @@ private module ImproperLdapAuthConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/InsecureDownloadQuery.qll
View File

@@ -20,6 +20,8 @@ private module InsecureDownloadConfig implements DataFlow::StateConfigSig {
predicate isSink(DataFlow::Node sink, FlowState label) { sink.(Sink).getAFlowLabel() = label }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/InsecureRandomnessQuery.qll
View File

@@ -13,6 +13,8 @@ private module InsecureRandomnessConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/KernelOpenQuery.qll
View File

@@ -85,6 +85,8 @@ private module KernelOpenConfig implements DataFlow::ConfigSig {
node instanceof StringConstArrayInclusionCallBarrier or
node instanceof Sanitizer
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/LdapInjectionQuery.qll
View File

@@ -26,6 +26,8 @@ private module LdapInjectionConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
LI::isAdditionalFlowStep(node1, node2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/LogInjectionQuery.qll
View File

@@ -73,6 +73,8 @@ private module LogInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/MassAssignmentQuery.qll
View File

@@ -59,6 +59,8 @@ private module Config implements DataFlow::StateConfigSig {
state2 instanceof FlowState::Permitted
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/** Taint tracking for reasoning about user input used for mass assignment. */

2
ruby/ql/lib/codeql/ruby/security/PathInjectionQuery.qll
View File

@@ -20,6 +20,8 @@ private module PathInjectionConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) {
node instanceof Path::PathSanitization or node instanceof PathInjection::Sanitizer
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/ReflectedXSSQuery.qll
View File

@@ -22,6 +22,8 @@ private module ReflectedXssConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
RX::isAdditionalXssTaintStep(node1, node2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

6
ruby/ql/lib/codeql/ruby/security/SensitiveGetQueryQuery.qll
View File

@@ -16,6 +16,12 @@ private module SensitiveGetQueryConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof Source }
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// src/queries/security/cwe-598/SensitiveGetQuery.ql:21: Column 3 does not select a source or sink originating from the flow call on line 20
none()
}
}
/**

2
ruby/ql/lib/codeql/ruby/security/ServerSideRequestForgeryQuery.qll
View File

@@ -22,6 +22,8 @@ private module ServerSideRequestForgeryConfig implements DataFlow::ConfigSig {
node instanceof StringConstCompareBarrier or
node instanceof StringConstArrayInclusionCallBarrier
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/SqlInjectionQuery.qll
View File

@@ -13,6 +13,8 @@ private module SqlInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/StackTraceExposureQuery.qll
View File

@@ -17,6 +17,8 @@ private module StackTraceExposureConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/StoredXSSQuery.qll
View File

@@ -32,6 +32,8 @@ private module StoredXssConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
isAdditionalXssTaintStep(node1, node2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/TaintedFormatStringQuery.qll
View File

@@ -19,6 +19,8 @@ module TaintedFormatStringConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/TemplateInjectionQuery.qll
View File

@@ -13,6 +13,8 @@ private module TemplateInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/UnsafeCodeConstructionQuery.qll
View File

@@ -24,6 +24,8 @@ private module UnsafeCodeConstructionConfig implements DataFlow::ConfigSig {
// override to require the path doesn't have unmatched return steps
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationQuery.qll
View File

@@ -17,6 +17,8 @@ private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeDeserialization::Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof UnsafeDeserialization::Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/UnsafeHtmlConstructionQuery.qll
View File

@@ -21,6 +21,8 @@ private module UnsafeHtmlConstructionConfig implements DataFlow::ConfigSig {
// override to require the path doesn't have unmatched return steps
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/UnsafeShellCommandConstructionQuery.qll
View File

@@ -26,6 +26,8 @@ private module UnsafeShellCommandConstructionConfig implements DataFlow::ConfigS
// override to require the path doesn't have unmatched return steps
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/UrlRedirectQuery.qll
View File

@@ -22,6 +22,8 @@ private module UrlRedirectConfig implements DataFlow::ConfigSig {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
UrlRedirect::isAdditionalTaintStep(node1, node2)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

12
ruby/ql/lib/codeql/ruby/security/WeakSensitiveDataHashingQuery.qll
View File

@@ -28,6 +28,12 @@ module NormalHashFunction {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/security/WeakSensitiveDataHashingQuery.qll:79: Flow call outside 'select' clause
none()
}
}
/** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on sensitive data" vulnerabilities. */
@@ -54,6 +60,12 @@ module ComputationallyExpensiveHashFunction {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() {
// TODO(diff-informed): Manually verify if config can be diff-informed.
// lib/codeql/ruby/security/WeakSensitiveDataHashingQuery.qll:86: Flow call outside 'select' clause
none()
}
}
/** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on passwords" vulnerabilities. */

2
ruby/ql/lib/codeql/ruby/security/XpathInjectionQuery.qll
View File

@@ -24,6 +24,8 @@ private module XpathInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/regexp/MissingFullAnchorQuery.qll
View File

@@ -17,6 +17,8 @@ private module MissingFullAnchorConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll
View File

@@ -18,6 +18,8 @@ private module PolynomialReDoSConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/lib/codeql/ruby/security/regexp/RegExpInjectionQuery.qll
View File

@@ -17,6 +17,8 @@ private module RegExpInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof RegExpInjection::Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof RegExpInjection::Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
ruby/ql/src/experimental/CWE-522-DecompressionBombs/DecompressionBombs.ql
View File

@@ -57,6 +57,8 @@ module BombsConfig implements DataFlow::ConfigSig {
nodeTo = cn
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
module Bombs = TaintTracking::Global<BombsConfig>;

2
ruby/ql/src/experimental/decompression-api/DecompressionApi.ql
View File

@@ -39,6 +39,8 @@ private module DecompressionApiConfig implements DataFlow::ConfigSig {
// our Decompression APIs defined above will be the sinks we use for this query
predicate isSink(DataFlow::Node sink) { sink instanceof DecompressionApiUse }
predicate observeDiffInformedIncrementalMode() { any() }
}
private module DecompressionApiFlow = TaintTracking::Global<DecompressionApiConfig>;

2
ruby/ql/src/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.ql
View File

@@ -86,6 +86,8 @@ private module HttpVerbConfig implements DataFlow::ConfigSig {
exists(ExprNodes::ConditionalExprCfgNode c | c.getCondition() = sink.asExpr()) or
exists(ExprNodes::CaseExprCfgNode c | c.getValue() = sink.asExpr())
}
predicate observeDiffInformedIncrementalMode() { any() }
}
private module HttpVerbFlow = TaintTracking::Global<HttpVerbConfig>;

2
ruby/ql/src/experimental/weak-params/WeakParams.ql
View File

@@ -46,6 +46,8 @@ private module WeakParamsConfig implements DataFlow::ConfigSig {
// the sink is an instance of a Model class that receives a method call
predicate isSink(DataFlow::Node node) { node = any(PersistentWriteAccess a).getValue() }
predicate observeDiffInformedIncrementalMode() { any() }
}
private module WeakParamsFlow = TaintTracking::Global<WeakParamsConfig>;

2
ruby/ql/src/queries/meta/TaintedNodes.ql
View File

@@ -19,6 +19,8 @@ private module BasicTaintConfig implements DataFlow::ConfigSig {
// To reduce noise from synthetic nodes, only count nodes that have an associated expression.
exists(node.asExpr().getExpr())
}
predicate observeDiffInformedIncrementalMode() { any() }
}
private module BasicTaintFlow = TaintTracking::Global<BasicTaintConfig>;

2
ruby/ql/src/queries/security/cwe-611/Xxe.ql
View File

@@ -31,6 +31,8 @@ private module XxeConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeXxeSink }
predicate observeDiffInformedIncrementalMode() { any() }
}
private module XxeFlow = TaintTracking::Global<XxeConfig>;

2
ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql
View File

@@ -54,6 +54,8 @@ private module PermissivePermissionsConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) {
exists(FileSystemPermissionModification mod | mod.getAPermissionNode() = sink)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
private module PermissivePermissionsFlow = DataFlow::Global<PermissivePermissionsConfig>;

2
ruby/ql/src/queries/security/cwe-798/HardcodedCredentials.ql
View File

@@ -147,6 +147,8 @@ private module HardcodedCredentialsConfig implements DataFlow::ConfigSig {
binop.getExpr() instanceof AddExpr
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
private module HardcodedCredentialsFlow = DataFlow::Global<HardcodedCredentialsConfig>;