mirror of
https://github.com/github/codeql.git
synced 2026-04-26 09:15:12 +02:00
Merge remote-tracking branch 'origin/main' into nickrolfe/regex_injection
This commit is contained in:
Nick Rolfe
@@ -41,8 +41,8 @@ break_ensure.rb:
|
||||
#-----| -> do ...
|
||||
|
||||
# 3| ... > ...
|
||||
#-----| raise -> for ... in ...
|
||||
#-----| true -> break
|
||||
#-----| raise -> for ... in ...
|
||||
#-----| false -> if ...
|
||||
|
||||
# 3| element
|
||||
@@ -580,12 +580,12 @@ cfg.html.erb:
|
||||
# 12| self
|
||||
#-----| -> call to a
|
||||
|
||||
# 12| Pair
|
||||
#-----| -> call to link_to
|
||||
|
||||
# 12| :id
|
||||
#-----| -> "a"
|
||||
|
||||
# 12| Pair
|
||||
#-----| -> call to link_to
|
||||
|
||||
# 12| "a"
|
||||
#-----| -> Pair
|
||||
|
||||
@@ -813,12 +813,12 @@ cfg.rb:
|
||||
# 23| 1
|
||||
#-----| -> ... + ...
|
||||
|
||||
# 25| 2
|
||||
#-----| -> { ... }
|
||||
|
||||
# 25| call to times
|
||||
#-----| -> self
|
||||
|
||||
# 25| 2
|
||||
#-----| -> { ... }
|
||||
|
||||
# 25| enter { ... }
|
||||
#-----| -> x
|
||||
|
||||
@@ -1493,12 +1493,12 @@ cfg.rb:
|
||||
# 97| "d"
|
||||
#-----| -> Pair
|
||||
|
||||
# 97| Pair
|
||||
#-----| -> {...}
|
||||
|
||||
# 97| :e
|
||||
#-----| -> "f"
|
||||
|
||||
# 97| Pair
|
||||
#-----| -> {...}
|
||||
|
||||
# 97| "f"
|
||||
#-----| -> Pair
|
||||
|
||||
@@ -1619,12 +1619,12 @@ cfg.rb:
|
||||
# 110| type
|
||||
#-----| -> #{...}
|
||||
|
||||
# 113| ... if ...
|
||||
#-----| -> C
|
||||
|
||||
# 113| call to puts
|
||||
#-----| -> ... if ...
|
||||
|
||||
# 113| ... if ...
|
||||
#-----| -> C
|
||||
|
||||
# 113| self
|
||||
#-----| -> "hi"
|
||||
|
||||
@@ -1826,9 +1826,6 @@ cfg.rb:
|
||||
# 134| EmptyModule
|
||||
#-----| -> ... rescue ...
|
||||
|
||||
# 136| ... rescue ...
|
||||
#-----| -> 1
|
||||
|
||||
# 136| ... / ...
|
||||
#-----| raise -> self
|
||||
#-----| -> __synth__0
|
||||
@@ -1836,6 +1833,9 @@ cfg.rb:
|
||||
# 136| 1
|
||||
#-----| -> 0
|
||||
|
||||
# 136| ... rescue ...
|
||||
#-----| -> 1
|
||||
|
||||
# 136| 0
|
||||
#-----| -> ... / ...
|
||||
|
||||
@@ -2398,7 +2398,7 @@ cfg.rb:
|
||||
#-----| -> yield ...
|
||||
|
||||
# 194| call to run_block
|
||||
#-----| -> exit cfg.rb (normal)
|
||||
#-----| -> forward_param
|
||||
|
||||
# 194| self
|
||||
#-----| -> { ... }
|
||||
@@ -2426,6 +2426,35 @@ cfg.rb:
|
||||
# 194| x
|
||||
#-----| -> call to puts
|
||||
|
||||
# 196| enter forward_param
|
||||
#-----| -> a
|
||||
|
||||
# 196| forward_param
|
||||
#-----| -> exit cfg.rb (normal)
|
||||
|
||||
# 196| exit forward_param
|
||||
|
||||
# 196| exit forward_param (normal)
|
||||
#-----| -> exit forward_param
|
||||
|
||||
# 196| a
|
||||
#-----| -> b
|
||||
|
||||
# 196| b
|
||||
#-----| -> ...
|
||||
|
||||
# 196| ...
|
||||
#-----| -> self
|
||||
|
||||
# 197| call to bar
|
||||
#-----| -> exit forward_param (normal)
|
||||
|
||||
# 197| self
|
||||
#-----| -> b
|
||||
|
||||
# 197| b
|
||||
#-----| -> call to bar
|
||||
|
||||
desugar.rb:
|
||||
# 1| enter m1
|
||||
#-----| -> x
|
||||
@@ -2679,12 +2708,12 @@ desugar.rb:
|
||||
# 18| __synth__2
|
||||
#-----| -> __synth__3
|
||||
|
||||
# 18| ... + ...
|
||||
#-----| -> ... = ...
|
||||
|
||||
# 18| call to baz
|
||||
#-----| -> 3
|
||||
|
||||
# 18| ... + ...
|
||||
#-----| -> ... = ...
|
||||
|
||||
# 18| x
|
||||
#-----| -> call to baz
|
||||
|
||||
@@ -5047,12 +5076,12 @@ raise.rb:
|
||||
# 155| elem
|
||||
#-----| -> element
|
||||
|
||||
# 155| ... if ...
|
||||
#-----| -> exit { ... } (normal)
|
||||
|
||||
# 155| call to raise
|
||||
#-----| raise -> exit { ... } (abnormal)
|
||||
|
||||
# 155| ... if ...
|
||||
#-----| -> exit { ... } (normal)
|
||||
|
||||
# 155| self
|
||||
#-----| -> ""
|
||||
|
||||
|
||||
324
ruby/ql/test/library-tests/controlflow/graph/Nodes.expected
Normal file
324
ruby/ql/test/library-tests/controlflow/graph/Nodes.expected
Normal file
@@ -0,0 +1,324 @@
|
||||
callsWithNoArguments
|
||||
| break_ensure.rb:8:6:8:18 | call to nil? |
|
||||
| break_ensure.rb:20:10:20:22 | [ensure: break] call to nil? |
|
||||
| break_ensure.rb:20:10:20:22 | [ensure: raise] call to nil? |
|
||||
| break_ensure.rb:20:10:20:22 | call to nil? |
|
||||
| break_ensure.rb:29:8:29:20 | call to nil? |
|
||||
| break_ensure.rb:35:12:35:12 | [ensure: raise] call to x |
|
||||
| break_ensure.rb:35:12:35:12 | [ensure: return] call to x |
|
||||
| break_ensure.rb:35:12:35:12 | call to x |
|
||||
| case.rb:2:8:2:9 | call to x1 |
|
||||
| case.rb:3:21:3:22 | call to x2 |
|
||||
| cfg.html.erb:12:24:12:24 | call to a |
|
||||
| cfg.html.erb:15:32:15:32 | call to a |
|
||||
| cfg.html.erb:16:32:16:32 | call to b |
|
||||
| cfg.html.erb:18:17:18:22 | call to admin? |
|
||||
| cfg.html.erb:19:32:19:32 | call to d |
|
||||
| cfg.html.erb:21:32:21:32 | call to e |
|
||||
| cfg.html.erb:29:8:29:17 | call to collection |
|
||||
| cfg.html.erb:29:8:31:10 | call to each |
|
||||
| cfg.rb:25:1:25:22 | call to times |
|
||||
| cfg.rb:29:1:29:24 | call to new |
|
||||
| cfg.rb:29:17:29:22 | call to call |
|
||||
| cfg.rb:60:17:60:17 | call to b |
|
||||
| cfg.rb:62:7:62:12 | * ... |
|
||||
| cfg.rb:62:17:62:27 | * ... |
|
||||
| cfg.rb:98:10:98:15 | ** ... |
|
||||
| cfg.rb:98:30:98:35 | ** ... |
|
||||
| cfg.rb:138:17:138:23 | * ... |
|
||||
| cfg.rb:141:1:141:8 | call to itself |
|
||||
| cfg.rb:143:10:143:21 | call to itself |
|
||||
| cfg.rb:147:10:147:14 | call to super |
|
||||
| cfg.rb:147:10:147:22 | call to print |
|
||||
| cfg.rb:151:9:151:17 | call to new |
|
||||
| cfg.rb:158:16:158:21 | * ... |
|
||||
| cfg.rb:160:22:160:29 | call to __FILE__ |
|
||||
| cfg.rb:167:5:167:10 | ! ... |
|
||||
| cfg.rb:168:5:168:8 | - ... |
|
||||
| cfg.rb:194:1:194:23 | call to run_block |
|
||||
| desugar.rb:6:3:6:7 | call to foo |
|
||||
| desugar.rb:10:3:10:7 | call to foo |
|
||||
| desugar.rb:14:3:14:7 | call to foo |
|
||||
| desugar.rb:14:3:14:13 | call to count |
|
||||
| desugar.rb:18:3:18:7 | call to foo |
|
||||
| desugar.rb:18:12:18:16 | call to bar |
|
||||
| desugar.rb:18:19:18:23 | call to baz |
|
||||
| desugar.rb:22:10:22:10 | call to z |
|
||||
| desugar.rb:22:18:22:29 | * ... |
|
||||
| desugar.rb:26:6:26:11 | * ... |
|
||||
| desugar.rb:26:15:26:25 | * ... |
|
||||
| ifs.rb:4:30:4:38 | [false] ! ... |
|
||||
| ifs.rb:4:30:4:38 | [true] ! ... |
|
||||
| ifs.rb:20:9:20:10 | - ... |
|
||||
| ifs.rb:41:6:41:10 | [false] ! ... |
|
||||
| loops.rb:25:3:27:5 | call to each |
|
||||
| raise.rb:155:3:155:50 | call to each |
|
||||
| raise.rb:155:37:155:48 | call to nil? |
|
||||
| raise.rb:159:3:163:5 | call to foo |
|
||||
positionalArguments
|
||||
| break_ensure.rb:3:8:3:18 | ... > ... | break_ensure.rb:3:18:3:18 | 0 |
|
||||
| break_ensure.rb:9:5:9:23 | call to puts | break_ensure.rb:9:10:9:23 | "elements nil" |
|
||||
| break_ensure.rb:16:10:16:20 | ... > ... | break_ensure.rb:16:20:16:20 | 0 |
|
||||
| break_ensure.rb:21:9:21:27 | [ensure: break] call to puts | break_ensure.rb:21:14:21:27 | [ensure: break] "elements nil" |
|
||||
| break_ensure.rb:21:9:21:27 | [ensure: raise] call to puts | break_ensure.rb:21:14:21:27 | [ensure: raise] "elements nil" |
|
||||
| break_ensure.rb:21:9:21:27 | call to puts | break_ensure.rb:21:14:21:27 | "elements nil" |
|
||||
| break_ensure.rb:35:12:35:16 | ... > ... | break_ensure.rb:35:16:35:16 | 0 |
|
||||
| break_ensure.rb:35:12:35:16 | [ensure: raise] ... > ... | break_ensure.rb:35:16:35:16 | [ensure: raise] 0 |
|
||||
| break_ensure.rb:35:12:35:16 | [ensure: return] ... > ... | break_ensure.rb:35:16:35:16 | [ensure: return] 0 |
|
||||
| break_ensure.rb:41:3:41:13 | call to puts | break_ensure.rb:41:8:41:13 | "Done" |
|
||||
| break_ensure.rb:47:10:47:20 | ... > ... | break_ensure.rb:47:20:47:20 | 1 |
|
||||
| break_ensure.rb:48:9:48:16 | call to raise | break_ensure.rb:48:15:48:16 | "" |
|
||||
| break_ensure.rb:51:10:51:20 | ... > ... | break_ensure.rb:51:20:51:20 | 0 |
|
||||
| break_ensure.rb:51:10:51:20 | [ensure: raise] ... > ... | break_ensure.rb:51:20:51:20 | [ensure: raise] 0 |
|
||||
| case.rb:3:29:3:37 | call to puts | case.rb:3:34:3:37 | "x2" |
|
||||
| case.rb:4:17:4:24 | call to puts | case.rb:4:22:4:24 | "2" |
|
||||
| cfg.html.erb:6:9:6:58 | call to stylesheet_link_tag | cfg.html.erb:6:29:6:41 | "application" |
|
||||
| cfg.html.erb:6:9:6:58 | call to stylesheet_link_tag | cfg.html.erb:6:44:6:58 | Pair |
|
||||
| cfg.html.erb:12:11:12:33 | call to link_to | cfg.html.erb:12:19:12:21 | "A" |
|
||||
| cfg.html.erb:12:11:12:33 | call to link_to | cfg.html.erb:12:24:12:24 | call to a |
|
||||
| cfg.html.erb:12:11:12:33 | call to link_to | cfg.html.erb:12:27:12:33 | Pair |
|
||||
| cfg.html.erb:15:19:15:32 | call to link_to | cfg.html.erb:15:27:15:29 | "B" |
|
||||
| cfg.html.erb:15:19:15:32 | call to link_to | cfg.html.erb:15:32:15:32 | call to a |
|
||||
| cfg.html.erb:16:19:16:32 | call to link_to | cfg.html.erb:16:27:16:29 | "C" |
|
||||
| cfg.html.erb:16:19:16:32 | call to link_to | cfg.html.erb:16:32:16:32 | call to b |
|
||||
| cfg.html.erb:19:19:19:32 | call to link_to | cfg.html.erb:19:27:19:29 | "D" |
|
||||
| cfg.html.erb:19:19:19:32 | call to link_to | cfg.html.erb:19:32:19:32 | call to d |
|
||||
| cfg.html.erb:21:19:21:32 | call to link_to | cfg.html.erb:21:27:21:29 | "E" |
|
||||
| cfg.html.erb:21:19:21:32 | call to link_to | cfg.html.erb:21:32:21:32 | call to e |
|
||||
| cfg.rb:7:1:7:21 | call to [] | cfg.rb:7:4:7:12 | :"one#{...}" |
|
||||
| cfg.rb:7:1:7:21 | call to [] | cfg.rb:7:14:7:20 | :"another" |
|
||||
| cfg.rb:9:1:9:21 | call to [] | cfg.rb:9:4:9:12 | "one#{...}" |
|
||||
| cfg.rb:9:1:9:21 | call to [] | cfg.rb:9:14:9:20 | "another" |
|
||||
| cfg.rb:12:3:12:8 | call to puts | cfg.rb:12:8:12:8 | 4 |
|
||||
| cfg.rb:16:3:16:14 | call to puts | cfg.rb:16:8:16:14 | "hello" |
|
||||
| cfg.rb:20:3:20:14 | call to puts | cfg.rb:20:8:20:14 | "world" |
|
||||
| cfg.rb:23:1:23:6 | ... + ... | cfg.rb:23:6:23:6 | 1 |
|
||||
| cfg.rb:25:15:25:20 | call to puts | cfg.rb:25:20:25:20 | x |
|
||||
| cfg.rb:27:1:27:11 | call to puts | cfg.rb:27:6:27:11 | &... |
|
||||
| cfg.rb:39:1:39:12 | call to puts | cfg.rb:39:11:39:12 | 42 |
|
||||
| cfg.rb:42:15:42:24 | call to puts | cfg.rb:42:20:42:24 | "one" |
|
||||
| cfg.rb:43:21:43:31 | call to puts | cfg.rb:43:26:43:31 | "some" |
|
||||
| cfg.rb:44:8:44:18 | call to puts | cfg.rb:44:13:44:18 | "many" |
|
||||
| cfg.rb:48:8:48:13 | ... == ... | cfg.rb:48:13:48:13 | 1 |
|
||||
| cfg.rb:48:20:48:29 | call to puts | cfg.rb:48:25:48:29 | "one" |
|
||||
| cfg.rb:49:8:49:13 | ... == ... | cfg.rb:49:13:49:13 | 0 |
|
||||
| cfg.rb:49:16:49:20 | ... > ... | cfg.rb:49:20:49:20 | 1 |
|
||||
| cfg.rb:49:27:49:37 | call to puts | cfg.rb:49:32:49:37 | "some" |
|
||||
| cfg.rb:60:17:60:22 | ... < ... | cfg.rb:60:21:60:22 | 10 |
|
||||
| cfg.rb:62:4:62:4 | call to [] | cfg.rb:62:4:62:4 | 0 |
|
||||
| cfg.rb:62:7:62:12 | call to [] | cfg.rb:62:7:62:12 | 1 |
|
||||
| cfg.rb:62:8:62:8 | call to [] | cfg.rb:62:8:62:8 | 0 |
|
||||
| cfg.rb:62:11:62:11 | call to [] | cfg.rb:62:11:62:11 | 1 |
|
||||
| cfg.rb:62:17:62:27 | call to [] | cfg.rb:62:18:62:18 | 1 |
|
||||
| cfg.rb:62:17:62:27 | call to [] | cfg.rb:62:21:62:26 | call to [] |
|
||||
| cfg.rb:62:21:62:26 | call to [] | cfg.rb:62:22:62:22 | 2 |
|
||||
| cfg.rb:62:21:62:26 | call to [] | cfg.rb:62:25:62:25 | 3 |
|
||||
| cfg.rb:64:5:64:10 | call to puts | cfg.rb:64:10:64:10 | a |
|
||||
| cfg.rb:65:5:65:10 | call to puts | cfg.rb:65:10:65:10 | b |
|
||||
| cfg.rb:67:11:67:19 | call to [] | cfg.rb:67:12:67:12 | 1 |
|
||||
| cfg.rb:67:11:67:19 | call to [] | cfg.rb:67:15:67:15 | 2 |
|
||||
| cfg.rb:67:11:67:19 | call to [] | cfg.rb:67:18:67:18 | 3 |
|
||||
| cfg.rb:68:3:68:15 | call to puts | cfg.rb:68:8:68:15 | ...[...] |
|
||||
| cfg.rb:68:8:68:15 | ...[...] | cfg.rb:68:14:68:14 | 2 |
|
||||
| cfg.rb:70:5:70:16 | call to puts | cfg.rb:70:10:70:16 | "silly" |
|
||||
| cfg.rb:75:4:75:8 | ... < ... | cfg.rb:75:8:75:8 | 0 |
|
||||
| cfg.rb:75:23:75:28 | ... > ... | cfg.rb:75:27:75:28 | 10 |
|
||||
| cfg.rb:83:3:83:11 | call to puts | cfg.rb:83:8:83:11 | "ok" |
|
||||
| cfg.rb:85:3:85:12 | call to puts | cfg.rb:85:8:85:12 | "end" |
|
||||
| cfg.rb:90:10:90:26 | call to [] | cfg.rb:90:11:90:13 | 1.4 |
|
||||
| cfg.rb:90:10:90:26 | call to [] | cfg.rb:90:16:90:18 | 2.5 |
|
||||
| cfg.rb:90:10:90:26 | call to [] | cfg.rb:90:21:90:25 | 3.4e5 |
|
||||
| cfg.rb:91:6:91:10 | ... > ... | cfg.rb:91:10:91:10 | 3 |
|
||||
| cfg.rb:92:3:92:8 | call to puts | cfg.rb:92:8:92:8 | x |
|
||||
| cfg.rb:102:3:102:12 | call to puts | cfg.rb:102:8:102:12 | value |
|
||||
| cfg.rb:103:10:103:20 | ...[...] | cfg.rb:103:17:103:19 | key |
|
||||
| cfg.rb:108:1:108:12 | call to puts | cfg.rb:108:6:108:12 | ( ... ) |
|
||||
| cfg.rb:113:1:113:9 | call to puts | cfg.rb:113:6:113:9 | "hi" |
|
||||
| cfg.rb:113:14:113:19 | ... > ... | cfg.rb:113:18:113:19 | 10 |
|
||||
| cfg.rb:120:21:120:26 | call to [] | cfg.rb:120:22:120:22 | y |
|
||||
| cfg.rb:120:21:120:26 | call to [] | cfg.rb:120:25:120:25 | x |
|
||||
| cfg.rb:125:7:125:8 | ... + ... | cfg.rb:125:10:125:11 | 10 |
|
||||
| cfg.rb:128:9:128:12 | ... / ... | cfg.rb:128:11:128:12 | 3r |
|
||||
| cfg.rb:128:9:128:19 | ... + ... | cfg.rb:128:16:128:19 | ... / ... |
|
||||
| cfg.rb:128:16:128:19 | ... / ... | cfg.rb:128:18:128:19 | 6r |
|
||||
| cfg.rb:136:1:136:3 | ... / ... | cfg.rb:136:3:136:3 | 0 |
|
||||
| cfg.rb:136:12:136:29 | call to puts | cfg.rb:136:17:136:29 | "div by zero" |
|
||||
| cfg.rb:138:3:138:6 | call to [] | cfg.rb:138:3:138:6 | _ .. _ |
|
||||
| cfg.rb:138:9:138:12 | call to [] | cfg.rb:138:9:138:12 | -1 |
|
||||
| cfg.rb:146:5:146:20 | call to puts | cfg.rb:146:10:146:20 | "singleton" |
|
||||
| cfg.rb:147:5:147:22 | call to puts | cfg.rb:147:10:147:22 | call to print |
|
||||
| cfg.rb:153:3:153:8 | call to puts | cfg.rb:153:8:153:8 | x |
|
||||
| cfg.rb:158:1:158:22 | call to two_parameters | cfg.rb:158:16:158:21 | * ... |
|
||||
| cfg.rb:158:17:158:21 | call to [] | cfg.rb:158:18:158:18 | 1 |
|
||||
| cfg.rb:158:17:158:21 | call to [] | cfg.rb:158:20:158:20 | 2 |
|
||||
| cfg.rb:164:33:164:39 | ... + ... | cfg.rb:164:38:164:39 | 13 |
|
||||
| cfg.rb:172:8:172:14 | ... == ... | cfg.rb:172:13:172:14 | 10 |
|
||||
| cfg.rb:172:21:172:29 | call to puts | cfg.rb:172:26:172:29 | "hi" |
|
||||
| cfg.rb:172:36:172:45 | call to puts | cfg.rb:172:41:172:45 | "bye" |
|
||||
| cfg.rb:174:1:174:9 | call to puts | cfg.rb:174:6:174:9 | "hi" |
|
||||
| cfg.rb:174:18:174:23 | ... == ... | cfg.rb:174:23:174:23 | 0 |
|
||||
| cfg.rb:176:7:176:12 | ... > ... | cfg.rb:176:11:176:12 | 10 |
|
||||
| cfg.rb:176:19:176:20 | ... + ... | cfg.rb:176:22:176:23 | 10 |
|
||||
| cfg.rb:176:26:176:37 | call to puts | cfg.rb:176:31:176:37 | "hello" |
|
||||
| cfg.rb:179:2:179:13 | call to puts | cfg.rb:179:7:179:13 | "hello" |
|
||||
| cfg.rb:179:18:179:19 | ... + ... | cfg.rb:179:21:179:21 | 1 |
|
||||
| cfg.rb:179:30:179:36 | ... == ... | cfg.rb:179:35:179:36 | 10 |
|
||||
| cfg.rb:182:7:182:12 | ... < ... | cfg.rb:182:11:182:12 | 10 |
|
||||
| cfg.rb:183:5:183:6 | ... + ... | cfg.rb:183:8:183:8 | 1 |
|
||||
| cfg.rb:184:6:184:11 | ... == ... | cfg.rb:184:11:184:11 | 5 |
|
||||
| cfg.rb:185:3:185:8 | call to puts | cfg.rb:185:8:185:8 | x |
|
||||
| cfg.rb:188:2:188:13 | call to puts | cfg.rb:188:7:188:13 | "hello" |
|
||||
| cfg.rb:188:18:188:19 | ... - ... | cfg.rb:188:21:188:21 | 1 |
|
||||
| cfg.rb:188:30:188:35 | ... != ... | cfg.rb:188:35:188:35 | 0 |
|
||||
| cfg.rb:191:3:191:10 | yield ... | cfg.rb:191:9:191:10 | 42 |
|
||||
| cfg.rb:194:16:194:21 | call to puts | cfg.rb:194:21:194:21 | x |
|
||||
| cfg.rb:197:3:197:13 | call to bar | cfg.rb:197:7:197:7 | b |
|
||||
| desugar.rb:2:5:2:6 | ... + ... | desugar.rb:2:8:2:8 | 1 |
|
||||
| desugar.rb:6:3:6:13 | call to count= | desugar.rb:6:3:6:13 | ... = ... |
|
||||
| desugar.rb:10:3:10:10 | call to []= | desugar.rb:10:3:10:10 | ... = ... |
|
||||
| desugar.rb:10:3:10:10 | call to []= | desugar.rb:10:9:10:9 | 0 |
|
||||
| desugar.rb:14:3:14:13 | call to count= | desugar.rb:14:15:14:16 | __synth__1 |
|
||||
| desugar.rb:14:15:14:16 | ... + ... | desugar.rb:14:18:14:18 | 1 |
|
||||
| desugar.rb:18:3:18:28 | call to [] | desugar.rb:18:9:18:9 | __synth__1 |
|
||||
| desugar.rb:18:3:18:28 | call to [] | desugar.rb:18:12:18:16 | __synth__2 |
|
||||
| desugar.rb:18:3:18:28 | call to [] | desugar.rb:18:19:18:27 | __synth__3 |
|
||||
| desugar.rb:18:3:18:28 | call to []= | desugar.rb:18:9:18:9 | __synth__1 |
|
||||
| desugar.rb:18:3:18:28 | call to []= | desugar.rb:18:12:18:16 | __synth__2 |
|
||||
| desugar.rb:18:3:18:28 | call to []= | desugar.rb:18:19:18:27 | __synth__3 |
|
||||
| desugar.rb:18:3:18:28 | call to []= | desugar.rb:18:30:18:31 | __synth__4 |
|
||||
| desugar.rb:18:19:18:27 | ... + ... | desugar.rb:18:27:18:27 | 3 |
|
||||
| desugar.rb:18:30:18:31 | ... + ... | desugar.rb:18:33:18:33 | 1 |
|
||||
| desugar.rb:22:3:22:3 | call to [] | desugar.rb:22:3:22:3 | 0 |
|
||||
| desugar.rb:22:7:22:7 | call to [] | desugar.rb:22:7:22:7 | _ .. _ |
|
||||
| desugar.rb:22:10:22:14 | call to [] | desugar.rb:22:10:22:14 | -1 |
|
||||
| desugar.rb:22:10:22:14 | call to bar= | desugar.rb:22:10:22:14 | ... = ... |
|
||||
| desugar.rb:22:18:22:29 | call to [] | desugar.rb:22:19:22:19 | 1 |
|
||||
| desugar.rb:22:18:22:29 | call to [] | desugar.rb:22:22:22:22 | 2 |
|
||||
| desugar.rb:22:18:22:29 | call to [] | desugar.rb:22:25:22:25 | 3 |
|
||||
| desugar.rb:22:18:22:29 | call to [] | desugar.rb:22:28:22:28 | 4 |
|
||||
| desugar.rb:26:3:26:3 | call to [] | desugar.rb:26:3:26:3 | 0 |
|
||||
| desugar.rb:26:6:26:11 | call to [] | desugar.rb:26:6:26:11 | 1 |
|
||||
| desugar.rb:26:7:26:7 | call to [] | desugar.rb:26:7:26:7 | 0 |
|
||||
| desugar.rb:26:10:26:10 | call to [] | desugar.rb:26:10:26:10 | 1 |
|
||||
| desugar.rb:26:15:26:25 | call to [] | desugar.rb:26:16:26:16 | 1 |
|
||||
| desugar.rb:26:15:26:25 | call to [] | desugar.rb:26:19:26:24 | call to [] |
|
||||
| desugar.rb:26:19:26:24 | call to [] | desugar.rb:26:20:26:20 | 2 |
|
||||
| desugar.rb:26:19:26:24 | call to [] | desugar.rb:26:23:26:23 | 3 |
|
||||
| desugar.rb:31:6:31:7 | ... + ... | desugar.rb:31:9:31:9 | 2 |
|
||||
| desugar.rb:34:7:34:8 | ... / ... | desugar.rb:34:10:34:10 | 4 |
|
||||
| desugar.rb:38:13:38:14 | ... * ... | desugar.rb:38:16:38:16 | 6 |
|
||||
| exit.rb:2:6:2:10 | ... > ... | exit.rb:2:10:2:10 | 2 |
|
||||
| exit.rb:3:5:3:10 | call to exit | exit.rb:3:10:3:10 | 1 |
|
||||
| exit.rb:5:3:5:15 | call to puts | exit.rb:5:8:5:15 | "x <= 2" |
|
||||
| exit.rb:9:6:9:10 | ... > ... | exit.rb:9:10:9:10 | 2 |
|
||||
| exit.rb:10:5:10:18 | call to abort | exit.rb:10:11:10:18 | "abort!" |
|
||||
| exit.rb:12:3:12:15 | call to puts | exit.rb:12:8:12:15 | "x <= 2" |
|
||||
| heredoc.rb:2:3:2:16 | call to puts | heredoc.rb:2:8:2:10 | <<A |
|
||||
| heredoc.rb:2:3:2:16 | call to puts | heredoc.rb:2:13:2:15 | <<A |
|
||||
| ifs.rb:2:6:2:10 | ... > ... | ifs.rb:2:10:2:10 | 2 |
|
||||
| ifs.rb:3:5:3:30 | call to puts | ifs.rb:3:10:3:30 | "x is greater than 2" |
|
||||
| ifs.rb:4:9:4:14 | ... <= ... | ifs.rb:4:14:4:14 | 2 |
|
||||
| ifs.rb:4:9:4:24 | [false] ... and ... | ifs.rb:4:20:4:24 | ... > ... |
|
||||
| ifs.rb:4:9:4:24 | [true] ... and ... | ifs.rb:4:20:4:24 | ... > ... |
|
||||
| ifs.rb:4:9:4:38 | [false] ... and ... | ifs.rb:4:30:4:38 | [false] ! ... |
|
||||
| ifs.rb:4:9:4:38 | [true] ... and ... | ifs.rb:4:30:4:38 | [true] ! ... |
|
||||
| ifs.rb:4:20:4:24 | ... > ... | ifs.rb:4:24:4:24 | 0 |
|
||||
| ifs.rb:4:32:4:37 | ... == ... | ifs.rb:4:37:4:37 | 5 |
|
||||
| ifs.rb:5:5:5:17 | call to puts | ifs.rb:5:10:5:17 | "x is 1" |
|
||||
| ifs.rb:7:5:7:35 | call to puts | ifs.rb:7:10:7:35 | "I can't guess the number" |
|
||||
| ifs.rb:19:6:19:10 | ... < ... | ifs.rb:19:10:19:10 | 0 |
|
||||
| ifs.rb:21:8:21:13 | ... > ... | ifs.rb:21:12:21:13 | 10 |
|
||||
| ifs.rb:22:11:22:15 | ... - ... | ifs.rb:22:15:22:15 | 1 |
|
||||
| ifs.rb:25:3:25:8 | call to puts | ifs.rb:25:8:25:8 | x |
|
||||
| ifs.rb:37:3:37:12 | call to puts | ifs.rb:37:8:37:12 | "bla" |
|
||||
| ifs.rb:38:12:38:17 | ... == ... | ifs.rb:38:17:38:17 | 2 |
|
||||
| ifs.rb:48:5:48:15 | call to puts | ifs.rb:48:10:48:15 | "true" |
|
||||
| ifs.rb:51:3:51:13 | call to puts | ifs.rb:51:8:51:13 | "done" |
|
||||
| loops.rb:2:9:2:14 | ... >= ... | loops.rb:2:14:2:14 | 0 |
|
||||
| loops.rb:3:5:3:10 | call to puts | loops.rb:3:10:3:10 | x |
|
||||
| loops.rb:4:7:4:8 | ... - ... | loops.rb:4:10:4:10 | 1 |
|
||||
| loops.rb:9:9:9:14 | ... >= ... | loops.rb:9:14:9:14 | 0 |
|
||||
| loops.rb:10:5:10:10 | call to puts | loops.rb:10:10:10:10 | x |
|
||||
| loops.rb:11:7:11:8 | ... - ... | loops.rb:11:10:11:10 | 1 |
|
||||
| loops.rb:12:8:12:14 | ... > ... | loops.rb:12:12:12:14 | 100 |
|
||||
| loops.rb:14:11:14:16 | ... > ... | loops.rb:14:15:14:16 | 50 |
|
||||
| loops.rb:16:11:16:16 | ... > ... | loops.rb:16:15:16:16 | 10 |
|
||||
| loops.rb:19:5:19:15 | call to puts | loops.rb:19:10:19:15 | "Iter" |
|
||||
| loops.rb:21:3:21:13 | call to puts | loops.rb:21:8:21:13 | "Done" |
|
||||
| loops.rb:25:3:25:9 | call to [] | loops.rb:25:4:25:4 | 1 |
|
||||
| loops.rb:25:3:25:9 | call to [] | loops.rb:25:6:25:6 | 2 |
|
||||
| loops.rb:25:3:25:9 | call to [] | loops.rb:25:8:25:8 | 3 |
|
||||
| loops.rb:26:5:26:10 | call to puts | loops.rb:26:10:26:10 | x |
|
||||
| loops.rb:31:9:31:13 | ... < ... | loops.rb:31:13:31:13 | y |
|
||||
| raise.rb:8:6:8:10 | ... > ... | raise.rb:8:10:8:10 | 2 |
|
||||
| raise.rb:9:5:9:17 | call to raise | raise.rb:9:11:9:17 | "x > 2" |
|
||||
| raise.rb:11:3:11:15 | call to puts | raise.rb:11:8:11:15 | "x <= 2" |
|
||||
| raise.rb:17:7:17:22 | call to raise | raise.rb:17:13:17:22 | ExceptionA |
|
||||
| raise.rb:20:5:20:18 | call to puts | raise.rb:20:10:20:18 | "Rescued" |
|
||||
| raise.rb:22:3:22:15 | call to puts | raise.rb:22:8:22:15 | "End m2" |
|
||||
| raise.rb:28:7:28:22 | call to raise | raise.rb:28:13:28:22 | ExceptionA |
|
||||
| raise.rb:31:5:31:18 | call to puts | raise.rb:31:10:31:18 | "Rescued" |
|
||||
| raise.rb:33:3:33:15 | call to puts | raise.rb:33:8:33:15 | "End m3" |
|
||||
| raise.rb:39:7:39:22 | call to raise | raise.rb:39:13:39:22 | ExceptionA |
|
||||
| raise.rb:42:5:42:22 | call to puts | raise.rb:42:10:42:22 | "Rescued {e}" |
|
||||
| raise.rb:44:3:44:15 | call to puts | raise.rb:44:8:44:15 | "End m4" |
|
||||
| raise.rb:50:7:50:22 | call to raise | raise.rb:50:13:50:22 | ExceptionA |
|
||||
| raise.rb:54:3:54:15 | call to puts | raise.rb:54:8:54:15 | "End m5" |
|
||||
| raise.rb:60:7:60:22 | call to raise | raise.rb:60:13:60:22 | ExceptionA |
|
||||
| raise.rb:63:5:63:22 | call to puts | raise.rb:63:10:63:22 | "Rescued {e}" |
|
||||
| raise.rb:65:3:65:15 | call to puts | raise.rb:65:8:65:15 | "End m6" |
|
||||
| raise.rb:69:6:69:10 | ... > ... | raise.rb:69:10:69:10 | 2 |
|
||||
| raise.rb:70:5:70:17 | call to raise | raise.rb:70:11:70:17 | "x > 2" |
|
||||
| raise.rb:71:9:71:13 | ... < ... | raise.rb:71:13:71:13 | 0 |
|
||||
| raise.rb:74:3:74:20 | call to puts | raise.rb:74:8:74:20 | "0 <= x <= 2" |
|
||||
| raise.rb:76:3:76:15 | [ensure: raise] call to puts | raise.rb:76:8:76:15 | [ensure: raise] "ensure" |
|
||||
| raise.rb:76:3:76:15 | [ensure: return] call to puts | raise.rb:76:8:76:15 | [ensure: return] "ensure" |
|
||||
| raise.rb:76:3:76:15 | call to puts | raise.rb:76:8:76:15 | "ensure" |
|
||||
| raise.rb:80:3:80:17 | call to puts | raise.rb:80:8:80:17 | "Begin m8" |
|
||||
| raise.rb:82:8:82:12 | ... > ... | raise.rb:82:12:82:12 | 2 |
|
||||
| raise.rb:83:7:83:19 | call to raise | raise.rb:83:13:83:19 | "x > 2" |
|
||||
| raise.rb:84:11:84:15 | ... < ... | raise.rb:84:15:84:15 | 0 |
|
||||
| raise.rb:87:5:87:22 | call to puts | raise.rb:87:10:87:22 | "0 <= x <= 2" |
|
||||
| raise.rb:89:5:89:17 | [ensure: raise] call to puts | raise.rb:89:10:89:17 | [ensure: raise] "ensure" |
|
||||
| raise.rb:89:5:89:17 | [ensure: return] call to puts | raise.rb:89:10:89:17 | [ensure: return] "ensure" |
|
||||
| raise.rb:89:5:89:17 | call to puts | raise.rb:89:10:89:17 | "ensure" |
|
||||
| raise.rb:91:3:91:15 | call to puts | raise.rb:91:8:91:15 | "End m8" |
|
||||
| raise.rb:95:3:95:17 | call to puts | raise.rb:95:8:95:17 | "Begin m9" |
|
||||
| raise.rb:97:8:97:12 | ... > ... | raise.rb:97:12:97:12 | 2 |
|
||||
| raise.rb:98:7:98:19 | call to raise | raise.rb:98:13:98:19 | "x > 2" |
|
||||
| raise.rb:99:11:99:15 | ... < ... | raise.rb:99:15:99:15 | 0 |
|
||||
| raise.rb:102:5:102:22 | call to puts | raise.rb:102:10:102:22 | "0 <= x <= 2" |
|
||||
| raise.rb:104:5:104:23 | [ensure: raise] call to puts | raise.rb:104:10:104:23 | [ensure: raise] "outer ensure" |
|
||||
| raise.rb:104:5:104:23 | [ensure: return] call to puts | raise.rb:104:10:104:23 | [ensure: return] "outer ensure" |
|
||||
| raise.rb:104:5:104:23 | call to puts | raise.rb:104:10:104:23 | "outer ensure" |
|
||||
| raise.rb:107:9:107:26 | [ensure: raise] call to raise | raise.rb:107:15:107:26 | [ensure: raise] "b1 is true" |
|
||||
| raise.rb:107:9:107:26 | [ensure: return] call to raise | raise.rb:107:15:107:26 | [ensure: return] "b1 is true" |
|
||||
| raise.rb:107:9:107:26 | call to raise | raise.rb:107:15:107:26 | "b1 is true" |
|
||||
| raise.rb:110:7:110:25 | [ensure(1): raise] call to puts | raise.rb:110:12:110:25 | [ensure(1): raise] "inner ensure" |
|
||||
| raise.rb:110:7:110:25 | [ensure: raise, ensure(1): raise] call to puts | raise.rb:110:12:110:25 | [ensure: raise, ensure(1): raise] "inner ensure" |
|
||||
| raise.rb:110:7:110:25 | [ensure: raise] call to puts | raise.rb:110:12:110:25 | [ensure: raise] "inner ensure" |
|
||||
| raise.rb:110:7:110:25 | [ensure: return, ensure(1): raise] call to puts | raise.rb:110:12:110:25 | [ensure: return, ensure(1): raise] "inner ensure" |
|
||||
| raise.rb:110:7:110:25 | [ensure: return] call to puts | raise.rb:110:12:110:25 | [ensure: return] "inner ensure" |
|
||||
| raise.rb:110:7:110:25 | call to puts | raise.rb:110:12:110:25 | "inner ensure" |
|
||||
| raise.rb:113:3:113:15 | call to puts | raise.rb:113:8:113:15 | "End m9" |
|
||||
| raise.rb:115:3:115:22 | [ensure: raise] call to puts | raise.rb:115:8:115:22 | [ensure: raise] "method ensure" |
|
||||
| raise.rb:115:3:115:22 | [ensure: return] call to puts | raise.rb:115:8:115:22 | [ensure: return] "method ensure" |
|
||||
| raise.rb:115:3:115:22 | call to puts | raise.rb:115:8:115:22 | "method ensure" |
|
||||
| raise.rb:117:5:117:22 | [ensure: raise] call to raise | raise.rb:117:11:117:22 | [ensure: raise] "b2 is true" |
|
||||
| raise.rb:117:5:117:22 | [ensure: return] call to raise | raise.rb:117:11:117:22 | [ensure: return] "b2 is true" |
|
||||
| raise.rb:117:5:117:22 | call to raise | raise.rb:117:11:117:22 | "b2 is true" |
|
||||
| raise.rb:121:14:121:30 | call to raise | raise.rb:121:20:121:30 | "Exception" |
|
||||
| raise.rb:125:3:125:51 | call to puts | raise.rb:125:8:125:51 | "Will not get executed if p is..." |
|
||||
| raise.rb:131:7:131:22 | call to raise | raise.rb:131:13:131:22 | ExceptionA |
|
||||
| raise.rb:135:5:135:21 | call to puts | raise.rb:135:10:135:21 | "ExceptionB" |
|
||||
| raise.rb:137:5:137:17 | [ensure: raise] call to puts | raise.rb:137:10:137:17 | [ensure: raise] "Ensure" |
|
||||
| raise.rb:137:5:137:17 | call to puts | raise.rb:137:10:137:17 | "Ensure" |
|
||||
| raise.rb:139:3:139:16 | call to puts | raise.rb:139:8:139:16 | "End m11" |
|
||||
| raise.rb:144:5:144:12 | call to raise | raise.rb:144:11:144:12 | "" |
|
||||
| raise.rb:155:25:155:32 | call to raise | raise.rb:155:31:155:32 | "" |
|
||||
| raise.rb:160:5:162:7 | call to bar | raise.rb:160:9:162:7 | -> { ... } |
|
||||
| raise.rb:161:7:161:14 | call to raise | raise.rb:161:13:161:14 | "" |
|
||||
| raise.rb:168:5:168:12 | call to raise | raise.rb:168:11:168:12 | "" |
|
||||
keywordArguments
|
||||
| cfg.html.erb:6:9:6:58 | call to stylesheet_link_tag | media | cfg.html.erb:6:54:6:58 | "all" |
|
||||
| cfg.html.erb:12:11:12:33 | call to link_to | id | cfg.html.erb:12:31:12:33 | "a" |
|
||||
12
ruby/ql/test/library-tests/controlflow/graph/Nodes.ql
Normal file
12
ruby/ql/test/library-tests/controlflow/graph/Nodes.ql
Normal file
@@ -0,0 +1,12 @@
|
||||
import codeql.ruby.controlflow.CfgNodes
|
||||
import codeql.ruby.controlflow.CfgNodes::ExprNodes
|
||||
|
||||
query predicate callsWithNoArguments(CallCfgNode c) {
|
||||
not exists(c.getArgument(_)) and not exists(c.getKeywordArgument(_))
|
||||
}
|
||||
|
||||
query predicate positionalArguments(CallCfgNode c, ExprCfgNode arg) { arg = c.getArgument(_) }
|
||||
|
||||
query predicate keywordArguments(CallCfgNode c, string keyword, ExprCfgNode arg) {
|
||||
arg = c.getKeywordArgument(keyword)
|
||||
}
|
||||
@@ -193,6 +193,10 @@ end
|
||||
|
||||
run_block { |x|puts x }
|
||||
|
||||
def forward_param(a, b, ...)
|
||||
bar(b, ...)
|
||||
end
|
||||
|
||||
__END__
|
||||
|
||||
Some ignored nonsense
|
||||
|
||||
@@ -0,0 +1,134 @@
|
||||
track
|
||||
| type_tracker.rb:2:5:5:7 | &block | type tracker without call steps | type_tracker.rb:2:5:5:7 | &block |
|
||||
| type_tracker.rb:2:5:5:7 | field= | type tracker without call steps | type_tracker.rb:2:5:5:7 | field= |
|
||||
| type_tracker.rb:2:5:5:7 | return return in field= | type tracker without call steps | type_tracker.rb:2:5:5:7 | return return in field= |
|
||||
| type_tracker.rb:2:5:5:7 | return return in field= | type tracker without call steps | type_tracker.rb:14:5:14:13 | call to field= |
|
||||
| type_tracker.rb:2:5:5:7 | self (field=) | type tracker with call steps | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:2:5:5:7 | self (field=) | type tracker without call steps | type_tracker.rb:2:5:5:7 | self (field=) |
|
||||
| type_tracker.rb:2:5:5:7 | self in field= | type tracker with call steps | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:2:5:5:7 | self in field= | type tracker without call steps | type_tracker.rb:2:5:5:7 | self in field= |
|
||||
| type_tracker.rb:2:16:2:18 | val | type tracker with call steps | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:2:16:2:18 | val | type tracker without call steps | type_tracker.rb:2:5:5:7 | return return in field= |
|
||||
| type_tracker.rb:2:16:2:18 | val | type tracker without call steps | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:2:16:2:18 | val | type tracker without call steps | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:2:16:2:18 | val | type tracker without call steps | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:2:16:2:18 | val | type tracker without call steps | type_tracker.rb:14:5:14:13 | call to field= |
|
||||
| type_tracker.rb:3:9:3:23 | [post] self | type tracker with call steps | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:3:9:3:23 | [post] self | type tracker without call steps | type_tracker.rb:3:9:3:23 | [post] self |
|
||||
| type_tracker.rb:3:9:3:23 | call to puts | type tracker without call steps | type_tracker.rb:3:9:3:23 | call to puts |
|
||||
| type_tracker.rb:3:9:3:23 | self | type tracker with call steps | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:3:9:3:23 | self | type tracker without call steps | type_tracker.rb:3:9:3:23 | self |
|
||||
| type_tracker.rb:3:14:3:17 | [post] self | type tracker without call steps | type_tracker.rb:3:14:3:17 | [post] self |
|
||||
| type_tracker.rb:3:14:3:17 | self | type tracker with call steps | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:3:14:3:17 | self | type tracker without call steps | type_tracker.rb:3:14:3:17 | self |
|
||||
| type_tracker.rb:3:14:3:23 | [post] call to field | type tracker without call steps | type_tracker.rb:3:14:3:23 | [post] call to field |
|
||||
| type_tracker.rb:3:14:3:23 | call to field | type tracker without call steps | type_tracker.rb:3:14:3:23 | call to field |
|
||||
| type_tracker.rb:4:9:4:14 | @field | type tracker without call steps | type_tracker.rb:4:9:4:14 | @field |
|
||||
| type_tracker.rb:4:18:4:20 | val | type tracker without call steps | type_tracker.rb:2:5:5:7 | return return in field= |
|
||||
| type_tracker.rb:4:18:4:20 | val | type tracker without call steps | type_tracker.rb:4:18:4:20 | val |
|
||||
| type_tracker.rb:4:18:4:20 | val | type tracker without call steps | type_tracker.rb:14:5:14:13 | call to field= |
|
||||
| type_tracker.rb:7:5:9:7 | &block | type tracker without call steps | type_tracker.rb:7:5:9:7 | &block |
|
||||
| type_tracker.rb:7:5:9:7 | field | type tracker without call steps | type_tracker.rb:7:5:9:7 | field |
|
||||
| type_tracker.rb:7:5:9:7 | return return in field | type tracker without call steps | type_tracker.rb:3:14:3:23 | call to field |
|
||||
| type_tracker.rb:7:5:9:7 | return return in field | type tracker without call steps | type_tracker.rb:7:5:9:7 | return return in field |
|
||||
| type_tracker.rb:7:5:9:7 | return return in field | type tracker without call steps | type_tracker.rb:15:10:15:18 | call to field |
|
||||
| type_tracker.rb:7:5:9:7 | self in field | type tracker without call steps | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:8:9:8:14 | @field | type tracker without call steps | type_tracker.rb:3:14:3:23 | call to field |
|
||||
| type_tracker.rb:8:9:8:14 | @field | type tracker without call steps | type_tracker.rb:7:5:9:7 | return return in field |
|
||||
| type_tracker.rb:8:9:8:14 | @field | type tracker without call steps | type_tracker.rb:8:9:8:14 | @field |
|
||||
| type_tracker.rb:8:9:8:14 | @field | type tracker without call steps | type_tracker.rb:15:10:15:18 | call to field |
|
||||
| type_tracker.rb:12:1:16:3 | &block | type tracker without call steps | type_tracker.rb:12:1:16:3 | &block |
|
||||
| type_tracker.rb:12:1:16:3 | m | type tracker without call steps | type_tracker.rb:12:1:16:3 | m |
|
||||
| type_tracker.rb:12:1:16:3 | return return in m | type tracker without call steps | type_tracker.rb:12:1:16:3 | return return in m |
|
||||
| type_tracker.rb:12:1:16:3 | self (m) | type tracker without call steps | type_tracker.rb:12:1:16:3 | self (m) |
|
||||
| type_tracker.rb:12:1:16:3 | self in m | type tracker without call steps | type_tracker.rb:12:1:16:3 | self in m |
|
||||
| type_tracker.rb:13:5:13:7 | var | type tracker without call steps | type_tracker.rb:13:5:13:7 | var |
|
||||
| type_tracker.rb:13:11:13:19 | Container | type tracker without call steps | type_tracker.rb:13:11:13:19 | Container |
|
||||
| type_tracker.rb:13:11:13:19 | [post] Container | type tracker without call steps | type_tracker.rb:13:11:13:19 | [post] Container |
|
||||
| type_tracker.rb:13:11:13:23 | call to new | type tracker with call steps | type_tracker.rb:2:5:5:7 | self in field= |
|
||||
| type_tracker.rb:13:11:13:23 | call to new | type tracker with call steps | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:13:11:13:23 | call to new | type tracker without call steps | type_tracker.rb:13:11:13:23 | call to new |
|
||||
| type_tracker.rb:14:5:14:7 | [post] var | type tracker with call steps | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:14:5:14:7 | [post] var | type tracker without call steps | type_tracker.rb:14:5:14:7 | [post] var |
|
||||
| type_tracker.rb:14:5:14:13 | [post] ... = ... | type tracker without call steps | type_tracker.rb:14:5:14:13 | [post] ... = ... |
|
||||
| type_tracker.rb:14:5:14:13 | __synth__0 | type tracker without call steps | type_tracker.rb:14:5:14:13 | __synth__0 |
|
||||
| type_tracker.rb:14:5:14:13 | call to field= | type tracker without call steps | type_tracker.rb:14:5:14:13 | call to field= |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type tracker with call steps | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type tracker with call steps | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type tracker with call steps with content field | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type tracker without call steps | type_tracker.rb:14:17:14:23 | "hello" |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type tracker without call steps | type_tracker.rb:15:10:15:18 | call to field |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type tracker without call steps with content field | type_tracker.rb:14:5:14:7 | [post] var |
|
||||
| type_tracker.rb:15:5:15:18 | [post] self | type tracker without call steps | type_tracker.rb:15:5:15:18 | [post] self |
|
||||
| type_tracker.rb:15:5:15:18 | call to puts | type tracker without call steps | type_tracker.rb:12:1:16:3 | return return in m |
|
||||
| type_tracker.rb:15:5:15:18 | call to puts | type tracker without call steps | type_tracker.rb:15:5:15:18 | call to puts |
|
||||
| type_tracker.rb:15:5:15:18 | self | type tracker without call steps | type_tracker.rb:15:5:15:18 | self |
|
||||
| type_tracker.rb:15:10:15:12 | [post] var | type tracker without call steps | type_tracker.rb:15:10:15:12 | [post] var |
|
||||
| type_tracker.rb:15:10:15:18 | [post] call to field | type tracker without call steps | type_tracker.rb:15:10:15:18 | [post] call to field |
|
||||
| type_tracker.rb:15:10:15:18 | call to field | type tracker without call steps | type_tracker.rb:15:10:15:18 | call to field |
|
||||
trackEnd
|
||||
| type_tracker.rb:2:5:5:7 | &block | type_tracker.rb:2:5:5:7 | &block |
|
||||
| type_tracker.rb:2:5:5:7 | field= | type_tracker.rb:2:5:5:7 | field= |
|
||||
| type_tracker.rb:2:5:5:7 | return return in field= | type_tracker.rb:2:5:5:7 | return return in field= |
|
||||
| type_tracker.rb:2:5:5:7 | return return in field= | type_tracker.rb:14:5:14:13 | call to field= |
|
||||
| type_tracker.rb:2:5:5:7 | self (field=) | type_tracker.rb:2:5:5:7 | self (field=) |
|
||||
| type_tracker.rb:2:5:5:7 | self (field=) | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:2:5:5:7 | self in field= | type_tracker.rb:2:5:5:7 | self in field= |
|
||||
| type_tracker.rb:2:5:5:7 | self in field= | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:2:16:2:18 | val | type_tracker.rb:2:5:5:7 | return return in field= |
|
||||
| type_tracker.rb:2:16:2:18 | val | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:2:16:2:18 | val | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:2:16:2:18 | val | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:2:16:2:18 | val | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:2:16:2:18 | val | type_tracker.rb:14:5:14:13 | call to field= |
|
||||
| type_tracker.rb:3:9:3:23 | [post] self | type_tracker.rb:3:9:3:23 | [post] self |
|
||||
| type_tracker.rb:3:9:3:23 | [post] self | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:3:9:3:23 | call to puts | type_tracker.rb:3:9:3:23 | call to puts |
|
||||
| type_tracker.rb:3:9:3:23 | self | type_tracker.rb:3:9:3:23 | self |
|
||||
| type_tracker.rb:3:9:3:23 | self | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:3:14:3:17 | [post] self | type_tracker.rb:3:14:3:17 | [post] self |
|
||||
| type_tracker.rb:3:14:3:17 | self | type_tracker.rb:3:14:3:17 | self |
|
||||
| type_tracker.rb:3:14:3:17 | self | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:3:14:3:23 | [post] call to field | type_tracker.rb:3:14:3:23 | [post] call to field |
|
||||
| type_tracker.rb:3:14:3:23 | call to field | type_tracker.rb:3:14:3:23 | call to field |
|
||||
| type_tracker.rb:4:9:4:14 | @field | type_tracker.rb:4:9:4:14 | @field |
|
||||
| type_tracker.rb:4:18:4:20 | val | type_tracker.rb:2:5:5:7 | return return in field= |
|
||||
| type_tracker.rb:4:18:4:20 | val | type_tracker.rb:4:18:4:20 | val |
|
||||
| type_tracker.rb:4:18:4:20 | val | type_tracker.rb:14:5:14:13 | call to field= |
|
||||
| type_tracker.rb:7:5:9:7 | &block | type_tracker.rb:7:5:9:7 | &block |
|
||||
| type_tracker.rb:7:5:9:7 | field | type_tracker.rb:7:5:9:7 | field |
|
||||
| type_tracker.rb:7:5:9:7 | return return in field | type_tracker.rb:3:14:3:23 | call to field |
|
||||
| type_tracker.rb:7:5:9:7 | return return in field | type_tracker.rb:7:5:9:7 | return return in field |
|
||||
| type_tracker.rb:7:5:9:7 | return return in field | type_tracker.rb:15:10:15:18 | call to field |
|
||||
| type_tracker.rb:7:5:9:7 | self in field | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:8:9:8:14 | @field | type_tracker.rb:3:14:3:23 | call to field |
|
||||
| type_tracker.rb:8:9:8:14 | @field | type_tracker.rb:7:5:9:7 | return return in field |
|
||||
| type_tracker.rb:8:9:8:14 | @field | type_tracker.rb:8:9:8:14 | @field |
|
||||
| type_tracker.rb:8:9:8:14 | @field | type_tracker.rb:15:10:15:18 | call to field |
|
||||
| type_tracker.rb:12:1:16:3 | &block | type_tracker.rb:12:1:16:3 | &block |
|
||||
| type_tracker.rb:12:1:16:3 | m | type_tracker.rb:12:1:16:3 | m |
|
||||
| type_tracker.rb:12:1:16:3 | return return in m | type_tracker.rb:12:1:16:3 | return return in m |
|
||||
| type_tracker.rb:12:1:16:3 | self (m) | type_tracker.rb:12:1:16:3 | self (m) |
|
||||
| type_tracker.rb:12:1:16:3 | self in m | type_tracker.rb:12:1:16:3 | self in m |
|
||||
| type_tracker.rb:13:5:13:7 | var | type_tracker.rb:13:5:13:7 | var |
|
||||
| type_tracker.rb:13:11:13:19 | Container | type_tracker.rb:13:11:13:19 | Container |
|
||||
| type_tracker.rb:13:11:13:19 | [post] Container | type_tracker.rb:13:11:13:19 | [post] Container |
|
||||
| type_tracker.rb:13:11:13:23 | call to new | type_tracker.rb:2:5:5:7 | self in field= |
|
||||
| type_tracker.rb:13:11:13:23 | call to new | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:13:11:13:23 | call to new | type_tracker.rb:13:11:13:23 | call to new |
|
||||
| type_tracker.rb:14:5:14:7 | [post] var | type_tracker.rb:7:5:9:7 | self in field |
|
||||
| type_tracker.rb:14:5:14:7 | [post] var | type_tracker.rb:14:5:14:7 | [post] var |
|
||||
| type_tracker.rb:14:5:14:13 | [post] ... = ... | type_tracker.rb:14:5:14:13 | [post] ... = ... |
|
||||
| type_tracker.rb:14:5:14:13 | __synth__0 | type_tracker.rb:14:5:14:13 | __synth__0 |
|
||||
| type_tracker.rb:14:5:14:13 | call to field= | type_tracker.rb:14:5:14:13 | call to field= |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type_tracker.rb:2:16:2:18 | val |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type_tracker.rb:14:17:14:23 | "hello" |
|
||||
| type_tracker.rb:14:17:14:23 | "hello" | type_tracker.rb:15:10:15:18 | call to field |
|
||||
| type_tracker.rb:15:5:15:18 | [post] self | type_tracker.rb:15:5:15:18 | [post] self |
|
||||
| type_tracker.rb:15:5:15:18 | call to puts | type_tracker.rb:12:1:16:3 | return return in m |
|
||||
| type_tracker.rb:15:5:15:18 | call to puts | type_tracker.rb:15:5:15:18 | call to puts |
|
||||
| type_tracker.rb:15:5:15:18 | self | type_tracker.rb:15:5:15:18 | self |
|
||||
| type_tracker.rb:15:10:15:12 | [post] var | type_tracker.rb:15:10:15:12 | [post] var |
|
||||
| type_tracker.rb:15:10:15:18 | [post] call to field | type_tracker.rb:15:10:15:18 | [post] call to field |
|
||||
| type_tracker.rb:15:10:15:18 | call to field | type_tracker.rb:15:10:15:18 | call to field |
|
||||
@@ -0,0 +1,18 @@
|
||||
import ruby
|
||||
import codeql.ruby.DataFlow
|
||||
import codeql.ruby.typetracking.TypeTracker
|
||||
|
||||
class LocalSourceNode extends DataFlow::LocalSourceNode {
|
||||
LocalSourceNode() { this.getLocation().getFile().getExtension() = "rb" }
|
||||
}
|
||||
|
||||
query predicate track(LocalSourceNode src, TypeTracker t, LocalSourceNode dst) {
|
||||
t.start() and
|
||||
dst = src
|
||||
or
|
||||
exists(TypeTracker t2, LocalSourceNode mid | track(src, t2, mid) and dst = mid.track(t2, t))
|
||||
}
|
||||
|
||||
query predicate trackEnd(LocalSourceNode src, LocalSourceNode dst) {
|
||||
track(src, TypeTracker::end(), dst)
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
class Container
|
||||
def field=(val)
|
||||
puts self.field
|
||||
@field = val
|
||||
end
|
||||
|
||||
def field
|
||||
@field
|
||||
end
|
||||
end
|
||||
|
||||
def m()
|
||||
var = Container.new
|
||||
var.field = "hello"
|
||||
puts var.field
|
||||
end
|
||||
@@ -1,12 +0,0 @@
|
||||
| Excon.rb:3:9:3:40 | call to get | Excon.rb:4:1:4:10 | call to body |
|
||||
| Excon.rb:6:9:6:60 | call to post | Excon.rb:7:1:7:10 | call to body |
|
||||
| Excon.rb:9:9:9:59 | call to put | Excon.rb:10:1:10:10 | call to body |
|
||||
| Excon.rb:12:9:12:61 | call to patch | Excon.rb:13:1:13:10 | call to body |
|
||||
| Excon.rb:15:9:15:43 | call to delete | Excon.rb:16:1:16:10 | call to body |
|
||||
| Excon.rb:18:9:18:41 | call to head | Excon.rb:19:1:19:10 | call to body |
|
||||
| Excon.rb:21:9:21:44 | call to options | Excon.rb:22:1:22:10 | call to body |
|
||||
| Excon.rb:24:9:24:42 | call to trace | Excon.rb:25:1:25:10 | call to body |
|
||||
| Excon.rb:28:9:28:34 | call to get | Excon.rb:29:1:29:10 | call to body |
|
||||
| Excon.rb:31:10:31:39 | call to post | Excon.rb:32:1:32:11 | call to body |
|
||||
| Excon.rb:35:9:35:34 | call to get | Excon.rb:36:1:36:10 | call to body |
|
||||
| Excon.rb:38:10:38:39 | call to post | Excon.rb:39:1:39:11 | call to body |
|
||||
@@ -1,4 +0,0 @@
|
||||
import codeql.ruby.frameworks.http_clients.Excon
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query DataFlow::Node exconHttpRequests(ExconHttpRequest e) { result = e.getResponseBody() }
|
||||
@@ -1,9 +0,0 @@
|
||||
| Faraday.rb:3:9:3:42 | call to get | Faraday.rb:4:1:4:10 | call to body |
|
||||
| Faraday.rb:6:9:6:62 | call to post | Faraday.rb:7:1:7:10 | call to body |
|
||||
| Faraday.rb:9:9:9:61 | call to put | Faraday.rb:10:1:10:10 | call to body |
|
||||
| Faraday.rb:12:9:12:63 | call to patch | Faraday.rb:13:1:13:10 | call to body |
|
||||
| Faraday.rb:15:9:15:45 | call to delete | Faraday.rb:16:1:16:10 | call to body |
|
||||
| Faraday.rb:18:9:18:43 | call to head | Faraday.rb:19:1:19:10 | call to body |
|
||||
| Faraday.rb:24:9:24:44 | call to trace | Faraday.rb:25:1:25:10 | call to body |
|
||||
| Faraday.rb:28:9:28:27 | call to get | Faraday.rb:29:1:29:10 | call to body |
|
||||
| Faraday.rb:31:10:31:46 | call to post | Faraday.rb:32:1:32:11 | call to body |
|
||||
@@ -1,4 +0,0 @@
|
||||
import codeql.ruby.frameworks.http_clients.Faraday
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query DataFlow::Node faradayHttpRequests(FaradayHttpRequest e) { result = e.getResponseBody() }
|
||||
@@ -29,4 +29,8 @@ resp9 = connection.get("/")
|
||||
resp9.body
|
||||
|
||||
resp10 = connection.post("/foo", some: "data")
|
||||
resp10.body
|
||||
resp10.body
|
||||
|
||||
connection = Faraday.new(url: "http://example.com")
|
||||
resp11 = connection.get("/")
|
||||
resp11.body
|
||||
@@ -1,9 +0,0 @@
|
||||
| HttpClient.rb:3:9:3:45 | call to get | HttpClient.rb:4:1:4:10 | call to body |
|
||||
| HttpClient.rb:6:9:6:65 | call to post | HttpClient.rb:7:1:7:13 | call to content |
|
||||
| HttpClient.rb:9:9:9:64 | call to put | HttpClient.rb:10:1:10:15 | call to http_body |
|
||||
| HttpClient.rb:12:9:12:48 | call to delete | HttpClient.rb:13:1:13:10 | call to dump |
|
||||
| HttpClient.rb:15:9:15:46 | call to head | HttpClient.rb:16:1:16:10 | call to body |
|
||||
| HttpClient.rb:18:9:18:49 | call to options | HttpClient.rb:19:1:19:13 | call to content |
|
||||
| HttpClient.rb:21:9:21:47 | call to trace | HttpClient.rb:22:1:22:15 | call to http_body |
|
||||
| HttpClient.rb:24:9:24:53 | call to get_content | HttpClient.rb:24:9:24:53 | call to get_content |
|
||||
| HttpClient.rb:26:10:26:74 | call to post_content | HttpClient.rb:26:10:26:74 | call to post_content |
|
||||
@@ -1,4 +0,0 @@
|
||||
import codeql.ruby.frameworks.http_clients.HttpClient
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query DataFlow::Node httpClientRequests(HttpClientRequest e) { result = e.getResponseBody() }
|
||||
@@ -0,0 +1,72 @@
|
||||
| Excon.rb:3:9:3:40 | call to get | Excon | Excon.rb:3:19:3:39 | "http://example.com/" | Excon.rb:4:1:4:10 | call to body |
|
||||
| Excon.rb:6:9:6:60 | call to post | Excon | Excon.rb:6:20:6:40 | "http://example.com/" | Excon.rb:7:1:7:10 | call to body |
|
||||
| Excon.rb:9:9:9:59 | call to put | Excon | Excon.rb:9:19:9:39 | "http://example.com/" | Excon.rb:10:1:10:10 | call to body |
|
||||
| Excon.rb:12:9:12:61 | call to patch | Excon | Excon.rb:12:21:12:41 | "http://example.com/" | Excon.rb:13:1:13:10 | call to body |
|
||||
| Excon.rb:15:9:15:43 | call to delete | Excon | Excon.rb:15:22:15:42 | "http://example.com/" | Excon.rb:16:1:16:10 | call to body |
|
||||
| Excon.rb:18:9:18:41 | call to head | Excon | Excon.rb:18:20:18:40 | "http://example.com/" | Excon.rb:19:1:19:10 | call to body |
|
||||
| Excon.rb:21:9:21:44 | call to options | Excon | Excon.rb:21:23:21:43 | "http://example.com/" | Excon.rb:22:1:22:10 | call to body |
|
||||
| Excon.rb:24:9:24:42 | call to trace | Excon | Excon.rb:24:21:24:41 | "http://example.com/" | Excon.rb:25:1:25:10 | call to body |
|
||||
| Excon.rb:28:9:28:34 | call to get | Excon | Excon.rb:27:25:27:44 | "http://example.com" | Excon.rb:29:1:29:10 | call to body |
|
||||
| Excon.rb:28:9:28:34 | call to get | Excon | Excon.rb:28:31:28:33 | "/" | Excon.rb:29:1:29:10 | call to body |
|
||||
| Excon.rb:31:10:31:39 | call to post | Excon | Excon.rb:27:25:27:44 | "http://example.com" | Excon.rb:32:1:32:11 | call to body |
|
||||
| Excon.rb:31:10:31:39 | call to post | Excon | Excon.rb:31:33:31:38 | "/foo" | Excon.rb:32:1:32:11 | call to body |
|
||||
| Excon.rb:35:9:35:34 | call to get | Excon | Excon.rb:34:37:34:56 | "http://example.com" | Excon.rb:36:1:36:10 | call to body |
|
||||
| Excon.rb:35:9:35:34 | call to get | Excon | Excon.rb:35:31:35:33 | "/" | Excon.rb:36:1:36:10 | call to body |
|
||||
| Excon.rb:38:10:38:39 | call to post | Excon | Excon.rb:34:37:34:56 | "http://example.com" | Excon.rb:39:1:39:11 | call to body |
|
||||
| Excon.rb:38:10:38:39 | call to post | Excon | Excon.rb:38:33:38:38 | "/foo" | Excon.rb:39:1:39:11 | call to body |
|
||||
| Faraday.rb:3:9:3:42 | call to get | Faraday | Faraday.rb:3:21:3:41 | "http://example.com/" | Faraday.rb:4:1:4:10 | call to body |
|
||||
| Faraday.rb:6:9:6:62 | call to post | Faraday | Faraday.rb:6:22:6:42 | "http://example.com/" | Faraday.rb:7:1:7:10 | call to body |
|
||||
| Faraday.rb:9:9:9:61 | call to put | Faraday | Faraday.rb:9:21:9:41 | "http://example.com/" | Faraday.rb:10:1:10:10 | call to body |
|
||||
| Faraday.rb:12:9:12:63 | call to patch | Faraday | Faraday.rb:12:23:12:43 | "http://example.com/" | Faraday.rb:13:1:13:10 | call to body |
|
||||
| Faraday.rb:15:9:15:45 | call to delete | Faraday | Faraday.rb:15:24:15:44 | "http://example.com/" | Faraday.rb:16:1:16:10 | call to body |
|
||||
| Faraday.rb:18:9:18:43 | call to head | Faraday | Faraday.rb:18:22:18:42 | "http://example.com/" | Faraday.rb:19:1:19:10 | call to body |
|
||||
| Faraday.rb:24:9:24:44 | call to trace | Faraday | Faraday.rb:24:23:24:43 | "http://example.com/" | Faraday.rb:25:1:25:10 | call to body |
|
||||
| Faraday.rb:28:9:28:27 | call to get | Faraday | Faraday.rb:27:26:27:45 | "http://example.com" | Faraday.rb:29:1:29:10 | call to body |
|
||||
| Faraday.rb:28:9:28:27 | call to get | Faraday | Faraday.rb:28:24:28:26 | "/" | Faraday.rb:29:1:29:10 | call to body |
|
||||
| Faraday.rb:31:10:31:46 | call to post | Faraday | Faraday.rb:27:26:27:45 | "http://example.com" | Faraday.rb:32:1:32:11 | call to body |
|
||||
| Faraday.rb:31:10:31:46 | call to post | Faraday | Faraday.rb:31:26:31:31 | "/foo" | Faraday.rb:32:1:32:11 | call to body |
|
||||
| Faraday.rb:35:10:35:28 | call to get | Faraday | Faraday.rb:34:26:34:50 | Pair | Faraday.rb:36:1:36:11 | call to body |
|
||||
| Faraday.rb:35:10:35:28 | call to get | Faraday | Faraday.rb:34:31:34:50 | "http://example.com" | Faraday.rb:36:1:36:11 | call to body |
|
||||
| Faraday.rb:35:10:35:28 | call to get | Faraday | Faraday.rb:35:25:35:27 | "/" | Faraday.rb:36:1:36:11 | call to body |
|
||||
| HttpClient.rb:3:9:3:45 | call to get | HTTPClient | HttpClient.rb:3:24:3:44 | "http://example.com/" | HttpClient.rb:4:1:4:10 | call to body |
|
||||
| HttpClient.rb:6:9:6:65 | call to post | HTTPClient | HttpClient.rb:6:25:6:45 | "http://example.com/" | HttpClient.rb:7:1:7:13 | call to content |
|
||||
| HttpClient.rb:9:9:9:64 | call to put | HTTPClient | HttpClient.rb:9:24:9:44 | "http://example.com/" | HttpClient.rb:10:1:10:15 | call to http_body |
|
||||
| HttpClient.rb:12:9:12:48 | call to delete | HTTPClient | HttpClient.rb:12:27:12:47 | "http://example.com/" | HttpClient.rb:13:1:13:10 | call to dump |
|
||||
| HttpClient.rb:15:9:15:46 | call to head | HTTPClient | HttpClient.rb:15:25:15:45 | "http://example.com/" | HttpClient.rb:16:1:16:10 | call to body |
|
||||
| HttpClient.rb:18:9:18:49 | call to options | HTTPClient | HttpClient.rb:18:28:18:48 | "http://example.com/" | HttpClient.rb:19:1:19:13 | call to content |
|
||||
| HttpClient.rb:21:9:21:47 | call to trace | HTTPClient | HttpClient.rb:21:26:21:46 | "http://example.com/" | HttpClient.rb:22:1:22:15 | call to http_body |
|
||||
| HttpClient.rb:24:9:24:53 | call to get_content | HTTPClient | HttpClient.rb:24:32:24:52 | "http://example.com/" | HttpClient.rb:24:9:24:53 | call to get_content |
|
||||
| HttpClient.rb:26:10:26:74 | call to post_content | HTTPClient | HttpClient.rb:26:34:26:54 | "http://example.com/" | HttpClient.rb:26:10:26:74 | call to post_content |
|
||||
| Httparty.rb:5:1:5:35 | call to get | HTTParty | Httparty.rb:5:14:5:34 | "http://example.com/" | Httparty.rb:5:1:5:35 | call to get |
|
||||
| Httparty.rb:7:1:7:55 | call to post | HTTParty | Httparty.rb:7:15:7:35 | "http://example.com/" | Httparty.rb:7:1:7:55 | call to post |
|
||||
| Httparty.rb:9:1:9:54 | call to put | HTTParty | Httparty.rb:9:14:9:34 | "http://example.com/" | Httparty.rb:9:1:9:54 | call to put |
|
||||
| Httparty.rb:11:1:11:56 | call to patch | HTTParty | Httparty.rb:11:16:11:36 | "http://example.com/" | Httparty.rb:11:1:11:56 | call to patch |
|
||||
| Httparty.rb:15:9:15:46 | call to delete | HTTParty | Httparty.rb:15:25:15:45 | "http://example.com/" | Httparty.rb:16:1:16:10 | call to body |
|
||||
| Httparty.rb:18:9:18:44 | call to head | HTTParty | Httparty.rb:18:23:18:43 | "http://example.com/" | Httparty.rb:19:1:19:10 | call to body |
|
||||
| Httparty.rb:21:9:21:47 | call to options | HTTParty | Httparty.rb:21:26:21:46 | "http://example.com/" | Httparty.rb:22:1:22:10 | call to body |
|
||||
| NetHttp.rb:4:1:4:18 | call to get | Net::HTTP | NetHttp.rb:4:15:4:17 | uri | NetHttp.rb:4:1:4:18 | call to get |
|
||||
| NetHttp.rb:6:8:6:50 | call to post | Net::HTTP | NetHttp.rb:6:23:6:36 | call to parse | NetHttp.rb:7:1:7:9 | call to body |
|
||||
| NetHttp.rb:6:8:6:50 | call to post | Net::HTTP | NetHttp.rb:6:23:6:36 | call to parse | NetHttp.rb:8:1:8:14 | call to read_body |
|
||||
| NetHttp.rb:6:8:6:50 | call to post | Net::HTTP | NetHttp.rb:6:23:6:36 | call to parse | NetHttp.rb:9:1:9:11 | call to entity |
|
||||
| NetHttp.rb:13:6:13:17 | call to get | Net::HTTP | NetHttp.rb:13:14:13:16 | "/" | NetHttp.rb:18:1:18:7 | call to body |
|
||||
| NetHttp.rb:14:6:14:18 | call to post | Net::HTTP | NetHttp.rb:14:15:14:17 | "/" | NetHttp.rb:19:1:19:12 | call to read_body |
|
||||
| NetHttp.rb:15:6:15:17 | call to put | Net::HTTP | NetHttp.rb:15:14:15:16 | "/" | NetHttp.rb:20:1:20:9 | call to entity |
|
||||
| NetHttp.rb:24:3:24:33 | call to get | Net::HTTP | NetHttp.rb:24:29:24:32 | path | NetHttp.rb:27:1:27:28 | call to body |
|
||||
| OpenURI.rb:3:9:3:41 | call to open | OpenURI | OpenURI.rb:3:21:3:40 | "http://example.com" | OpenURI.rb:4:1:4:10 | call to read |
|
||||
| OpenURI.rb:6:9:6:34 | call to open | OpenURI | OpenURI.rb:6:14:6:33 | "http://example.com" | OpenURI.rb:7:1:7:15 | call to readlines |
|
||||
| OpenURI.rb:9:9:9:38 | call to open | OpenURI | OpenURI.rb:9:18:9:37 | "http://example.com" | OpenURI.rb:10:1:10:10 | call to read |
|
||||
| RestClient.rb:3:9:3:45 | call to get | RestClient | RestClient.rb:3:24:3:44 | "http://example.com/" | RestClient.rb:4:1:4:10 | call to body |
|
||||
| RestClient.rb:6:9:6:59 | call to post | RestClient | RestClient.rb:6:25:6:44 | "http://example.com" | RestClient.rb:7:1:7:10 | call to body |
|
||||
| RestClient.rb:9:9:9:58 | call to put | RestClient | RestClient.rb:9:24:9:43 | "http://example.com" | RestClient.rb:10:1:10:10 | call to body |
|
||||
| RestClient.rb:12:9:12:60 | call to patch | RestClient | RestClient.rb:12:26:12:45 | "http://example.com" | RestClient.rb:13:1:13:10 | call to body |
|
||||
| RestClient.rb:15:9:15:47 | call to delete | RestClient | RestClient.rb:15:27:15:46 | "http://example.com" | RestClient.rb:16:1:16:10 | call to body |
|
||||
| RestClient.rb:18:9:18:45 | call to head | RestClient | RestClient.rb:18:25:18:44 | "http://example.com" | RestClient.rb:19:1:19:10 | call to body |
|
||||
| RestClient.rb:21:9:21:48 | call to options | RestClient | RestClient.rb:21:28:21:47 | "http://example.com" | RestClient.rb:22:1:22:10 | call to body |
|
||||
| RestClient.rb:28:9:28:85 | call to execute | RestClient | RestClient.rb:28:56:28:84 | "http://example.com/resource" | RestClient.rb:29:1:29:10 | call to body |
|
||||
| Typhoeus.rb:3:9:3:43 | call to get | Typhoeus | Typhoeus.rb:3:22:3:42 | "http://example.com/" | Typhoeus.rb:4:1:4:10 | call to body |
|
||||
| Typhoeus.rb:6:9:6:63 | call to post | Typhoeus | Typhoeus.rb:6:23:6:43 | "http://example.com/" | Typhoeus.rb:7:1:7:10 | call to body |
|
||||
| Typhoeus.rb:9:9:9:62 | call to put | Typhoeus | Typhoeus.rb:9:22:9:42 | "http://example.com/" | Typhoeus.rb:10:1:10:10 | call to body |
|
||||
| Typhoeus.rb:12:9:12:64 | call to patch | Typhoeus | Typhoeus.rb:12:24:12:44 | "http://example.com/" | Typhoeus.rb:13:1:13:10 | call to body |
|
||||
| Typhoeus.rb:15:9:15:46 | call to delete | Typhoeus | Typhoeus.rb:15:25:15:45 | "http://example.com/" | Typhoeus.rb:16:1:16:10 | call to body |
|
||||
| Typhoeus.rb:18:9:18:44 | call to head | Typhoeus | Typhoeus.rb:18:23:18:43 | "http://example.com/" | Typhoeus.rb:19:1:19:10 | call to body |
|
||||
| Typhoeus.rb:21:9:21:47 | call to options | Typhoeus | Typhoeus.rb:21:26:21:46 | "http://example.com/" | Typhoeus.rb:22:1:22:10 | call to body |
|
||||
@@ -0,0 +1,10 @@
|
||||
import codeql.ruby.Concepts
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query predicate httpRequests(
|
||||
HTTP::Client::Request r, string framework, DataFlow::Node url, DataFlow::Node responseBody
|
||||
) {
|
||||
r.getFramework() = framework and
|
||||
r.getURL() = url and
|
||||
r.getResponseBody() = responseBody
|
||||
}
|
||||
@@ -1,7 +0,0 @@
|
||||
| Httparty.rb:5:1:5:35 | call to get | Httparty.rb:5:1:5:35 | call to get |
|
||||
| Httparty.rb:7:1:7:55 | call to post | Httparty.rb:7:1:7:55 | call to post |
|
||||
| Httparty.rb:9:1:9:54 | call to put | Httparty.rb:9:1:9:54 | call to put |
|
||||
| Httparty.rb:11:1:11:56 | call to patch | Httparty.rb:11:1:11:56 | call to patch |
|
||||
| Httparty.rb:15:9:15:46 | call to delete | Httparty.rb:16:1:16:10 | call to body |
|
||||
| Httparty.rb:18:9:18:44 | call to head | Httparty.rb:19:1:19:10 | call to body |
|
||||
| Httparty.rb:21:9:21:47 | call to options | Httparty.rb:22:1:22:10 | call to body |
|
||||
@@ -1,4 +0,0 @@
|
||||
import codeql.ruby.frameworks.http_clients.Httparty
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query DataFlow::Node httpartyRequests(HttpartyRequest e) { result = e.getResponseBody() }
|
||||
@@ -1,8 +0,0 @@
|
||||
| NetHttp.rb:4:1:4:18 | call to get | NetHttp.rb:4:1:4:18 | call to get |
|
||||
| NetHttp.rb:6:8:6:50 | call to post | NetHttp.rb:7:1:7:9 | call to body |
|
||||
| NetHttp.rb:6:8:6:50 | call to post | NetHttp.rb:8:1:8:14 | call to read_body |
|
||||
| NetHttp.rb:6:8:6:50 | call to post | NetHttp.rb:9:1:9:11 | call to entity |
|
||||
| NetHttp.rb:13:6:13:17 | call to get | NetHttp.rb:18:1:18:7 | call to body |
|
||||
| NetHttp.rb:14:6:14:18 | call to post | NetHttp.rb:19:1:19:12 | call to read_body |
|
||||
| NetHttp.rb:15:6:15:17 | call to put | NetHttp.rb:20:1:20:9 | call to entity |
|
||||
| NetHttp.rb:24:3:24:33 | call to get | NetHttp.rb:27:1:27:28 | call to body |
|
||||
@@ -1,4 +0,0 @@
|
||||
import codeql.ruby.frameworks.http_clients.NetHttp
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query DataFlow::Node netHttpRequests(NetHttpRequest e) { result = e.getResponseBody() }
|
||||
@@ -1,6 +0,0 @@
|
||||
openUriRequests
|
||||
| OpenURI.rb:9:9:9:38 | call to open | OpenURI.rb:10:1:10:10 | call to read |
|
||||
| OpenURI.rb:12:9:12:45 | call to open | OpenURI.rb:13:1:13:10 | call to read |
|
||||
openUriKernelOpenRequests
|
||||
| OpenURI.rb:3:9:3:41 | call to open | OpenURI.rb:4:1:4:10 | call to read |
|
||||
| OpenURI.rb:6:9:6:34 | call to open | OpenURI.rb:7:1:7:15 | call to readlines |
|
||||
@@ -1,8 +0,0 @@
|
||||
import codeql.ruby.frameworks.http_clients.OpenURI
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query DataFlow::Node openUriRequests(OpenUriRequest e) { result = e.getResponseBody() }
|
||||
|
||||
query DataFlow::Node openUriKernelOpenRequests(OpenUriKernelOpenRequest e) {
|
||||
result = e.getResponseBody()
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
| RestClient.rb:3:9:3:45 | call to get | RestClient.rb:4:1:4:10 | call to body |
|
||||
| RestClient.rb:6:9:6:59 | call to post | RestClient.rb:7:1:7:10 | call to body |
|
||||
| RestClient.rb:9:9:9:58 | call to put | RestClient.rb:10:1:10:10 | call to body |
|
||||
| RestClient.rb:12:9:12:60 | call to patch | RestClient.rb:13:1:13:10 | call to body |
|
||||
| RestClient.rb:15:9:15:47 | call to delete | RestClient.rb:16:1:16:10 | call to body |
|
||||
| RestClient.rb:18:9:18:45 | call to head | RestClient.rb:19:1:19:10 | call to body |
|
||||
| RestClient.rb:21:9:21:48 | call to options | RestClient.rb:22:1:22:10 | call to body |
|
||||
| RestClient.rb:25:9:25:21 | call to get | RestClient.rb:26:1:26:10 | call to body |
|
||||
@@ -1,6 +0,0 @@
|
||||
import codeql.ruby.frameworks.http_clients.RestClient
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query DataFlow::Node restClientHttpRequests(RestClientHttpRequest e) {
|
||||
result = e.getResponseBody()
|
||||
}
|
||||
@@ -23,4 +23,7 @@ resp7.body
|
||||
|
||||
resource8 = RestClient::Resource.new "http://example.com"
|
||||
resp8 = resource8.get
|
||||
resp8.body
|
||||
resp8.body
|
||||
|
||||
resp9 = RestClient::Request.execute(method: :get, url: 'http://example.com/resource')
|
||||
resp9.body
|
||||
@@ -1,7 +0,0 @@
|
||||
| Typhoeus.rb:3:9:3:43 | call to get | Typhoeus.rb:4:1:4:10 | call to body |
|
||||
| Typhoeus.rb:6:9:6:63 | call to post | Typhoeus.rb:7:1:7:10 | call to body |
|
||||
| Typhoeus.rb:9:9:9:62 | call to put | Typhoeus.rb:10:1:10:10 | call to body |
|
||||
| Typhoeus.rb:12:9:12:64 | call to patch | Typhoeus.rb:13:1:13:10 | call to body |
|
||||
| Typhoeus.rb:15:9:15:46 | call to delete | Typhoeus.rb:16:1:16:10 | call to body |
|
||||
| Typhoeus.rb:18:9:18:44 | call to head | Typhoeus.rb:19:1:19:10 | call to body |
|
||||
| Typhoeus.rb:21:9:21:47 | call to options | Typhoeus.rb:22:1:22:10 | call to body |
|
||||
@@ -1,4 +0,0 @@
|
||||
import codeql.ruby.frameworks.http_clients.Typhoeus
|
||||
import codeql.ruby.DataFlow
|
||||
|
||||
query DataFlow::Node typhoeusHttpRequests(TyphoeusHttpRequest e) { result = e.getResponseBody() }
|
||||
@@ -3,7 +3,7 @@
|
||||
*/
|
||||
|
||||
import codeql.Locations
|
||||
import codeql.ruby.regexp.RegExpTreeView as RETV
|
||||
import codeql.ruby.security.performance.RegExpTreeView as RETV
|
||||
|
||||
query predicate nodes(RETV::RegExpTerm n, string attr, string val) {
|
||||
attr = "semmle.label" and
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
| test.rb:2:6:2:29 | <script.*?>.*?<\\/script> | This regular expression does not match script end tags like </script >. |
|
||||
| test.rb:3:6:3:29 | <script.*?>.*?<\\/script> | This regular expression does not match script end tags like </script >. |
|
||||
| test.rb:7:6:7:16 | <!--.*--!?> | This regular expression does not match comments containing newlines. |
|
||||
| test.rb:8:6:8:39 | <script.*?>(.\|\\s)*?<\\/script[^>]*> | This regular expression matches <script></script>, but not <script \\n></script> |
|
||||
| test.rb:9:6:9:37 | <script[^>]*?>.*?<\\/script[^>]*> | This regular expression matches <script>...</script>, but not <script >...\\n</script> |
|
||||
| test.rb:10:6:10:44 | <script(\\s\|\\w\|=\|")*?>.*?<\\/script[^>]*> | This regular expression does not match script tags where the attribute uses single-quotes. |
|
||||
| test.rb:11:6:11:44 | <script(\\s\|\\w\|=\|')*?>.*?<\\/script[^>]*> | This regular expression does not match script tags where the attribute uses double-quotes. |
|
||||
| test.rb:12:6:12:48 | <script( \|\\n\|\\w\|=\|'\|")*?>.*?<\\/script[^>]*> | This regular expression does not match script tags where tabs are used between attributes. |
|
||||
| test.rb:13:6:13:34 | <script.*?>.*?<\\/script[^>]*> | This regular expression does not match upper case <SCRIPT> tags. |
|
||||
| test.rb:14:6:14:52 | <(script\|SCRIPT).*?>.*?<\\/(script\|SCRIPT)[^>]*> | This regular expression does not match mixed case <sCrIpT> tags. |
|
||||
| test.rb:15:6:15:39 | <script[^>]*?>[\\s\\S]*?<\\/script.*> | This regular expression does not match script end tags like </script\\t\\n bar>. |
|
||||
| test.rb:17:6:17:40 | <script\\b[^>]*>([\\s\\S]*?)<\\/script> | This regular expression does not match script end tags like </script >. |
|
||||
| test.rb:18:6:18:48 | <(?:!--([\\S\|\\s]*?)-->)\|([^\\/\\s>]+)[\\S\\s]*?> | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 1 and comments ending with --!> are matched with capture group 2. |
|
||||
| test.rb:19:6:19:147 | <(?:(?:\\/([^>]+)>)\|(?:!--([\\S\|\\s]*?)-->)\|(?:([^\\/\\s>]+)((?:\\s+[\\w\\-:.]+(?:\\s*=\\s*?(?:(?:"[^"]*")\|(?:'[^']*')\|[^\\s"'\\/>]+))?)*)[\\S\\s]*?(\\/?)>)) | Comments ending with --> are matched differently from comments ending with --!>. The first is matched with capture group 2 and comments ending with --!> are matched with capture group 1, 3, 4, 5. |
|
||||
@@ -0,0 +1 @@
|
||||
queries/security/cwe-116/BadTagFilter.ql
|
||||
22
ruby/ql/test/query-tests/security/cwe-116/test.rb
Normal file
22
ruby/ql/test/query-tests/security/cwe-116/test.rb
Normal file
@@ -0,0 +1,22 @@
|
||||
filters = [
|
||||
/<script.*?>.*?<\/script>/i, # NOT OK - doesn't match newlines or `</script >`
|
||||
/<script.*?>.*?<\/script>/im, # NOT OK - doesn't match `</script >`
|
||||
/<script.*?>.*?<\/script[^>]*>/im, # OK
|
||||
/<!--.*-->/im, # OK - we don't care regexps that only match comments
|
||||
/<!--.*--!?>/im, # OK
|
||||
/<!--.*--!?>/i, # NOT OK, does not match newlines
|
||||
/<script.*?>(.|\s)*?<\/script[^>]*>/i, # NOT OK - doesn't match inside the script tag
|
||||
/<script[^>]*?>.*?<\/script[^>]*>/i, # NOT OK - doesn't match newlines inside the content
|
||||
/<script(\s|\w|=|")*?>.*?<\/script[^>]*>/im, # NOT OK - does not match single quotes for attribute values
|
||||
/<script(\s|\w|=|')*?>.*?<\/script[^>]*>/im, # NOT OK - does not match double quotes for attribute values
|
||||
/<script( |\n|\w|=|'|")*?>.*?<\/script[^>]*>/im, # NOT OK - does not match tabs between attributes
|
||||
/<script.*?>.*?<\/script[^>]*>/m, # NOT OK - does not match uppercase SCRIPT tags
|
||||
/<(script|SCRIPT).*?>.*?<\/(script|SCRIPT)[^>]*>/m, # NOT OK - does not match mixed case script tags
|
||||
/<script[^>]*?>[\s\S]*?<\/script.*>/i, # NOT OK - doesn't match newlines in the end tag
|
||||
/<script[^>]*?>[\s\S]*?<\/script[^>]*?>/i, # OK
|
||||
/<script\b[^>]*>([\s\S]*?)<\/script>/gi, # NOT OK - too strict matching on the end tag
|
||||
/<(?:!--([\S|\s]*?)-->)|([^\/\s>]+)[\S\s]*?>/, # NOT OK - doesn't match comments with the right capture groups
|
||||
/<(?:(?:\/([^>]+)>)|(?:!--([\S|\s]*?)-->)|(?:([^\/\s>]+)((?:\s+[\w\-:.]+(?:\s*=\s*?(?:(?:"[^"]*")|(?:'[^']*')|[^\s"'\/>]+))?)*)[\S\s]*?(\/?)>))/, # NOT OK - capture groups
|
||||
]
|
||||
|
||||
doFilters(filters)
|
||||
@@ -3,7 +3,9 @@ edges
|
||||
| UrlRedirect.rb:14:17:14:22 | call to params : | UrlRedirect.rb:14:17:14:43 | call to fetch |
|
||||
| UrlRedirect.rb:19:17:19:22 | call to params : | UrlRedirect.rb:19:17:19:37 | call to to_unsafe_hash |
|
||||
| UrlRedirect.rb:24:31:24:36 | call to params : | UrlRedirect.rb:24:17:24:37 | call to filter_params |
|
||||
| UrlRedirect.rb:24:31:24:36 | call to params : | UrlRedirect.rb:56:21:56:32 | input_params : |
|
||||
| UrlRedirect.rb:34:20:34:25 | call to params : | UrlRedirect.rb:34:17:34:37 | "#{...}/foo" |
|
||||
| UrlRedirect.rb:56:21:56:32 | input_params : | UrlRedirect.rb:57:5:57:29 | call to permit : |
|
||||
nodes
|
||||
| UrlRedirect.rb:4:17:4:22 | call to params | semmle.label | call to params |
|
||||
| UrlRedirect.rb:9:17:9:22 | call to params : | semmle.label | call to params : |
|
||||
@@ -16,7 +18,10 @@ nodes
|
||||
| UrlRedirect.rb:24:31:24:36 | call to params : | semmle.label | call to params : |
|
||||
| UrlRedirect.rb:34:17:34:37 | "#{...}/foo" | semmle.label | "#{...}/foo" |
|
||||
| UrlRedirect.rb:34:20:34:25 | call to params : | semmle.label | call to params : |
|
||||
| UrlRedirect.rb:56:21:56:32 | input_params : | semmle.label | input_params : |
|
||||
| UrlRedirect.rb:57:5:57:29 | call to permit : | semmle.label | call to permit : |
|
||||
subpaths
|
||||
| UrlRedirect.rb:24:31:24:36 | call to params : | UrlRedirect.rb:56:21:56:32 | input_params : | UrlRedirect.rb:57:5:57:29 | call to permit : | UrlRedirect.rb:24:17:24:37 | call to filter_params : |
|
||||
#select
|
||||
| UrlRedirect.rb:4:17:4:22 | call to params | UrlRedirect.rb:4:17:4:22 | call to params | UrlRedirect.rb:4:17:4:22 | call to params | Untrusted URL redirection due to $@. | UrlRedirect.rb:4:17:4:22 | call to params | a user-provided value |
|
||||
| UrlRedirect.rb:9:17:9:28 | ...[...] | UrlRedirect.rb:9:17:9:22 | call to params : | UrlRedirect.rb:9:17:9:28 | ...[...] | Untrusted URL redirection due to $@. | UrlRedirect.rb:9:17:9:22 | call to params | a user-provided value |
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
edges
|
||||
| ServerSideRequestForgery.rb:9:32:9:37 | call to params : | ServerSideRequestForgery.rb:10:31:10:62 | "#{...}/logins" |
|
||||
nodes
|
||||
| ServerSideRequestForgery.rb:9:32:9:37 | call to params : | semmle.label | call to params : |
|
||||
| ServerSideRequestForgery.rb:10:31:10:62 | "#{...}/logins" | semmle.label | "#{...}/logins" |
|
||||
subpaths
|
||||
#select
|
||||
| ServerSideRequestForgery.rb:10:31:10:62 | "#{...}/logins" | ServerSideRequestForgery.rb:9:32:9:37 | call to params : | ServerSideRequestForgery.rb:10:31:10:62 | "#{...}/logins" | The URL of this request depends on $@. | ServerSideRequestForgery.rb:9:32:9:37 | call to params | a user-provided value |
|
||||
@@ -0,0 +1 @@
|
||||
queries/security/cwe-918/ServerSideRequestForgery.ql
|
||||
@@ -0,0 +1,21 @@
|
||||
require "excon"
|
||||
require "json"
|
||||
|
||||
class PostsController < ActionController::Base
|
||||
def create
|
||||
user = params[:user_id]
|
||||
|
||||
# BAD - user can control the entire URL of the request
|
||||
users_service_domain = params[:users_service_domain]
|
||||
response = Excon.post("#{users_service_domain}/logins", body: {user_id: user}).body
|
||||
token = JSON.parse(response)["token"]
|
||||
|
||||
# GOOD - user can only control the suffix of the URL
|
||||
users_service_path = params[:users_service_path]
|
||||
response = Excon.post("users-service/#{users_service_path}", body: {user_id: user}).body
|
||||
token = JSON.parse(response)["token"]
|
||||
|
||||
@post = Post.create(params[:post].merge(user_token: token))
|
||||
render @post
|
||||
end
|
||||
end
|
||||
Reference in New Issue
Block a user