Ruby: Make implicit this receivers explicit

This commit is contained in:
Kasper Svendsen
2023-05-09 13:28:34 +02:00
parent 3d5c8153ca
commit 6b8a7c2f6f
3 changed files with 17 additions and 13 deletions

View File

@@ -57,36 +57,40 @@ module Gem {
}
/** Gets the name of the gem */
string getName() { result = getSpecProperty("name").getConstantValue().getString() }
string getName() { result = this.getSpecProperty("name").getConstantValue().getString() }
/** Gets a path that is loaded when the gem is required */
private string getARequirePath() {
result = getSpecProperty(["require_paths", "require_path"]).getConstantValue().getString()
result =
this.getSpecProperty(["require_paths", "require_path"]).getConstantValue().getString()
or
not exists(getSpecProperty(["require_paths", "require_path"]).getConstantValue().getString()) and
not exists(
this.getSpecProperty(["require_paths", "require_path"]).getConstantValue().getString()
) and
result = "lib" // the default is "lib"
}
/** Gets a file that could be loaded when the gem is required. */
private File getAPossiblyRequiredFile() {
result = File.super.getParentContainer().getFolder(getARequirePath()).getAChildContainer*()
result =
File.super.getParentContainer().getFolder(this.getARequirePath()).getAChildContainer*()
}
/** Gets a class/module that is exported by this gem. */
private ModuleBase getAPublicModule() {
result.(Toplevel).getLocation().getFile() = getAPossiblyRequiredFile()
result.(Toplevel).getLocation().getFile() = this.getAPossiblyRequiredFile()
or
result = getAPublicModule().getAModule()
result = this.getAPublicModule().getAModule()
or
result = getAPublicModule().getAClass()
result = this.getAPublicModule().getAClass()
or
result = getAPublicModule().getStmt(_).(SingletonClass)
result = this.getAPublicModule().getStmt(_).(SingletonClass)
}
/** Gets a parameter from an exported method, which is an input to this gem. */
DataFlow::ParameterNode getAnInputParameter() {
exists(MethodBase method |
method = getAPublicModule().getAMethod() and
method = this.getAPublicModule().getAMethod() and
result.getParameter() = method.getAParameter()
|
method.isPublic()

View File

@@ -11,7 +11,7 @@ private import codeql.ruby.security.UrlRedirectCustomizations
private import codeql.ruby.security.SqlInjectionCustomizations
class RelevantFile extends File {
RelevantFile() { not getRelativePath().regexpMatch(".*/test(case)?s?/.*") }
RelevantFile() { not this.getRelativePath().regexpMatch(".*/test(case)?s?/.*") }
}
RemoteFlowSource relevantTaintSource(string kind) {

View File

@@ -38,11 +38,11 @@ class ApiUseTest extends InlineExpectationsTest {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "use" and // def tags are always optional
exists(DataFlow::Node n | relevantNode(_, n, location, tag) |
exists(DataFlow::Node n | this.relevantNode(_, n, location, tag) |
// Only report the longest path on this line:
value =
max(API::Node a2, Location l2, DataFlow::Node n2 |
relevantNode(a2, n2, l2, tag) and
this.relevantNode(a2, n2, l2, tag) and
l2.getFile() = location.getFile() and
l2.getEndLine() = location.getEndLine()
|
@@ -57,7 +57,7 @@ class ApiUseTest extends InlineExpectationsTest {
// We also permit optional annotations for any other path on the line.
// This is used to test subclass paths, which typically have a shorter canonical path.
override predicate hasOptionalResult(Location location, string element, string tag, string value) {
exists(API::Node a, DataFlow::Node n | relevantNode(a, n, location, tag) |
exists(API::Node a, DataFlow::Node n | this.relevantNode(a, n, location, tag) |
element = n.toString() and
value = getAPath(a, _)
)