patch upper-case acronyms to be PascalCase

ruby/ql/lib/codeql/ruby/frameworks/Files.qll

@@ -69,7 +69,10 @@ abstract private class IOOrFileMethodCall extends DataFlow::CallNode {
   }
 
   /** Gets the API used to perform this call, either "IO" or "File" */
-  abstract string getAPI();
+  abstract string getApi();
+
+  /** DEPRECATED: Alias for getApi */
+  deprecated string getAPI() { result = getApi() }
 
   /** Gets a node representing the data read or written by this call */
   abstract DataFlow::Node getADataNodeImpl();
@@ -110,7 +113,10 @@ private class IOOrFileReadMethodCall extends IOOrFileMethodCall {
     )
   }
 
-  override string getAPI() { result = api }
+  override string getApi() { result = api }
+
+  /** DEPRECATED: Alias for getApi */
+  deprecated override string getAPI() { result = getApi() }
 
   override DataFlow::Node getADataNodeImpl() { result = this }
 
@@ -151,7 +157,10 @@ private class IOOrFileWriteMethodCall extends IOOrFileMethodCall {
     )
   }
 
-  override string getAPI() { result = api }
+  override string getApi() { result = api }
+
+  /** DEPRECATED: Alias for getApi */
+  deprecated override string getAPI() { result = getApi() }
 
   override DataFlow::Node getADataNodeImpl() { result = dataNode }
 
@@ -202,7 +211,7 @@ module IO {
    * that use a subclass of `IO` such as `File`.
    */
   class IOReader extends IOOrFileReadMethodCall {
-    IOReader() { this.getAPI() = "IO" }
+    IOReader() { this.getApi() = "IO" }
   }
 
   /**
@@ -221,7 +230,7 @@ module IO {
    * that use a subclass of `IO` such as `File`.
    */
   class IOWriter extends IOOrFileWriteMethodCall {
-    IOWriter() { this.getAPI() = "IO" }
+    IOWriter() { this.getApi() = "IO" }
   }
 
   /**
@@ -306,7 +315,7 @@ module File {
    * ```
    */
   class FileModuleReader extends IO::FileReader {
-    FileModuleReader() { this.getAPI() = "File" }
+    FileModuleReader() { this.getApi() = "File" }
 
     override DataFlow::Node getADataNode() { result = this.getADataNodeImpl() }
 

ruby/ql/lib/codeql/ruby/security/BadTagFilterQuery.qll

@@ -176,8 +176,8 @@ private module RegexpMatching {
 }
 
 /** A class to test whether a regular expression matches certain HTML tags. */
-class HTMLMatchingRegExp extends RegexpMatching::MatchedRegExp {
-  HTMLMatchingRegExp() {
+class HtmlMatchingRegExp extends RegexpMatching::MatchedRegExp {
+  HtmlMatchingRegExp() {
     // the regexp must mention "<" and ">" explicitly.
     forall(string angleBracket | angleBracket = ["<", ">"] |
       any(RegExpConstant term | term.getValue().matches("%" + angleBracket + "%")).getRootTerm() =
@@ -204,12 +204,15 @@ class HTMLMatchingRegExp extends RegexpMatching::MatchedRegExp {
   }
 }
 
+/** DEPRECATED: Alias for HtmlMatchingRegExp */
+deprecated class HTMLMatchingRegExp = HtmlMatchingRegExp;
+
 /**
  * Holds if `regexp` matches some HTML tags, but misses some HTML tags that it should match.
  *
  * When adding a new case to this predicate, make sure the test string used in `matches(..)` calls are present in `HTMLMatchingRegExp::test` / `HTMLMatchingRegExp::testWithGroups`.
  */
-predicate isBadRegexpFilter(HTMLMatchingRegExp regexp, string msg) {
+predicate isBadRegexpFilter(HtmlMatchingRegExp regexp, string msg) {
   // CVE-2021-33829 - matching both "<!-- foo -->" and "<!-- foo --!>", but in different capture groups
   regexp.matches("<!-- foo -->") and
   regexp.matches("<!-- foo --!>") and

ruby/ql/lib/codeql/ruby/security/ReflectedXSSQuery.qll

@@ -13,8 +13,8 @@ import codeql.ruby.TaintTracking
 /**
  * Provides a taint-tracking configuration for detecting "reflected server-side cross-site scripting" vulnerabilities.
  */
-module ReflectedXSS {
-  import XSS::ReflectedXSS
+module ReflectedXss {
+  import XSS::ReflectedXss
 
   /**
    * A taint-tracking configuration for detecting "reflected server-side cross-site scripting" vulnerabilities.
@@ -33,7 +33,10 @@ module ReflectedXSS {
     }
 
     override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
-      isAdditionalXSSTaintStep(node1, node2)
+      isAdditionalXssTaintStep(node1, node2)
     }
   }
 }
+
+/** DEPRECATED: Alias for ReflectedXss */
+deprecated module ReflectedXSS = ReflectedXss;

ruby/ql/lib/codeql/ruby/security/StoredXSSQuery.qll

@@ -11,8 +11,8 @@ import ruby
 import codeql.ruby.DataFlow
 import codeql.ruby.TaintTracking
 
-module StoredXSS {
-  import XSS::StoredXSS
+module StoredXss {
+  import XSS::StoredXss
 
   /**
    * A taint-tracking configuration for reasoning about Stored XSS.
@@ -34,7 +34,10 @@ module StoredXSS {
     }
 
     override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
-      isAdditionalXSSTaintStep(node1, node2)
+      isAdditionalXssTaintStep(node1, node2)
     }
   }
 }
+
+/** DEPRECATED: Alias for StoredXss */
+deprecated module StoredXSS = StoredXss;

ruby/ql/lib/codeql/ruby/security/XSS.qll

@@ -245,7 +245,7 @@ private module Shared {
   /**
    * An additional step that is preserves dataflow in the context of XSS.
    */
-  predicate isAdditionalXSSFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+  predicate isAdditionalXssFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     isFlowFromLocals(node1, node2)
     or
     isFlowFromControllerInstanceVariable(node1, node2)
@@ -254,6 +254,9 @@ private module Shared {
     or
     isFlowFromHelperMethod(node1, node2)
   }
+
+  /** DEPRECATED: Alias for isAdditionalXssFlowStep */
+  deprecated predicate isAdditionalXSSFlowStep = isAdditionalXssFlowStep/2;
 }
 
 /**
@@ -261,7 +264,7 @@ private module Shared {
  * "reflected cross-site scripting" vulnerabilities, as well as
  * extension points for adding your own.
  */
-module ReflectedXSS {
+module ReflectedXss {
   /** A data flow source for stored XSS vulnerabilities. */
   abstract class Source extends Shared::Source { }
 
@@ -277,7 +280,10 @@ module ReflectedXSS {
   /**
    * An additional step that is preserves dataflow in the context of reflected XSS.
    */
-  predicate isAdditionalXSSTaintStep = Shared::isAdditionalXSSFlowStep/2;
+  predicate isAdditionalXssTaintStep = Shared::isAdditionalXssFlowStep/2;
+
+  /** DEPRECATED: Alias for isAdditionalXssTaintStep */
+  deprecated predicate isAdditionalXSSTaintStep = isAdditionalXssTaintStep/2;
 
   /**
    * A source of remote user input, considered as a flow source.
@@ -285,6 +291,9 @@ module ReflectedXSS {
   class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
 }
 
+/** DEPRECATED: Alias for ReflectedXss */
+deprecated module ReflectedXSS = ReflectedXss;
+
 private module OrmTracking {
   /**
    * A data flow configuration to track flow from finder calls to field accesses.
@@ -298,7 +307,7 @@ private module OrmTracking {
     override predicate isSink(DataFlow2::Node sink) { sink instanceof DataFlow2::CallNode }
 
     override predicate isAdditionalFlowStep(DataFlow2::Node node1, DataFlow2::Node node2) {
-      Shared::isAdditionalXSSFlowStep(node1, node2)
+      Shared::isAdditionalXssFlowStep(node1, node2)
       or
       // Propagate flow through arbitrary method calls
       node2.(DataFlow2::CallNode).getReceiver() = node1
@@ -309,7 +318,7 @@ private module OrmTracking {
   }
 }
 
-module StoredXSS {
+module StoredXss {
   /** A data flow source for stored XSS vulnerabilities. */
   abstract class Source extends Shared::Source { }
 
@@ -325,7 +334,10 @@ module StoredXSS {
   /**
    * An additional step that preserves dataflow in the context of stored XSS.
    */
-  predicate isAdditionalXSSTaintStep = Shared::isAdditionalXSSFlowStep/2;
+  predicate isAdditionalXssTaintStep = Shared::isAdditionalXssFlowStep/2;
+
+  /** DEPRECATED: Alias for isAdditionalXssTaintStep */
+  deprecated predicate isAdditionalXSSTaintStep = isAdditionalXssTaintStep/2;
 
   private class OrmFieldAsSource extends Source instanceof DataFlow2::CallNode {
     OrmFieldAsSource() {
@@ -341,3 +353,6 @@ module StoredXSS {
   private class FileSystemReadAccessAsSource extends Source instanceof FileSystemReadAccess { }
   // TODO: Consider `FileNameSource` flowing to script tag `src` attributes and similar
 }
+
+/** DEPRECATED: Alias for StoredXss */
+deprecated module StoredXSS = StoredXss;

ruby/ql/src/queries/meta/internal/TaintMetrics.qll

@@ -25,7 +25,7 @@ DataFlow::Node relevantTaintSink(string kind) {
     or
     kind = "CommandInjection" and result instanceof CommandInjection::Sink
     or
-    kind = "XSS" and result instanceof ReflectedXSS::Sink
+    kind = "XSS" and result instanceof ReflectedXss::Sink
     or
     kind = "PathInjection" and result instanceof PathInjection::Sink
     or

ruby/ql/src/queries/security/cwe-079/ReflectedXSS.ql

@@ -18,7 +18,7 @@ import codeql.ruby.security.ReflectedXSSQuery
 import codeql.ruby.DataFlow
 import DataFlow::PathGraph
 
-from ReflectedXSS::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from ReflectedXss::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
   source.getNode(), "a user-provided value"

ruby/ql/src/queries/security/cwe-079/StoredXSS.ql

@@ -17,7 +17,7 @@ import codeql.ruby.security.StoredXSSQuery
 import codeql.ruby.DataFlow
 import DataFlow::PathGraph
 
-from StoredXSS::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from StoredXss::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@",
   source.getNode(), "stored value"

ruby/ql/src/queries/security/cwe-089/SqlInjection.ql

@@ -19,8 +19,8 @@ import codeql.ruby.dataflow.RemoteFlowSources
 import codeql.ruby.TaintTracking
 import DataFlow::PathGraph
 
-class SQLInjectionConfiguration extends TaintTracking::Configuration {
-  SQLInjectionConfiguration() { this = "SQLInjectionConfiguration" }
+class SqlInjectionConfiguration extends TaintTracking::Configuration {
+  SqlInjectionConfiguration() { this = "SQLInjectionConfiguration" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
@@ -32,7 +32,7 @@ class SQLInjectionConfiguration extends TaintTracking::Configuration {
   }
 }
 
-from SQLInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from SqlInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "This SQL query depends on $@.", source.getNode(),
   "a user-provided value"

ruby/ql/src/queries/security/cwe-116/BadTagFilter.ql

@@ -16,6 +16,6 @@
 
 import codeql.ruby.security.BadTagFilterQuery
 
-from HTMLMatchingRegExp regexp, string msg
+from HtmlMatchingRegExp regexp, string msg
 where msg = min(string m | isBadRegexpFilter(regexp, m) | m order by m.length(), m) // there might be multiple, we arbitrarily pick the shortest one
 select regexp, msg