hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Fix bug in disablesCertificateValidation

Browse Source
This commit is contained in:
Harry Maclean
2022-09-02 13:15:02 +12:00
parent 570a03a08f
commit 6fff02817d
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ruby/ql/lib/codeql/ruby/frameworks/ActiveResource.qll
View File

@@ -93,7 +93,13 @@ module ActiveResource {
/** Holds if this site value specifies HTTP rather than HTTPS. */
predicate disablesCertificateValidation() {
this.getAUrlPart().asExpr().getConstantValue().getString().regexpMatch("^http(^s)")
this.getAUrlPart()
.asExpr()
.(ExprNodes::AssignExprCfgNode)
.getRhs()
.getConstantValue()
.getString()
.regexpMatch("^http[^s].+")
}
}

2
ruby/ql/test/library-tests/frameworks/active_resource/ActiveResource.expected
View File

@@ -1,6 +1,6 @@
modelClasses
| active_resource.rb:1:1:3:3 | Person | active_resource.rb:2:3:2:11 | call to site= | false |
| active_resource.rb:29:1:31:3 | Post | active_resource.rb:30:3:30:11 | call to site= | false |
| active_resource.rb:29:1:31:3 | Post | active_resource.rb:30:3:30:11 | call to site= | true |
modelClassMethodCalls
| active_resource.rb:2:3:2:11 | call to site= |
| active_resource.rb:5:9:5:33 | call to new |