hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into getRubyInSync

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-11-23 20:20:37 +01:00
parent b2e40ac603 8c9e817c0d
commit 87a1ccd428
212 changed files with 11507 additions and 2116 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
ruby/ql/test/library-tests/ast/Ast.expected
View File

@@ -365,7 +365,6 @@ calls/calls.rb:
# 223| getReceiver: [ConstantReadAccess] X
# 226| getStmt: [ForExpr] for ... in ...
# 226| getPattern: [LocalVariableAccess] x
# 226| <in>: [???] In
# 226| getValue: [MethodCall] call to bar
# 226| getReceiver: [Self, SelfVariableAccess] self
# 226| getBody: [StmtSequence] do ...
@@ -373,7 +372,6 @@ calls/calls.rb:
# 227| getReceiver: [Self, SelfVariableAccess] self
# 229| getStmt: [ForExpr] for ... in ...
# 229| getPattern: [LocalVariableAccess] x
# 229| <in>: [???] In
# 229| getValue: [MethodCall] call to bar
# 229| getReceiver: [ConstantReadAccess] X
# 229| getBody: [StmtSequence] do ...
@@ -655,6 +653,26 @@ calls/calls.rb:
# 336| getReceiver: [Self, SelfVariableAccess] self
# 336| getArgument: [LocalVariableAccess] b
# 336| getArgument: [ForwardedArguments] ...
# 340| getStmt: [ForExpr] for ... in ...
# 340| getPattern: [TuplePattern] (..., ...)
# 340| getElement: [LocalVariableAccess] x
# 340| getElement: [LocalVariableAccess] y
# 340| getElement: [LocalVariableAccess] z
# 340| getValue: [ArrayLiteral] [...]
# 340| getElement: [ArrayLiteral] [...]
# 340| getElement: [IntegerLiteral] 1
# 340| getElement: [IntegerLiteral] 2
# 340| getElement: [IntegerLiteral] 3
# 340| getElement: [ArrayLiteral] [...]
# 340| getElement: [IntegerLiteral] 4
# 340| getElement: [IntegerLiteral] 5
# 340| getElement: [IntegerLiteral] 6
# 340| getBody: [StmtSequence] do ...
# 341| getStmt: [MethodCall] call to foo
# 341| getReceiver: [Self, SelfVariableAccess] self
# 341| getArgument: [LocalVariableAccess] x
# 341| getArgument: [LocalVariableAccess] y
# 341| getArgument: [LocalVariableAccess] z
control/cases.rb:
# 1| [Toplevel] cases.rb
# 2| getStmt: [AssignExpr] ... = ...
@@ -1422,7 +1440,6 @@ control/loops.rb:
# 6| getAnOperand/getRightOperand: [IntegerLiteral] 0
# 9| getStmt: [ForExpr] for ... in ...
# 9| getPattern: [LocalVariableAccess] n
# 9| <in>: [???] In
# 9| getValue: [RangeLiteral] _ .. _
# 9| getBegin: [IntegerLiteral] 1
# 9| getEnd: [IntegerLiteral] 10
@@ -1435,7 +1452,6 @@ control/loops.rb:
# 11| getAnOperand/getRightOperand: [LocalVariableAccess] n
# 16| getStmt: [ForExpr] for ... in ...
# 16| getPattern: [LocalVariableAccess] n
# 16| <in>: [???] In
# 16| getValue: [RangeLiteral] _ .. _
# 16| getBegin: [IntegerLiteral] 1
# 16| getEnd: [IntegerLiteral] 10
@@ -1450,7 +1466,6 @@ control/loops.rb:
# 22| getPattern: [TuplePattern] (..., ...)
# 22| getElement: [LocalVariableAccess] key
# 22| getElement: [LocalVariableAccess] value
# 22| <in>: [???] In
# 22| getValue: [HashLiteral] {...}
# 22| getElement: [Pair] Pair
# 22| getKey: [SymbolLiteral] :foo
@@ -1469,7 +1484,6 @@ control/loops.rb:
# 28| getPattern: [TuplePattern] (..., ...)
# 28| getElement: [LocalVariableAccess] key
# 28| getElement: [LocalVariableAccess] value
# 28| <in>: [???] In
# 28| getValue: [HashLiteral] {...}
# 28| getElement: [Pair] Pair
# 28| getKey: [SymbolLiteral] :foo
@@ -2140,7 +2154,6 @@ erb/template.html.erb:
# 25| getAnOperand/getRightOperand: [StringLiteral] ""
# 27| getStmt: [ForExpr] for ... in ...
# 27| getPattern: [LocalVariableAccess] x
# 27| <in>: [???] In
# 27| getValue: [ArrayLiteral] [...]
# 27| getElement: [StringLiteral] "foo"
# 27| getComponent: [StringTextComponent] foo

278
ruby/ql/test/library-tests/ast/AstDesugar.expected
View File

@@ -23,6 +23,30 @@ calls/calls.rb:
# 67| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] var1
# 67| getAnOperand/getArgument/getRightOperand: [MethodCall] call to bar
# 67| getReceiver: [ConstantReadAccess] X
# 226| [ForExpr] for ... in ...
# 226| getDesugared: [MethodCall] call to each
# 226| getBlock: [BraceBlock] { ... }
# 226| getParameter: [SimpleParameter] __synth__0__1
# 226| getDefiningAccess: [LocalVariableAccess] __synth__0__1
# 226| getStmt: [AssignExpr] ... = ...
# 226| getAnOperand/getRightOperand: [LocalVariableAccess] __synth__0__1
# 226| getAnOperand/getLeftOperand: [LocalVariableAccess] x
# 227| getStmt: [MethodCall] call to baz
# 227| getReceiver: [Self, SelfVariableAccess] self
# 226| getReceiver: [MethodCall] call to bar
# 226| getReceiver: [Self, SelfVariableAccess] self
# 229| [ForExpr] for ... in ...
# 229| getDesugared: [MethodCall] call to each
# 229| getBlock: [BraceBlock] { ... }
# 229| getParameter: [SimpleParameter] __synth__0__1
# 229| getDefiningAccess: [LocalVariableAccess] __synth__0__1
# 229| getStmt: [AssignExpr] ... = ...
# 229| getAnOperand/getRightOperand: [LocalVariableAccess] __synth__0__1
# 229| getAnOperand/getLeftOperand: [LocalVariableAccess] x
# 230| getStmt: [MethodCall] call to baz
# 230| getReceiver: [ConstantReadAccess] X
# 229| getReceiver: [MethodCall] call to bar
# 229| getReceiver: [ConstantReadAccess] X
# 314| [AssignExpr] ... = ...
# 314| getDesugared: [StmtSequence] ...
# 314| getStmt: [SetterMethodCall] call to foo=
@@ -195,6 +219,53 @@ calls/calls.rb:
# 320| getAnOperand/getArgument/getRightOperand: [IntegerLiteral] 2
# 320| getAnOperand/getLeftOperand: [LocalVariableAccess] __synth__4
# 320| getStmt: [LocalVariableAccess] __synth__4
# 340| [ForExpr] for ... in ...
# 340| getDesugared: [MethodCall] call to each
# 340| getBlock: [BraceBlock] { ... }
# 340| getParameter: [SimpleParameter] __synth__0__1
# 340| getDefiningAccess: [LocalVariableAccess] __synth__0__1
# 340| getStmt: [AssignExpr] ... = ...
# 340| getDesugared: [StmtSequence] ...
# 340| getStmt: [AssignExpr] ... = ...
# 340| getAnOperand/getRightOperand: [SplatExpr] * ...
# 340| getAnOperand/getOperand/getReceiver: [LocalVariableAccess] __synth__0__1
# 340| getAnOperand/getLeftOperand: [LocalVariableAccess] __synth__0__1
# 340| getStmt: [AssignExpr] ... = ...
# 340| getAnOperand/getLeftOperand: [LocalVariableAccess] x
# 340| getAnOperand/getRightOperand: [MethodCall] call to []
# 340| getArgument: [IntegerLiteral] 0
# 340| getReceiver: [LocalVariableAccess] __synth__0__1
# 340| getStmt: [AssignExpr] ... = ...
# 340| getAnOperand/getLeftOperand: [LocalVariableAccess] y
# 340| getAnOperand/getRightOperand: [MethodCall] call to []
# 340| getArgument: [IntegerLiteral] 1
# 340| getReceiver: [LocalVariableAccess] __synth__0__1
# 340| getStmt: [AssignExpr] ... = ...
# 340| getAnOperand/getLeftOperand: [LocalVariableAccess] z
# 340| getAnOperand/getRightOperand: [MethodCall] call to []
# 340| getArgument: [IntegerLiteral] 2
# 340| getReceiver: [LocalVariableAccess] __synth__0__1
# 340| getLeftOperand: [TuplePattern] (..., ...)
# 341| getStmt: [MethodCall] call to foo
# 341| getReceiver: [Self, SelfVariableAccess] self
# 341| getArgument: [LocalVariableAccess] x
# 341| getArgument: [LocalVariableAccess] y
# 341| getArgument: [LocalVariableAccess] z
# 340| getReceiver: [ArrayLiteral] [...]
# 340| getDesugared: [MethodCall] call to []
# 340| getReceiver: [ConstantReadAccess] Array
# 340| getArgument: [ArrayLiteral] [...]
# 340| getDesugared: [MethodCall] call to []
# 340| getReceiver: [ConstantReadAccess] Array
# 340| getArgument: [IntegerLiteral] 1
# 340| getArgument: [IntegerLiteral] 2
# 340| getArgument: [IntegerLiteral] 3
# 340| getArgument: [ArrayLiteral] [...]
# 340| getDesugared: [MethodCall] call to []
# 340| getReceiver: [ConstantReadAccess] Array
# 340| getArgument: [IntegerLiteral] 4
# 340| getArgument: [IntegerLiteral] 5
# 340| getArgument: [IntegerLiteral] 6
constants/constants.rb:
# 20| [ArrayLiteral] [...]
# 20| getDesugared: [MethodCall] call to []
@@ -327,48 +398,132 @@ literals/literals.rb:
# 109| getArgument: [SymbolLiteral] :"baz"
# 109| getComponent: [StringTextComponent] baz
control/loops.rb:
# 10| [AssignAddExpr] ... += ...
# 10| getDesugared: [AssignExpr] ... = ...
# 10| getAnOperand/getLeftOperand: [LocalVariableAccess] sum
# 10| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 10| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] sum
# 10| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] n
# 17| [AssignAddExpr] ... += ...
# 17| getDesugared: [AssignExpr] ... = ...
# 17| getAnOperand/getLeftOperand: [LocalVariableAccess] sum
# 17| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 17| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] sum
# 17| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] n
# 18| [AssignSubExpr] ... -= ...
# 18| getDesugared: [AssignExpr] ... = ...
# 18| getAnOperand/getLeftOperand: [LocalVariableAccess] foo
# 18| getAnOperand/getRightOperand: [SubExpr] ... - ...
# 18| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] foo
# 18| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] n
# 23| [AssignAddExpr] ... += ...
# 23| getDesugared: [AssignExpr] ... = ...
# 23| getAnOperand/getLeftOperand: [LocalVariableAccess] sum
# 23| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 23| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] sum
# 23| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] value
# 24| [AssignMulExpr] ... *= ...
# 24| getDesugared: [AssignExpr] ... = ...
# 24| getAnOperand/getLeftOperand: [LocalVariableAccess] foo
# 24| getAnOperand/getRightOperand: [MulExpr] ... * ...
# 24| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] foo
# 24| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] value
# 29| [AssignAddExpr] ... += ...
# 29| getDesugared: [AssignExpr] ... = ...
# 29| getAnOperand/getLeftOperand: [LocalVariableAccess] sum
# 29| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 29| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] sum
# 29| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] value
# 30| [AssignDivExpr] ... /= ...
# 30| getDesugared: [AssignExpr] ... = ...
# 30| getAnOperand/getLeftOperand: [LocalVariableAccess] foo
# 30| getAnOperand/getRightOperand: [DivExpr] ... / ...
# 30| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] foo
# 30| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] value
# 9| [ForExpr] for ... in ...
# 9| getDesugared: [MethodCall] call to each
# 9| getBlock: [BraceBlock] { ... }
# 9| getParameter: [SimpleParameter] __synth__0__1
# 9| getDefiningAccess: [LocalVariableAccess] __synth__0__1
# 9| getStmt: [AssignExpr] ... = ...
# 9| getAnOperand/getRightOperand: [LocalVariableAccess] __synth__0__1
# 9| getAnOperand/getLeftOperand: [LocalVariableAccess] n
# 10| getStmt: [AssignAddExpr] ... += ...
# 10| getDesugared: [AssignExpr] ... = ...
# 10| getAnOperand/getLeftOperand: [LocalVariableAccess] sum
# 10| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 10| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] sum
# 10| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] n
# 11| getStmt: [AssignExpr] ... = ...
# 11| getAnOperand/getLeftOperand: [LocalVariableAccess] foo
# 11| getAnOperand/getRightOperand: [LocalVariableAccess] n
# 9| getReceiver: [RangeLiteral] _ .. _
# 9| getBegin: [IntegerLiteral] 1
# 9| getEnd: [IntegerLiteral] 10
# 16| [ForExpr] for ... in ...
# 16| getDesugared: [MethodCall] call to each
# 16| getBlock: [BraceBlock] { ... }
# 16| getParameter: [SimpleParameter] __synth__0__1
# 16| getDefiningAccess: [LocalVariableAccess] __synth__0__1
# 16| getStmt: [AssignExpr] ... = ...
# 16| getAnOperand/getRightOperand: [LocalVariableAccess] __synth__0__1
# 16| getAnOperand/getLeftOperand: [LocalVariableAccess] n
# 17| getStmt: [AssignAddExpr] ... += ...
# 17| getDesugared: [AssignExpr] ... = ...
# 17| getAnOperand/getLeftOperand: [LocalVariableAccess] sum
# 17| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 17| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] sum
# 17| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] n
# 18| getStmt: [AssignSubExpr] ... -= ...
# 18| getDesugared: [AssignExpr] ... = ...
# 18| getAnOperand/getLeftOperand: [LocalVariableAccess] foo
# 18| getAnOperand/getRightOperand: [SubExpr] ... - ...
# 18| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] foo
# 18| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] n
# 16| getReceiver: [RangeLiteral] _ .. _
# 16| getBegin: [IntegerLiteral] 1
# 16| getEnd: [IntegerLiteral] 10
# 22| [ForExpr] for ... in ...
# 22| getDesugared: [MethodCall] call to each
# 22| getBlock: [BraceBlock] { ... }
# 22| getParameter: [SimpleParameter] __synth__0__1
# 22| getDefiningAccess: [LocalVariableAccess] __synth__0__1
# 22| getStmt: [AssignExpr] ... = ...
# 22| getDesugared: [StmtSequence] ...
# 22| getStmt: [AssignExpr] ... = ...
# 22| getAnOperand/getRightOperand: [SplatExpr] * ...
# 22| getAnOperand/getOperand/getReceiver: [LocalVariableAccess] __synth__0__1
# 22| getAnOperand/getLeftOperand: [LocalVariableAccess] __synth__0__1
# 22| getStmt: [AssignExpr] ... = ...
# 22| getAnOperand/getLeftOperand: [LocalVariableAccess] key
# 22| getAnOperand/getRightOperand: [MethodCall] call to []
# 22| getArgument: [IntegerLiteral] 0
# 22| getReceiver: [LocalVariableAccess] __synth__0__1
# 22| getStmt: [AssignExpr] ... = ...
# 22| getAnOperand/getLeftOperand: [LocalVariableAccess] value
# 22| getAnOperand/getRightOperand: [MethodCall] call to []
# 22| getArgument: [IntegerLiteral] 1
# 22| getReceiver: [LocalVariableAccess] __synth__0__1
# 22| getLeftOperand: [TuplePattern] (..., ...)
# 23| getStmt: [AssignAddExpr] ... += ...
# 23| getDesugared: [AssignExpr] ... = ...
# 23| getAnOperand/getLeftOperand: [LocalVariableAccess] sum
# 23| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 23| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] sum
# 23| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] value
# 24| getStmt: [AssignMulExpr] ... *= ...
# 24| getDesugared: [AssignExpr] ... = ...
# 24| getAnOperand/getLeftOperand: [LocalVariableAccess] foo
# 24| getAnOperand/getRightOperand: [MulExpr] ... * ...
# 24| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] foo
# 24| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] value
# 22| getReceiver: [HashLiteral] {...}
# 22| getElement: [Pair] Pair
# 22| getKey: [SymbolLiteral] :foo
# 22| getValue: [IntegerLiteral] 0
# 22| getElement: [Pair] Pair
# 22| getKey: [SymbolLiteral] :bar
# 22| getValue: [IntegerLiteral] 1
# 28| [ForExpr] for ... in ...
# 28| getDesugared: [MethodCall] call to each
# 28| getBlock: [BraceBlock] { ... }
# 28| getParameter: [SimpleParameter] __synth__0__1
# 28| getDefiningAccess: [LocalVariableAccess] __synth__0__1
# 28| getStmt: [AssignExpr] ... = ...
# 28| getDesugared: [StmtSequence] ...
# 28| getStmt: [AssignExpr] ... = ...
# 28| getAnOperand/getRightOperand: [SplatExpr] * ...
# 28| getAnOperand/getOperand/getReceiver: [LocalVariableAccess] __synth__0__1
# 28| getAnOperand/getLeftOperand: [LocalVariableAccess] __synth__0__1
# 28| getStmt: [AssignExpr] ... = ...
# 28| getAnOperand/getLeftOperand: [LocalVariableAccess] key
# 28| getAnOperand/getRightOperand: [MethodCall] call to []
# 28| getArgument: [IntegerLiteral] 0
# 28| getReceiver: [LocalVariableAccess] __synth__0__1
# 28| getStmt: [AssignExpr] ... = ...
# 28| getAnOperand/getLeftOperand: [LocalVariableAccess] value
# 28| getAnOperand/getRightOperand: [MethodCall] call to []
# 28| getArgument: [IntegerLiteral] 1
# 28| getReceiver: [LocalVariableAccess] __synth__0__1
# 28| getLeftOperand: [TuplePattern] (..., ...)
# 29| getStmt: [AssignAddExpr] ... += ...
# 29| getDesugared: [AssignExpr] ... = ...
# 29| getAnOperand/getLeftOperand: [LocalVariableAccess] sum
# 29| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 29| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] sum
# 29| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] value
# 30| getStmt: [AssignDivExpr] ... /= ...
# 30| getDesugared: [AssignExpr] ... = ...
# 30| getAnOperand/getLeftOperand: [LocalVariableAccess] foo
# 30| getAnOperand/getRightOperand: [DivExpr] ... / ...
# 30| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] foo
# 30| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] value
# 31| getStmt: [BreakStmt] break
# 28| getReceiver: [HashLiteral] {...}
# 28| getElement: [Pair] Pair
# 28| getKey: [SymbolLiteral] :foo
# 28| getValue: [IntegerLiteral] 0
# 28| getElement: [Pair] Pair
# 28| getKey: [SymbolLiteral] :bar
# 28| getValue: [IntegerLiteral] 1
# 36| [AssignAddExpr] ... += ...
# 36| getDesugared: [AssignExpr] ... = ...
# 36| getAnOperand/getLeftOperand: [LocalVariableAccess] x
@@ -535,21 +690,30 @@ params/params.rb:
# 21| getDesugared: [MethodCall] call to []
# 21| getReceiver: [ConstantReadAccess] Array
erb/template.html.erb:
# 27| [ArrayLiteral] [...]
# 27| getDesugared: [MethodCall] call to []
# 27| getReceiver: [ConstantReadAccess] Array
# 27| getArgument: [StringLiteral] "foo"
# 27| getComponent: [StringTextComponent] foo
# 27| getArgument: [StringLiteral] "bar"
# 27| getComponent: [StringTextComponent] bar
# 27| getArgument: [StringLiteral] "baz"
# 27| getComponent: [StringTextComponent] baz
# 28| [AssignAddExpr] ... += ...
# 28| getDesugared: [AssignExpr] ... = ...
# 28| getAnOperand/getLeftOperand: [LocalVariableAccess] xs
# 28| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 28| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] xs
# 28| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] x
# 27| [ForExpr] for ... in ...
# 27| getDesugared: [MethodCall] call to each
# 27| getBlock: [BraceBlock] { ... }
# 27| getParameter: [SimpleParameter] __synth__0__1
# 27| getDefiningAccess: [LocalVariableAccess] __synth__0__1
# 27| getStmt: [AssignExpr] ... = ...
# 27| getAnOperand/getRightOperand: [LocalVariableAccess] __synth__0__1
# 27| getAnOperand/getLeftOperand: [LocalVariableAccess] x
# 28| getStmt: [AssignAddExpr] ... += ...
# 28| getDesugared: [AssignExpr] ... = ...
# 28| getAnOperand/getLeftOperand: [LocalVariableAccess] xs
# 28| getAnOperand/getRightOperand: [AddExpr] ... + ...
# 28| getAnOperand/getLeftOperand/getReceiver: [LocalVariableAccess] xs
# 28| getAnOperand/getArgument/getRightOperand: [LocalVariableAccess] x
# 29| getStmt: [LocalVariableAccess] xs
# 27| getReceiver: [ArrayLiteral] [...]
# 27| getDesugared: [MethodCall] call to []
# 27| getReceiver: [ConstantReadAccess] Array
# 27| getArgument: [StringLiteral] "foo"
# 27| getComponent: [StringTextComponent] foo
# 27| getArgument: [StringLiteral] "bar"
# 27| getComponent: [StringTextComponent] bar
# 27| getArgument: [StringLiteral] "baz"
# 27| getComponent: [StringTextComponent] baz
gems/test.gemspec:
# 2| [AssignExpr] ... = ...
# 2| getDesugared: [StmtSequence] ...

13
ruby/ql/test/library-tests/ast/ValueText.expected
View File

@@ -56,6 +56,15 @@
| calls/calls.rb:320:31:320:31 | 1 | 1 |
| calls/calls.rb:320:37:320:37 | 2 | 2 |
| calls/calls.rb:328:31:328:37 | "error" | error |
| calls/calls.rb:340:5:340:5 | 0 | 0 |
| calls/calls.rb:340:8:340:8 | 1 | 1 |
| calls/calls.rb:340:11:340:11 | 2 | 2 |
| calls/calls.rb:340:18:340:18 | 1 | 1 |
| calls/calls.rb:340:20:340:20 | 2 | 2 |
| calls/calls.rb:340:22:340:22 | 3 | 3 |
| calls/calls.rb:340:27:340:27 | 4 | 4 |
| calls/calls.rb:340:29:340:29 | 5 | 5 |
| calls/calls.rb:340:31:340:31 | 6 | 6 |
| constants/constants.rb:3:19:3:27 | "const_a" | const_a |
| constants/constants.rb:6:15:6:23 | "const_b" | const_b |
| constants/constants.rb:17:12:17:18 | "Hello" | Hello |
@@ -150,10 +159,14 @@
| control/loops.rb:9:13:9:14 | 10 | 10 |
| control/loops.rb:16:10:16:10 | 1 | 1 |
| control/loops.rb:16:13:16:14 | 10 | 10 |
| control/loops.rb:22:5:22:7 | 0 | 0 |
| control/loops.rb:22:10:22:14 | 1 | 1 |
| control/loops.rb:22:20:22:22 | :foo | foo |
| control/loops.rb:22:25:22:25 | 0 | 0 |
| control/loops.rb:22:28:22:30 | :bar | bar |
| control/loops.rb:22:33:22:33 | 1 | 1 |
| control/loops.rb:28:6:28:8 | 0 | 0 |
| control/loops.rb:28:11:28:15 | 1 | 1 |
| control/loops.rb:28:22:28:24 | :foo | foo |
| control/loops.rb:28:27:28:27 | 0 | 0 |
| control/loops.rb:28:30:28:32 | :bar | bar |

1
ruby/ql/test/library-tests/ast/calls/arguments.expected
View File

@@ -6,6 +6,7 @@ splatExpr
| calls.rb:271:5:271:11 | * ... | calls.rb:271:6:271:11 | call to bar |
| calls.rb:316:31:316:42 | * ... | calls.rb:316:31:316:42 | [...] |
| calls.rb:317:14:317:22 | * ... | calls.rb:317:14:317:22 | [...] |
| calls.rb:340:1:342:3 | * ... | calls.rb:340:1:342:3 | __synth__0__1 |
hashSplatExpr
| calls.rb:274:5:274:9 | ** ... | calls.rb:274:7:274:9 | call to bar |
| calls.rb:275:5:275:12 | ** ... | calls.rb:275:7:275:12 | call to bar |

28
ruby/ql/test/library-tests/ast/calls/calls.expected
View File

@@ -90,6 +90,20 @@ callsWithArguments
| calls.rb:332:3:332:12 | call to super | super | 0 | calls.rb:332:9:332:11 | ... |
| calls.rb:336:3:336:13 | call to bar | bar | 0 | calls.rb:336:7:336:7 | b |
| calls.rb:336:3:336:13 | call to bar | bar | 1 | calls.rb:336:10:336:12 | ... |
| calls.rb:340:5:340:5 | call to [] | [] | 0 | calls.rb:340:5:340:5 | 0 |
| calls.rb:340:8:340:8 | call to [] | [] | 0 | calls.rb:340:8:340:8 | 1 |
| calls.rb:340:11:340:11 | call to [] | [] | 0 | calls.rb:340:11:340:11 | 2 |
| calls.rb:340:16:340:33 | call to [] | [] | 0 | calls.rb:340:17:340:23 | [...] |
| calls.rb:340:16:340:33 | call to [] | [] | 1 | calls.rb:340:26:340:32 | [...] |
| calls.rb:340:17:340:23 | call to [] | [] | 0 | calls.rb:340:18:340:18 | 1 |
| calls.rb:340:17:340:23 | call to [] | [] | 1 | calls.rb:340:20:340:20 | 2 |
| calls.rb:340:17:340:23 | call to [] | [] | 2 | calls.rb:340:22:340:22 | 3 |
| calls.rb:340:26:340:32 | call to [] | [] | 0 | calls.rb:340:27:340:27 | 4 |
| calls.rb:340:26:340:32 | call to [] | [] | 1 | calls.rb:340:29:340:29 | 5 |
| calls.rb:340:26:340:32 | call to [] | [] | 2 | calls.rb:340:31:340:31 | 6 |
| calls.rb:341:3:341:13 | call to foo | foo | 0 | calls.rb:341:7:341:7 | x |
| calls.rb:341:3:341:13 | call to foo | foo | 1 | calls.rb:341:10:341:10 | y |
| calls.rb:341:3:341:13 | call to foo | foo | 2 | calls.rb:341:13:341:13 | z |
callsWithReceiver
| calls.rb:2:1:2:5 | call to foo | calls.rb:2:1:2:5 | self |
| calls.rb:5:1:5:10 | call to bar | calls.rb:5:1:5:3 | Foo |
@@ -214,8 +228,10 @@ callsWithReceiver
| calls.rb:222:11:222:13 | call to foo | calls.rb:222:11:222:13 | self |
| calls.rb:223:1:223:6 | call to bar | calls.rb:223:1:223:1 | X |
| calls.rb:223:14:223:19 | call to foo | calls.rb:223:14:223:14 | X |
| calls.rb:226:1:228:3 | call to each | calls.rb:226:10:226:12 | call to bar |
| calls.rb:226:10:226:12 | call to bar | calls.rb:226:10:226:12 | self |
| calls.rb:227:3:227:5 | call to baz | calls.rb:227:3:227:5 | self |
| calls.rb:229:1:231:3 | call to each | calls.rb:229:10:229:15 | call to bar |
| calls.rb:229:10:229:15 | call to bar | calls.rb:229:10:229:10 | X |
| calls.rb:230:3:230:8 | call to baz | calls.rb:230:3:230:3 | X |
| calls.rb:234:1:234:3 | call to foo | calls.rb:234:1:234:3 | self |
@@ -328,16 +344,28 @@ callsWithReceiver
| calls.rb:328:13:328:15 | call to bar | calls.rb:328:13:328:15 | self |
| calls.rb:328:25:328:37 | call to print | calls.rb:328:25:328:37 | self |
| calls.rb:336:3:336:13 | call to bar | calls.rb:336:3:336:13 | self |
| calls.rb:340:1:342:3 | * ... | calls.rb:340:1:342:3 | __synth__0__1 |
| calls.rb:340:1:342:3 | call to each | calls.rb:340:16:340:33 | [...] |
| calls.rb:340:5:340:5 | call to [] | calls.rb:340:5:340:5 | __synth__0__1 |
| calls.rb:340:8:340:8 | call to [] | calls.rb:340:8:340:8 | __synth__0__1 |
| calls.rb:340:11:340:11 | call to [] | calls.rb:340:11:340:11 | __synth__0__1 |
| calls.rb:340:16:340:33 | call to [] | calls.rb:340:16:340:33 | Array |
| calls.rb:340:17:340:23 | call to [] | calls.rb:340:17:340:23 | Array |
| calls.rb:340:26:340:32 | call to [] | calls.rb:340:26:340:32 | Array |
| calls.rb:341:3:341:13 | call to foo | calls.rb:341:3:341:13 | self |
callsWithBlock
| calls.rb:17:1:17:17 | call to foo | calls.rb:17:5:17:17 | { ... } |
| calls.rb:20:1:22:3 | call to foo | calls.rb:20:5:22:3 | do ... end |
| calls.rb:25:1:27:3 | call to bar | calls.rb:25:16:27:3 | do ... end |
| calls.rb:92:1:92:21 | call to foo | calls.rb:92:7:92:21 | { ... } |
| calls.rb:95:1:98:3 | call to foo | calls.rb:95:7:98:3 | do ... end |
| calls.rb:226:1:228:3 | call to each | calls.rb:226:1:228:3 | { ... } |
| calls.rb:229:1:231:3 | call to each | calls.rb:229:1:231:3 | { ... } |
| calls.rb:290:5:290:23 | call to super | calls.rb:290:11:290:23 | { ... } |
| calls.rb:291:5:291:26 | call to super | calls.rb:291:11:291:26 | do ... end |
| calls.rb:292:5:292:30 | call to super | calls.rb:292:16:292:30 | { ... } |
| calls.rb:293:5:293:33 | call to super | calls.rb:293:16:293:33 | do ... end |
| calls.rb:340:1:342:3 | call to each | calls.rb:340:1:342:3 | { ... } |
yieldCalls
| calls.rb:31:3:31:7 | yield ... |
| calls.rb:36:3:36:16 | yield ... |

5
ruby/ql/test/library-tests/ast/calls/calls.rb
View File

@@ -335,3 +335,8 @@ end
def foo(a, b, ...)
bar(b, ...)
end
# for loop over nested array
for x, y, z in [[1,2,3], [4,5,6]]
foo x, y, z
end

566
ruby/ql/test/library-tests/controlflow/graph/Cfg.expected
View File

File diff suppressed because it is too large Load Diff

331
ruby/ql/test/library-tests/controlflow/graph/Nodes.expected Normal file
View File

@@ -0,0 +1,331 @@
callsWithNoArguments
| break_ensure.rb:8:6:8:13 | [ensure: raise] call to elements |
| break_ensure.rb:8:6:8:13 | call to elements |
| break_ensure.rb:8:6:8:18 | [ensure: raise] call to nil? |
| break_ensure.rb:8:6:8:18 | call to nil? |
| break_ensure.rb:20:10:20:15 | [ensure: break] call to nil? |
| break_ensure.rb:20:10:20:15 | [ensure: raise] call to nil? |
| break_ensure.rb:20:10:20:15 | call to nil? |
| break_ensure.rb:29:8:29:13 | call to nil? |
| case.rb:2:8:2:9 | call to x1 |
| case.rb:3:21:3:22 | call to x2 |
| cfg.html.erb:12:24:12:24 | call to a |
| cfg.html.erb:15:32:15:32 | call to a |
| cfg.html.erb:16:32:16:32 | call to b |
| cfg.html.erb:18:17:18:22 | call to admin? |
| cfg.html.erb:19:32:19:32 | call to d |
| cfg.html.erb:21:32:21:32 | call to e |
| cfg.html.erb:29:8:29:17 | call to collection |
| cfg.html.erb:29:8:31:10 | call to each |
| cfg.rb:25:1:25:22 | call to times |
| cfg.rb:29:1:29:24 | call to new |
| cfg.rb:29:17:29:22 | call to call |
| cfg.rb:60:17:60:17 | call to b |
| cfg.rb:62:7:62:12 | * ... |
| cfg.rb:62:17:62:27 | * ... |
| cfg.rb:90:1:93:3 | call to each |
| cfg.rb:98:10:98:15 | ** ... |
| cfg.rb:98:30:98:35 | ** ... |
| cfg.rb:138:17:138:23 | * ... |
| cfg.rb:141:1:141:8 | call to itself |
| cfg.rb:143:10:143:21 | call to itself |
| cfg.rb:147:10:147:14 | call to super |
| cfg.rb:147:10:147:22 | call to print |
| cfg.rb:151:9:151:17 | call to new |
| cfg.rb:158:16:158:21 | * ... |
| cfg.rb:160:22:160:29 | call to __FILE__ |
| cfg.rb:167:5:167:10 | ! ... |
| cfg.rb:168:5:168:8 | - ... |
| cfg.rb:194:1:194:23 | call to run_block |
| desugar.rb:6:3:6:7 | call to foo |
| desugar.rb:10:3:10:7 | call to foo |
| desugar.rb:14:3:14:7 | call to foo |
| desugar.rb:14:3:14:13 | call to count |
| desugar.rb:18:3:18:7 | call to foo |
| desugar.rb:18:12:18:16 | call to bar |
| desugar.rb:18:19:18:23 | call to baz |
| desugar.rb:22:10:22:10 | call to z |
| desugar.rb:22:18:22:29 | * ... |
| desugar.rb:26:6:26:11 | * ... |
| desugar.rb:26:15:26:25 | * ... |
| ifs.rb:4:30:4:38 | [false] ! ... |
| ifs.rb:4:30:4:38 | [true] ! ... |
| ifs.rb:20:9:20:10 | - ... |
| ifs.rb:41:6:41:10 | [false] ! ... |
| loops.rb:25:3:27:5 | call to each |
| raise.rb:155:3:155:50 | call to each |
| raise.rb:155:37:155:48 | call to nil? |
| raise.rb:159:3:163:5 | call to foo |
positionalArguments
| break_ensure.rb:2:9:2:13 | ... < ... | break_ensure.rb:2:13:2:13 | 0 |
| break_ensure.rb:3:8:3:12 | ... > ... | break_ensure.rb:3:12:3:12 | 0 |
| break_ensure.rb:9:5:9:23 | [ensure: raise] call to puts | break_ensure.rb:9:10:9:23 | [ensure: raise] "elements nil" |
| break_ensure.rb:9:5:9:23 | call to puts | break_ensure.rb:9:10:9:23 | "elements nil" |
| break_ensure.rb:14:9:14:13 | ... < ... | break_ensure.rb:14:13:14:13 | 0 |
| break_ensure.rb:16:10:16:14 | ... > ... | break_ensure.rb:16:14:16:14 | 0 |
| break_ensure.rb:21:9:21:20 | [ensure: break] call to puts | break_ensure.rb:21:14:21:20 | [ensure: break] "y nil" |
| break_ensure.rb:21:9:21:20 | [ensure: raise] call to puts | break_ensure.rb:21:14:21:20 | [ensure: raise] "y nil" |
| break_ensure.rb:21:9:21:20 | call to puts | break_ensure.rb:21:14:21:20 | "y nil" |
| break_ensure.rb:33:11:33:15 | ... < ... | break_ensure.rb:33:15:33:15 | 0 |
| break_ensure.rb:33:11:33:15 | [ensure: raise] ... < ... | break_ensure.rb:33:15:33:15 | [ensure: raise] 0 |
| break_ensure.rb:33:11:33:15 | [ensure: return] ... < ... | break_ensure.rb:33:15:33:15 | [ensure: return] 0 |
| break_ensure.rb:35:12:35:16 | ... > ... | break_ensure.rb:35:16:35:16 | 0 |
| break_ensure.rb:35:12:35:16 | [ensure: raise] ... > ... | break_ensure.rb:35:16:35:16 | [ensure: raise] 0 |
| break_ensure.rb:35:12:35:16 | [ensure: return] ... > ... | break_ensure.rb:35:16:35:16 | [ensure: return] 0 |
| break_ensure.rb:41:3:41:13 | call to puts | break_ensure.rb:41:8:41:13 | "Done" |
| break_ensure.rb:45:9:45:13 | ... < ... | break_ensure.rb:45:13:45:13 | 0 |
| break_ensure.rb:47:10:47:14 | ... > ... | break_ensure.rb:47:14:47:14 | 1 |
| break_ensure.rb:48:9:48:16 | call to raise | break_ensure.rb:48:15:48:16 | "" |
| break_ensure.rb:51:10:51:14 | ... > ... | break_ensure.rb:51:14:51:14 | 0 |
| break_ensure.rb:51:10:51:14 | [ensure: raise] ... > ... | break_ensure.rb:51:14:51:14 | [ensure: raise] 0 |
| case.rb:3:29:3:37 | call to puts | case.rb:3:34:3:37 | "x2" |
| case.rb:4:17:4:24 | call to puts | case.rb:4:22:4:24 | "2" |
| cfg.html.erb:6:9:6:58 | call to stylesheet_link_tag | cfg.html.erb:6:29:6:41 | "application" |
| cfg.html.erb:6:9:6:58 | call to stylesheet_link_tag | cfg.html.erb:6:44:6:58 | Pair |
| cfg.html.erb:12:11:12:33 | call to link_to | cfg.html.erb:12:19:12:21 | "A" |
| cfg.html.erb:12:11:12:33 | call to link_to | cfg.html.erb:12:24:12:24 | call to a |
| cfg.html.erb:12:11:12:33 | call to link_to | cfg.html.erb:12:27:12:33 | Pair |
| cfg.html.erb:15:19:15:32 | call to link_to | cfg.html.erb:15:27:15:29 | "B" |
| cfg.html.erb:15:19:15:32 | call to link_to | cfg.html.erb:15:32:15:32 | call to a |
| cfg.html.erb:16:19:16:32 | call to link_to | cfg.html.erb:16:27:16:29 | "C" |
| cfg.html.erb:16:19:16:32 | call to link_to | cfg.html.erb:16:32:16:32 | call to b |
| cfg.html.erb:19:19:19:32 | call to link_to | cfg.html.erb:19:27:19:29 | "D" |
| cfg.html.erb:19:19:19:32 | call to link_to | cfg.html.erb:19:32:19:32 | call to d |
| cfg.html.erb:21:19:21:32 | call to link_to | cfg.html.erb:21:27:21:29 | "E" |
| cfg.html.erb:21:19:21:32 | call to link_to | cfg.html.erb:21:32:21:32 | call to e |
| cfg.rb:7:1:7:21 | call to [] | cfg.rb:7:4:7:12 | :"one#{...}" |
| cfg.rb:7:1:7:21 | call to [] | cfg.rb:7:14:7:20 | :"another" |
| cfg.rb:9:1:9:21 | call to [] | cfg.rb:9:4:9:12 | "one#{...}" |
| cfg.rb:9:1:9:21 | call to [] | cfg.rb:9:14:9:20 | "another" |
| cfg.rb:12:3:12:8 | call to puts | cfg.rb:12:8:12:8 | 4 |
| cfg.rb:16:3:16:14 | call to puts | cfg.rb:16:8:16:14 | "hello" |
| cfg.rb:23:1:23:6 | ... + ... | cfg.rb:23:6:23:6 | 1 |
| cfg.rb:25:15:25:20 | call to puts | cfg.rb:25:20:25:20 | x |
| cfg.rb:27:1:27:11 | call to puts | cfg.rb:27:6:27:11 | &... |
| cfg.rb:39:1:39:12 | call to puts | cfg.rb:39:11:39:12 | 42 |
| cfg.rb:42:15:42:24 | call to puts | cfg.rb:42:20:42:24 | "one" |
| cfg.rb:43:21:43:31 | call to puts | cfg.rb:43:26:43:31 | "some" |
| cfg.rb:44:8:44:18 | call to puts | cfg.rb:44:13:44:18 | "many" |
| cfg.rb:48:8:48:13 | ... == ... | cfg.rb:48:13:48:13 | 1 |
| cfg.rb:48:20:48:29 | call to puts | cfg.rb:48:25:48:29 | "one" |
| cfg.rb:49:8:49:13 | ... == ... | cfg.rb:49:13:49:13 | 0 |
| cfg.rb:49:16:49:20 | ... > ... | cfg.rb:49:20:49:20 | 1 |
| cfg.rb:49:27:49:37 | call to puts | cfg.rb:49:32:49:37 | "some" |
| cfg.rb:60:17:60:22 | ... < ... | cfg.rb:60:21:60:22 | 10 |
| cfg.rb:62:4:62:4 | call to [] | cfg.rb:62:4:62:4 | 0 |
| cfg.rb:62:7:62:12 | call to [] | cfg.rb:62:7:62:12 | 1 |
| cfg.rb:62:8:62:8 | call to [] | cfg.rb:62:8:62:8 | 0 |
| cfg.rb:62:11:62:11 | call to [] | cfg.rb:62:11:62:11 | 1 |
| cfg.rb:62:17:62:27 | call to [] | cfg.rb:62:18:62:18 | 1 |
| cfg.rb:62:17:62:27 | call to [] | cfg.rb:62:21:62:26 | call to [] |
| cfg.rb:62:21:62:26 | call to [] | cfg.rb:62:22:62:22 | 2 |
| cfg.rb:62:21:62:26 | call to [] | cfg.rb:62:25:62:25 | 3 |
| cfg.rb:64:5:64:10 | call to puts | cfg.rb:64:10:64:10 | a |
| cfg.rb:65:5:65:10 | call to puts | cfg.rb:65:10:65:10 | b |
| cfg.rb:67:11:67:19 | call to [] | cfg.rb:67:12:67:12 | 1 |
| cfg.rb:67:11:67:19 | call to [] | cfg.rb:67:15:67:15 | 2 |
| cfg.rb:67:11:67:19 | call to [] | cfg.rb:67:18:67:18 | 3 |
| cfg.rb:68:3:68:15 | call to puts | cfg.rb:68:8:68:15 | ...[...] |
| cfg.rb:68:8:68:15 | ...[...] | cfg.rb:68:14:68:14 | 2 |
| cfg.rb:70:5:70:16 | call to puts | cfg.rb:70:10:70:16 | "silly" |
| cfg.rb:75:4:75:8 | ... < ... | cfg.rb:75:8:75:8 | 0 |
| cfg.rb:75:23:75:28 | ... > ... | cfg.rb:75:27:75:28 | 10 |
| cfg.rb:83:3:83:11 | call to puts | cfg.rb:83:8:83:11 | "ok" |
| cfg.rb:85:3:85:12 | call to puts | cfg.rb:85:8:85:12 | "end" |
| cfg.rb:90:10:90:26 | call to [] | cfg.rb:90:11:90:13 | 1.4 |
| cfg.rb:90:10:90:26 | call to [] | cfg.rb:90:16:90:18 | 2.5 |
| cfg.rb:90:10:90:26 | call to [] | cfg.rb:90:21:90:25 | 3.4e5 |
| cfg.rb:91:6:91:10 | ... > ... | cfg.rb:91:10:91:10 | 3 |
| cfg.rb:92:3:92:8 | call to puts | cfg.rb:92:8:92:8 | x |
| cfg.rb:102:3:102:12 | call to puts | cfg.rb:102:8:102:12 | value |
| cfg.rb:103:10:103:20 | ...[...] | cfg.rb:103:17:103:19 | key |
| cfg.rb:108:1:108:12 | call to puts | cfg.rb:108:6:108:12 | ( ... ) |
| cfg.rb:113:1:113:9 | call to puts | cfg.rb:113:6:113:9 | "hi" |
| cfg.rb:113:14:113:19 | ... > ... | cfg.rb:113:18:113:19 | 10 |
| cfg.rb:120:21:120:26 | call to [] | cfg.rb:120:22:120:22 | y |
| cfg.rb:120:21:120:26 | call to [] | cfg.rb:120:25:120:25 | x |
| cfg.rb:125:7:125:8 | ... + ... | cfg.rb:125:10:125:11 | 10 |
| cfg.rb:128:9:128:12 | ... / ... | cfg.rb:128:11:128:12 | 3r |
| cfg.rb:128:9:128:19 | ... + ... | cfg.rb:128:16:128:19 | ... / ... |
| cfg.rb:128:16:128:19 | ... / ... | cfg.rb:128:18:128:19 | 6r |
| cfg.rb:136:1:136:3 | ... / ... | cfg.rb:136:3:136:3 | 0 |
| cfg.rb:136:12:136:29 | call to puts | cfg.rb:136:17:136:29 | "div by zero" |
| cfg.rb:138:3:138:6 | call to [] | cfg.rb:138:3:138:6 | _ .. _ |
| cfg.rb:138:9:138:12 | call to [] | cfg.rb:138:9:138:12 | -1 |
| cfg.rb:146:5:146:20 | call to puts | cfg.rb:146:10:146:20 | "singleton" |
| cfg.rb:147:5:147:22 | call to puts | cfg.rb:147:10:147:22 | call to print |
| cfg.rb:153:3:153:8 | call to puts | cfg.rb:153:8:153:8 | x |
| cfg.rb:158:1:158:22 | call to two_parameters | cfg.rb:158:16:158:21 | * ... |
| cfg.rb:158:17:158:21 | call to [] | cfg.rb:158:18:158:18 | 1 |
| cfg.rb:158:17:158:21 | call to [] | cfg.rb:158:20:158:20 | 2 |
| cfg.rb:164:33:164:39 | ... + ... | cfg.rb:164:38:164:39 | 13 |
| cfg.rb:172:8:172:14 | ... == ... | cfg.rb:172:13:172:14 | 10 |
| cfg.rb:172:21:172:29 | call to puts | cfg.rb:172:26:172:29 | "hi" |
| cfg.rb:172:36:172:45 | call to puts | cfg.rb:172:41:172:45 | "bye" |
| cfg.rb:174:1:174:9 | call to puts | cfg.rb:174:6:174:9 | "hi" |
| cfg.rb:174:18:174:23 | ... == ... | cfg.rb:174:23:174:23 | 0 |
| cfg.rb:176:7:176:12 | ... > ... | cfg.rb:176:11:176:12 | 10 |
| cfg.rb:176:19:176:20 | ... + ... | cfg.rb:176:22:176:23 | 10 |
| cfg.rb:176:26:176:37 | call to puts | cfg.rb:176:31:176:37 | "hello" |
| cfg.rb:179:2:179:13 | call to puts | cfg.rb:179:7:179:13 | "hello" |
| cfg.rb:179:18:179:19 | ... + ... | cfg.rb:179:21:179:21 | 1 |
| cfg.rb:179:30:179:36 | ... == ... | cfg.rb:179:35:179:36 | 10 |
| cfg.rb:182:7:182:12 | ... < ... | cfg.rb:182:11:182:12 | 10 |
| cfg.rb:183:5:183:6 | ... + ... | cfg.rb:183:8:183:8 | 1 |
| cfg.rb:184:6:184:11 | ... == ... | cfg.rb:184:11:184:11 | 5 |
| cfg.rb:185:3:185:8 | call to puts | cfg.rb:185:8:185:8 | x |
| cfg.rb:188:2:188:13 | call to puts | cfg.rb:188:7:188:13 | "hello" |
| cfg.rb:188:18:188:19 | ... - ... | cfg.rb:188:21:188:21 | 1 |
| cfg.rb:188:30:188:35 | ... != ... | cfg.rb:188:35:188:35 | 0 |
| cfg.rb:191:3:191:10 | yield ... | cfg.rb:191:9:191:10 | 42 |
| cfg.rb:194:16:194:21 | call to puts | cfg.rb:194:21:194:21 | x |
| cfg.rb:197:3:197:13 | call to bar | cfg.rb:197:7:197:7 | b |
| desugar.rb:2:5:2:6 | ... + ... | desugar.rb:2:8:2:8 | 1 |
| desugar.rb:6:3:6:13 | call to count= | desugar.rb:6:3:6:13 | ... = ... |
| desugar.rb:10:3:10:10 | call to []= | desugar.rb:10:3:10:10 | ... = ... |
| desugar.rb:10:3:10:10 | call to []= | desugar.rb:10:9:10:9 | 0 |
| desugar.rb:14:3:14:13 | call to count= | desugar.rb:14:15:14:16 | __synth__1 |
| desugar.rb:14:15:14:16 | ... + ... | desugar.rb:14:18:14:18 | 1 |
| desugar.rb:18:3:18:28 | call to [] | desugar.rb:18:9:18:9 | __synth__1 |
| desugar.rb:18:3:18:28 | call to [] | desugar.rb:18:12:18:16 | __synth__2 |
| desugar.rb:18:3:18:28 | call to [] | desugar.rb:18:19:18:27 | __synth__3 |
| desugar.rb:18:3:18:28 | call to []= | desugar.rb:18:9:18:9 | __synth__1 |
| desugar.rb:18:3:18:28 | call to []= | desugar.rb:18:12:18:16 | __synth__2 |
| desugar.rb:18:3:18:28 | call to []= | desugar.rb:18:19:18:27 | __synth__3 |
| desugar.rb:18:3:18:28 | call to []= | desugar.rb:18:30:18:31 | __synth__4 |
| desugar.rb:18:19:18:27 | ... + ... | desugar.rb:18:27:18:27 | 3 |
| desugar.rb:18:30:18:31 | ... + ... | desugar.rb:18:33:18:33 | 1 |
| desugar.rb:22:3:22:3 | call to [] | desugar.rb:22:3:22:3 | 0 |
| desugar.rb:22:7:22:7 | call to [] | desugar.rb:22:7:22:7 | _ .. _ |
| desugar.rb:22:10:22:14 | call to [] | desugar.rb:22:10:22:14 | -1 |
| desugar.rb:22:10:22:14 | call to bar= | desugar.rb:22:10:22:14 | ... = ... |
| desugar.rb:22:18:22:29 | call to [] | desugar.rb:22:19:22:19 | 1 |
| desugar.rb:22:18:22:29 | call to [] | desugar.rb:22:22:22:22 | 2 |
| desugar.rb:22:18:22:29 | call to [] | desugar.rb:22:25:22:25 | 3 |
| desugar.rb:22:18:22:29 | call to [] | desugar.rb:22:28:22:28 | 4 |
| desugar.rb:26:3:26:3 | call to [] | desugar.rb:26:3:26:3 | 0 |
| desugar.rb:26:6:26:11 | call to [] | desugar.rb:26:6:26:11 | 1 |
| desugar.rb:26:7:26:7 | call to [] | desugar.rb:26:7:26:7 | 0 |
| desugar.rb:26:10:26:10 | call to [] | desugar.rb:26:10:26:10 | 1 |
| desugar.rb:26:15:26:25 | call to [] | desugar.rb:26:16:26:16 | 1 |
| desugar.rb:26:15:26:25 | call to [] | desugar.rb:26:19:26:24 | call to [] |
| desugar.rb:26:19:26:24 | call to [] | desugar.rb:26:20:26:20 | 2 |
| desugar.rb:26:19:26:24 | call to [] | desugar.rb:26:23:26:23 | 3 |
| desugar.rb:31:6:31:7 | ... + ... | desugar.rb:31:9:31:9 | 2 |
| desugar.rb:34:7:34:8 | ... / ... | desugar.rb:34:10:34:10 | 4 |
| desugar.rb:38:13:38:14 | ... * ... | desugar.rb:38:16:38:16 | 6 |
| exit.rb:2:6:2:10 | ... > ... | exit.rb:2:10:2:10 | 2 |
| exit.rb:3:5:3:10 | call to exit | exit.rb:3:10:3:10 | 1 |
| exit.rb:5:3:5:15 | call to puts | exit.rb:5:8:5:15 | "x <= 2" |
| exit.rb:9:6:9:10 | ... > ... | exit.rb:9:10:9:10 | 2 |
| exit.rb:10:5:10:18 | call to abort | exit.rb:10:11:10:18 | "abort!" |
| exit.rb:12:3:12:15 | call to puts | exit.rb:12:8:12:15 | "x <= 2" |
| heredoc.rb:2:3:2:16 | call to puts | heredoc.rb:2:8:2:10 | <<A |
| heredoc.rb:2:3:2:16 | call to puts | heredoc.rb:2:13:2:15 | <<A |
| ifs.rb:2:6:2:10 | ... > ... | ifs.rb:2:10:2:10 | 2 |
| ifs.rb:3:5:3:30 | call to puts | ifs.rb:3:10:3:30 | "x is greater than 2" |
| ifs.rb:4:9:4:14 | ... <= ... | ifs.rb:4:14:4:14 | 2 |
| ifs.rb:4:9:4:24 | [false] ... and ... | ifs.rb:4:20:4:24 | ... > ... |
| ifs.rb:4:9:4:24 | [true] ... and ... | ifs.rb:4:20:4:24 | ... > ... |
| ifs.rb:4:9:4:38 | [false] ... and ... | ifs.rb:4:30:4:38 | [false] ! ... |
| ifs.rb:4:9:4:38 | [true] ... and ... | ifs.rb:4:30:4:38 | [true] ! ... |
| ifs.rb:4:20:4:24 | ... > ... | ifs.rb:4:24:4:24 | 0 |
| ifs.rb:4:32:4:37 | ... == ... | ifs.rb:4:37:4:37 | 5 |
| ifs.rb:5:5:5:17 | call to puts | ifs.rb:5:10:5:17 | "x is 1" |
| ifs.rb:7:5:7:35 | call to puts | ifs.rb:7:10:7:35 | "I can't guess the number" |
| ifs.rb:19:6:19:10 | ... < ... | ifs.rb:19:10:19:10 | 0 |
| ifs.rb:21:8:21:13 | ... > ... | ifs.rb:21:12:21:13 | 10 |
| ifs.rb:22:11:22:15 | ... - ... | ifs.rb:22:15:22:15 | 1 |
| ifs.rb:25:3:25:8 | call to puts | ifs.rb:25:8:25:8 | x |
| ifs.rb:37:3:37:12 | call to puts | ifs.rb:37:8:37:12 | "bla" |
| ifs.rb:38:12:38:17 | ... == ... | ifs.rb:38:17:38:17 | 2 |
| ifs.rb:48:5:48:15 | call to puts | ifs.rb:48:10:48:15 | "true" |
| ifs.rb:51:3:51:13 | call to puts | ifs.rb:51:8:51:13 | "done" |
| loops.rb:2:9:2:14 | ... >= ... | loops.rb:2:14:2:14 | 0 |
| loops.rb:3:5:3:10 | call to puts | loops.rb:3:10:3:10 | x |
| loops.rb:4:7:4:8 | ... - ... | loops.rb:4:10:4:10 | 1 |
| loops.rb:9:9:9:14 | ... >= ... | loops.rb:9:14:9:14 | 0 |
| loops.rb:10:5:10:10 | call to puts | loops.rb:10:10:10:10 | x |
| loops.rb:11:7:11:8 | ... - ... | loops.rb:11:10:11:10 | 1 |
| loops.rb:12:8:12:14 | ... > ... | loops.rb:12:12:12:14 | 100 |
| loops.rb:14:11:14:16 | ... > ... | loops.rb:14:15:14:16 | 50 |
| loops.rb:16:11:16:16 | ... > ... | loops.rb:16:15:16:16 | 10 |
| loops.rb:19:5:19:15 | call to puts | loops.rb:19:10:19:15 | "Iter" |
| loops.rb:21:3:21:13 | call to puts | loops.rb:21:8:21:13 | "Done" |
| loops.rb:25:3:25:9 | call to [] | loops.rb:25:4:25:4 | 1 |
| loops.rb:25:3:25:9 | call to [] | loops.rb:25:6:25:6 | 2 |
| loops.rb:25:3:25:9 | call to [] | loops.rb:25:8:25:8 | 3 |
| loops.rb:26:5:26:10 | call to puts | loops.rb:26:10:26:10 | x |
| loops.rb:31:9:31:13 | ... < ... | loops.rb:31:13:31:13 | y |
| raise.rb:8:6:8:10 | ... > ... | raise.rb:8:10:8:10 | 2 |
| raise.rb:9:5:9:17 | call to raise | raise.rb:9:11:9:17 | "x > 2" |
| raise.rb:11:3:11:15 | call to puts | raise.rb:11:8:11:15 | "x <= 2" |
| raise.rb:17:7:17:22 | call to raise | raise.rb:17:13:17:22 | ExceptionA |
| raise.rb:20:5:20:18 | call to puts | raise.rb:20:10:20:18 | "Rescued" |
| raise.rb:22:3:22:15 | call to puts | raise.rb:22:8:22:15 | "End m2" |
| raise.rb:28:7:28:22 | call to raise | raise.rb:28:13:28:22 | ExceptionA |
| raise.rb:31:5:31:18 | call to puts | raise.rb:31:10:31:18 | "Rescued" |
| raise.rb:33:3:33:15 | call to puts | raise.rb:33:8:33:15 | "End m3" |
| raise.rb:39:7:39:22 | call to raise | raise.rb:39:13:39:22 | ExceptionA |
| raise.rb:42:5:42:22 | call to puts | raise.rb:42:10:42:22 | "Rescued {e}" |
| raise.rb:44:3:44:15 | call to puts | raise.rb:44:8:44:15 | "End m4" |
| raise.rb:50:7:50:22 | call to raise | raise.rb:50:13:50:22 | ExceptionA |
| raise.rb:54:3:54:15 | call to puts | raise.rb:54:8:54:15 | "End m5" |
| raise.rb:60:7:60:22 | call to raise | raise.rb:60:13:60:22 | ExceptionA |
| raise.rb:63:5:63:22 | call to puts | raise.rb:63:10:63:22 | "Rescued {e}" |
| raise.rb:65:3:65:15 | call to puts | raise.rb:65:8:65:15 | "End m6" |
| raise.rb:69:6:69:10 | ... > ... | raise.rb:69:10:69:10 | 2 |
| raise.rb:70:5:70:17 | call to raise | raise.rb:70:11:70:17 | "x > 2" |
| raise.rb:71:9:71:13 | ... < ... | raise.rb:71:13:71:13 | 0 |
| raise.rb:74:3:74:20 | call to puts | raise.rb:74:8:74:20 | "0 <= x <= 2" |
| raise.rb:76:3:76:15 | [ensure: raise] call to puts | raise.rb:76:8:76:15 | [ensure: raise] "ensure" |
| raise.rb:76:3:76:15 | [ensure: return] call to puts | raise.rb:76:8:76:15 | [ensure: return] "ensure" |
| raise.rb:76:3:76:15 | call to puts | raise.rb:76:8:76:15 | "ensure" |
| raise.rb:80:3:80:17 | call to puts | raise.rb:80:8:80:17 | "Begin m8" |
| raise.rb:82:8:82:12 | ... > ... | raise.rb:82:12:82:12 | 2 |
| raise.rb:83:7:83:19 | call to raise | raise.rb:83:13:83:19 | "x > 2" |
| raise.rb:84:11:84:15 | ... < ... | raise.rb:84:15:84:15 | 0 |
| raise.rb:87:5:87:22 | call to puts | raise.rb:87:10:87:22 | "0 <= x <= 2" |
| raise.rb:89:5:89:17 | [ensure: raise] call to puts | raise.rb:89:10:89:17 | [ensure: raise] "ensure" |
| raise.rb:89:5:89:17 | [ensure: return] call to puts | raise.rb:89:10:89:17 | [ensure: return] "ensure" |
| raise.rb:89:5:89:17 | call to puts | raise.rb:89:10:89:17 | "ensure" |
| raise.rb:91:3:91:15 | call to puts | raise.rb:91:8:91:15 | "End m8" |
| raise.rb:95:3:95:17 | call to puts | raise.rb:95:8:95:17 | "Begin m9" |
| raise.rb:97:8:97:12 | ... > ... | raise.rb:97:12:97:12 | 2 |
| raise.rb:98:7:98:19 | call to raise | raise.rb:98:13:98:19 | "x > 2" |
| raise.rb:99:11:99:15 | ... < ... | raise.rb:99:15:99:15 | 0 |
| raise.rb:102:5:102:22 | call to puts | raise.rb:102:10:102:22 | "0 <= x <= 2" |
| raise.rb:104:5:104:23 | [ensure: raise] call to puts | raise.rb:104:10:104:23 | [ensure: raise] "outer ensure" |
| raise.rb:104:5:104:23 | [ensure: return] call to puts | raise.rb:104:10:104:23 | [ensure: return] "outer ensure" |
| raise.rb:104:5:104:23 | call to puts | raise.rb:104:10:104:23 | "outer ensure" |
| raise.rb:107:9:107:26 | [ensure: raise] call to raise | raise.rb:107:15:107:26 | [ensure: raise] "b1 is true" |
| raise.rb:107:9:107:26 | [ensure: return] call to raise | raise.rb:107:15:107:26 | [ensure: return] "b1 is true" |
| raise.rb:107:9:107:26 | call to raise | raise.rb:107:15:107:26 | "b1 is true" |
| raise.rb:110:7:110:25 | [ensure(1): raise] call to puts | raise.rb:110:12:110:25 | [ensure(1): raise] "inner ensure" |
| raise.rb:110:7:110:25 | [ensure: raise, ensure(1): raise] call to puts | raise.rb:110:12:110:25 | [ensure: raise, ensure(1): raise] "inner ensure" |
| raise.rb:110:7:110:25 | [ensure: raise] call to puts | raise.rb:110:12:110:25 | [ensure: raise] "inner ensure" |
| raise.rb:110:7:110:25 | [ensure: return, ensure(1): raise] call to puts | raise.rb:110:12:110:25 | [ensure: return, ensure(1): raise] "inner ensure" |
| raise.rb:110:7:110:25 | [ensure: return] call to puts | raise.rb:110:12:110:25 | [ensure: return] "inner ensure" |
| raise.rb:110:7:110:25 | call to puts | raise.rb:110:12:110:25 | "inner ensure" |
| raise.rb:113:3:113:15 | call to puts | raise.rb:113:8:113:15 | "End m9" |
| raise.rb:115:3:115:22 | [ensure: raise] call to puts | raise.rb:115:8:115:22 | [ensure: raise] "method ensure" |
| raise.rb:115:3:115:22 | [ensure: return] call to puts | raise.rb:115:8:115:22 | [ensure: return] "method ensure" |
| raise.rb:115:3:115:22 | call to puts | raise.rb:115:8:115:22 | "method ensure" |
| raise.rb:117:5:117:22 | [ensure: raise] call to raise | raise.rb:117:11:117:22 | [ensure: raise] "b2 is true" |
| raise.rb:117:5:117:22 | [ensure: return] call to raise | raise.rb:117:11:117:22 | [ensure: return] "b2 is true" |
| raise.rb:117:5:117:22 | call to raise | raise.rb:117:11:117:22 | "b2 is true" |
| raise.rb:121:14:121:30 | call to raise | raise.rb:121:20:121:30 | "Exception" |
| raise.rb:125:3:125:51 | call to puts | raise.rb:125:8:125:51 | "Will not get executed if p is..." |
| raise.rb:131:7:131:22 | call to raise | raise.rb:131:13:131:22 | ExceptionA |
| raise.rb:135:5:135:21 | call to puts | raise.rb:135:10:135:21 | "ExceptionB" |
| raise.rb:137:5:137:17 | [ensure: raise] call to puts | raise.rb:137:10:137:17 | [ensure: raise] "Ensure" |
| raise.rb:137:5:137:17 | call to puts | raise.rb:137:10:137:17 | "Ensure" |
| raise.rb:139:3:139:16 | call to puts | raise.rb:139:8:139:16 | "End m11" |
| raise.rb:144:5:144:12 | call to raise | raise.rb:144:11:144:12 | "" |
| raise.rb:155:25:155:32 | call to raise | raise.rb:155:31:155:32 | "" |
| raise.rb:160:5:162:7 | call to bar | raise.rb:160:9:162:7 | -> { ... } |
| raise.rb:161:7:161:14 | call to raise | raise.rb:161:13:161:14 | "" |
| raise.rb:168:5:168:12 | call to raise | raise.rb:168:11:168:12 | "" |
keywordArguments
| cfg.html.erb:6:9:6:58 | call to stylesheet_link_tag | media | cfg.html.erb:6:54:6:58 | "all" |
| cfg.html.erb:12:11:12:33 | call to link_to | id | cfg.html.erb:12:31:12:33 | "a" |

12
ruby/ql/test/library-tests/controlflow/graph/Nodes.ql Normal file
View File

@@ -0,0 +1,12 @@
import codeql.ruby.controlflow.CfgNodes
import codeql.ruby.controlflow.CfgNodes::ExprNodes
query predicate callsWithNoArguments(CallCfgNode c) {
not exists(c.getArgument(_)) and not exists(c.getKeywordArgument(_))
}
query predicate positionalArguments(CallCfgNode c, ExprCfgNode arg) { arg = c.getArgument(_) }
query predicate keywordArguments(CallCfgNode c, string keyword, ExprCfgNode arg) {
arg = c.getKeywordArgument(keyword)
}

30
ruby/ql/test/library-tests/controlflow/graph/break_ensure.rb
View File

@@ -1,6 +1,6 @@
def m1 elements
for element in elements do
if element > 0 then
def m1 x
while x < 0
if x > 0 then
break
end
end
@@ -10,27 +10,27 @@ ensure
end
end
def m2 elements
for element in elements do
def m2(x, y)
while x < 0
begin
if element > 0 then
if x > 0 then
break
end
ensure
if elements.nil? then
puts "elements nil"
if y.nil? then
puts "y nil"
end
end
end
end
def m3 elements
def m3(x,y)
begin
if elements.nil? then
if x.nil? then
return
end
ensure
for element in elements do
while y < 0
begin
if x > 0 then
break
@@ -41,14 +41,14 @@ def m3 elements
puts "Done"
end
def m4 elements
for element in elements do
def m4 x
while x < 0
begin
if element > 1 then
if x > 1 then
raise ""
end
ensure
if element > 0 then
if x > 0 then
break 10;
end
end

33
ruby/ql/test/library-tests/dataflow/local/DataflowStep.expected
View File

@@ -1,5 +1,4 @@
| local_dataflow.rb:1:1:7:3 | self (foo) | local_dataflow.rb:3:8:3:10 | self |
| local_dataflow.rb:1:1:7:3 | self (local_dataflow.rb) | local_dataflow.rb:11:1:11:2 | self |
| local_dataflow.rb:1:1:7:3 | self (local_dataflow.rb) | local_dataflow.rb:49:1:53:3 | self |
| local_dataflow.rb:1:1:7:3 | self in foo | local_dataflow.rb:3:8:3:10 | self |
| local_dataflow.rb:1:9:1:9 | a | local_dataflow.rb:1:9:1:9 | a |
@@ -26,25 +25,29 @@
| local_dataflow.rb:9:1:9:15 | ... = ... | local_dataflow.rb:10:14:10:18 | array |
| local_dataflow.rb:9:9:9:15 | call to [] | local_dataflow.rb:9:1:9:15 | ... = ... |
| local_dataflow.rb:9:9:9:15 | call to [] | local_dataflow.rb:9:1:9:15 | ... = ... |
| local_dataflow.rb:10:5:13:3 | for ... in ... | local_dataflow.rb:10:1:13:3 | ... = ... |
| local_dataflow.rb:10:9:10:9 | x | local_dataflow.rb:12:5:12:5 | x |
| local_dataflow.rb:10:14:10:18 | array | local_dataflow.rb:10:5:13:3 | for ... in ... |
| local_dataflow.rb:10:5:13:3 | ... = ... | local_dataflow.rb:12:5:12:5 | x |
| local_dataflow.rb:10:5:13:3 | <captured> | local_dataflow.rb:11:1:11:2 | self |
| local_dataflow.rb:10:5:13:3 | __synth__0__1 | local_dataflow.rb:10:5:13:3 | ... = ... |
| local_dataflow.rb:10:5:13:3 | __synth__0__1 | local_dataflow.rb:10:5:13:3 | ... = ... |
| local_dataflow.rb:10:5:13:3 | __synth__0__1 | local_dataflow.rb:10:5:13:3 | __synth__0__1 |
| local_dataflow.rb:10:5:13:3 | __synth__0__1 | local_dataflow.rb:10:5:13:3 | __synth__0__1 |
| local_dataflow.rb:10:5:13:3 | call to each | local_dataflow.rb:10:1:13:3 | ... = ... |
| local_dataflow.rb:10:14:10:18 | [post] array | local_dataflow.rb:15:10:15:14 | array |
| local_dataflow.rb:10:14:10:18 | array | local_dataflow.rb:15:10:15:14 | array |
| local_dataflow.rb:11:1:11:2 | [post] self | local_dataflow.rb:12:3:12:5 | self |
| local_dataflow.rb:11:1:11:2 | self | local_dataflow.rb:12:3:12:5 | self |
| local_dataflow.rb:12:3:12:5 | [post] self | local_dataflow.rb:11:1:11:2 | self |
| local_dataflow.rb:12:3:12:5 | [post] self | local_dataflow.rb:49:1:53:3 | self |
| local_dataflow.rb:12:3:12:5 | call to p | local_dataflow.rb:10:19:13:3 | do ... |
| local_dataflow.rb:12:3:12:5 | self | local_dataflow.rb:11:1:11:2 | self |
| local_dataflow.rb:12:3:12:5 | self | local_dataflow.rb:49:1:53:3 | self |
| local_dataflow.rb:15:10:15:14 | array | local_dataflow.rb:15:1:17:3 | for ... in ... |
| local_dataflow.rb:15:1:17:3 | __synth__0__1 | local_dataflow.rb:15:1:17:3 | ... = ... |
| local_dataflow.rb:15:1:17:3 | __synth__0__1 | local_dataflow.rb:15:1:17:3 | ... = ... |
| local_dataflow.rb:15:1:17:3 | __synth__0__1 | local_dataflow.rb:15:1:17:3 | __synth__0__1 |
| local_dataflow.rb:15:1:17:3 | __synth__0__1 | local_dataflow.rb:15:1:17:3 | __synth__0__1 |
| local_dataflow.rb:15:10:15:14 | [post] array | local_dataflow.rb:19:10:19:14 | array |
| local_dataflow.rb:15:10:15:14 | array | local_dataflow.rb:19:10:19:14 | array |
| local_dataflow.rb:16:3:16:10 | break | local_dataflow.rb:15:1:17:3 | for ... in ... |
| local_dataflow.rb:16:9:16:10 | 10 | local_dataflow.rb:16:3:16:10 | break |
| local_dataflow.rb:19:5:19:5 | x | local_dataflow.rb:20:6:20:6 | x |
| local_dataflow.rb:19:10:19:14 | array | local_dataflow.rb:19:1:21:3 | for ... in ... |
| local_dataflow.rb:20:3:20:25 | if ... | local_dataflow.rb:19:16:21:3 | do ... |
| local_dataflow.rb:20:17:20:21 | break | local_dataflow.rb:19:1:21:3 | for ... in ... |
| local_dataflow.rb:19:1:21:3 | ... = ... | local_dataflow.rb:20:6:20:6 | x |
| local_dataflow.rb:19:1:21:3 | __synth__0__1 | local_dataflow.rb:19:1:21:3 | ... = ... |
| local_dataflow.rb:19:1:21:3 | __synth__0__1 | local_dataflow.rb:19:1:21:3 | ... = ... |
| local_dataflow.rb:19:1:21:3 | __synth__0__1 | local_dataflow.rb:19:1:21:3 | __synth__0__1 |
| local_dataflow.rb:19:1:21:3 | __synth__0__1 | local_dataflow.rb:19:1:21:3 | __synth__0__1 |
| local_dataflow.rb:24:2:24:8 | break | local_dataflow.rb:23:1:25:3 | while ... |
| local_dataflow.rb:24:8:24:8 | 5 | local_dataflow.rb:24:2:24:8 | break |
| local_dataflow.rb:28:5:28:26 | M | local_dataflow.rb:28:1:28:26 | ... = ... |

10
ruby/ql/test/library-tests/dataflow/local/Nodes.expected
View File

@@ -1,5 +1,9 @@
ret
| local_dataflow.rb:6:3:6:14 | ... = ... |
| local_dataflow.rb:12:3:12:5 | call to p |
| local_dataflow.rb:16:3:16:10 | break |
| local_dataflow.rb:20:3:20:25 | if ... |
| local_dataflow.rb:20:17:20:21 | break |
| local_dataflow.rb:32:14:32:21 | "method" |
| local_dataflow.rb:36:6:36:13 | return |
| local_dataflow.rb:38:3:38:13 | "reachable" |
@@ -17,9 +21,15 @@ arg
| local_dataflow.rb:9:10:9:10 | 1 | local_dataflow.rb:9:9:9:15 | call to [] | 0 |
| local_dataflow.rb:9:12:9:12 | 2 | local_dataflow.rb:9:9:9:15 | call to [] | 1 |
| local_dataflow.rb:9:14:9:14 | 3 | local_dataflow.rb:9:9:9:15 | call to [] | 2 |
| local_dataflow.rb:10:5:13:3 | { ... } | local_dataflow.rb:10:5:13:3 | call to each | -2 |
| local_dataflow.rb:10:14:10:18 | array | local_dataflow.rb:10:5:13:3 | call to each | -1 |
| local_dataflow.rb:11:1:11:2 | self | local_dataflow.rb:11:1:11:2 | call to do | -1 |
| local_dataflow.rb:12:3:12:5 | self | local_dataflow.rb:12:3:12:5 | call to p | -1 |
| local_dataflow.rb:12:5:12:5 | x | local_dataflow.rb:12:3:12:5 | call to p | 0 |
| local_dataflow.rb:15:1:17:3 | { ... } | local_dataflow.rb:15:1:17:3 | call to each | -2 |
| local_dataflow.rb:15:10:15:14 | array | local_dataflow.rb:15:1:17:3 | call to each | -1 |
| local_dataflow.rb:19:1:21:3 | { ... } | local_dataflow.rb:19:1:21:3 | call to each | -2 |
| local_dataflow.rb:19:10:19:14 | array | local_dataflow.rb:19:1:21:3 | call to each | -1 |
| local_dataflow.rb:20:6:20:6 | x | local_dataflow.rb:20:6:20:10 | ... > ... | -1 |
| local_dataflow.rb:20:10:20:10 | 1 | local_dataflow.rb:20:6:20:10 | ... > ... | 0 |
| local_dataflow.rb:35:6:35:6 | x | local_dataflow.rb:35:6:35:11 | ... == ... | -1 |

12
ruby/ql/test/library-tests/frameworks/http_clients/Excon.expected
View File

@@ -1,12 +0,0 @@
| Excon.rb:3:9:3:40 | call to get | Excon.rb:4:1:4:10 | call to body |
| Excon.rb:6:9:6:60 | call to post | Excon.rb:7:1:7:10 | call to body |
| Excon.rb:9:9:9:59 | call to put | Excon.rb:10:1:10:10 | call to body |
| Excon.rb:12:9:12:61 | call to patch | Excon.rb:13:1:13:10 | call to body |
| Excon.rb:15:9:15:43 | call to delete | Excon.rb:16:1:16:10 | call to body |
| Excon.rb:18:9:18:41 | call to head | Excon.rb:19:1:19:10 | call to body |
| Excon.rb:21:9:21:44 | call to options | Excon.rb:22:1:22:10 | call to body |
| Excon.rb:24:9:24:42 | call to trace | Excon.rb:25:1:25:10 | call to body |
| Excon.rb:28:9:28:34 | call to get | Excon.rb:29:1:29:10 | call to body |
| Excon.rb:31:10:31:39 | call to post | Excon.rb:32:1:32:11 | call to body |
| Excon.rb:35:9:35:34 | call to get | Excon.rb:36:1:36:10 | call to body |
| Excon.rb:38:10:38:39 | call to post | Excon.rb:39:1:39:11 | call to body |

4
ruby/ql/test/library-tests/frameworks/http_clients/Excon.ql
View File

@@ -1,4 +0,0 @@
import codeql.ruby.frameworks.http_clients.Excon
import codeql.ruby.DataFlow
query DataFlow::Node exconHttpRequests(ExconHttpRequest e) { result = e.getResponseBody() }

9
ruby/ql/test/library-tests/frameworks/http_clients/Faraday.expected
View File

@@ -1,9 +0,0 @@
| Faraday.rb:3:9:3:42 | call to get | Faraday.rb:4:1:4:10 | call to body |
| Faraday.rb:6:9:6:62 | call to post | Faraday.rb:7:1:7:10 | call to body |
| Faraday.rb:9:9:9:61 | call to put | Faraday.rb:10:1:10:10 | call to body |
| Faraday.rb:12:9:12:63 | call to patch | Faraday.rb:13:1:13:10 | call to body |
| Faraday.rb:15:9:15:45 | call to delete | Faraday.rb:16:1:16:10 | call to body |
| Faraday.rb:18:9:18:43 | call to head | Faraday.rb:19:1:19:10 | call to body |
| Faraday.rb:24:9:24:44 | call to trace | Faraday.rb:25:1:25:10 | call to body |
| Faraday.rb:28:9:28:27 | call to get | Faraday.rb:29:1:29:10 | call to body |
| Faraday.rb:31:10:31:46 | call to post | Faraday.rb:32:1:32:11 | call to body |

4
ruby/ql/test/library-tests/frameworks/http_clients/Faraday.ql
View File

@@ -1,4 +0,0 @@
import codeql.ruby.frameworks.http_clients.Faraday
import codeql.ruby.DataFlow
query DataFlow::Node faradayHttpRequests(FaradayHttpRequest e) { result = e.getResponseBody() }

6
ruby/ql/test/library-tests/frameworks/http_clients/Faraday.rb
View File

@@ -29,4 +29,8 @@ resp9 = connection.get("/")
resp9.body
resp10 = connection.post("/foo", some: "data")
resp10.body
resp10.body
connection = Faraday.new(url: "http://example.com")
resp11 = connection.get("/")
resp11.body

9
ruby/ql/test/library-tests/frameworks/http_clients/HttpClient.expected
View File

@@ -1,9 +0,0 @@
| HttpClient.rb:3:9:3:45 | call to get | HttpClient.rb:4:1:4:10 | call to body |
| HttpClient.rb:6:9:6:65 | call to post | HttpClient.rb:7:1:7:13 | call to content |
| HttpClient.rb:9:9:9:64 | call to put | HttpClient.rb:10:1:10:15 | call to http_body |
| HttpClient.rb:12:9:12:48 | call to delete | HttpClient.rb:13:1:13:10 | call to dump |
| HttpClient.rb:15:9:15:46 | call to head | HttpClient.rb:16:1:16:10 | call to body |
| HttpClient.rb:18:9:18:49 | call to options | HttpClient.rb:19:1:19:13 | call to content |
| HttpClient.rb:21:9:21:47 | call to trace | HttpClient.rb:22:1:22:15 | call to http_body |
| HttpClient.rb:24:9:24:53 | call to get_content | HttpClient.rb:24:9:24:53 | call to get_content |
| HttpClient.rb:26:10:26:74 | call to post_content | HttpClient.rb:26:10:26:74 | call to post_content |

4
ruby/ql/test/library-tests/frameworks/http_clients/HttpClient.ql
View File

@@ -1,4 +0,0 @@
import codeql.ruby.frameworks.http_clients.HttpClient
import codeql.ruby.DataFlow
query DataFlow::Node httpClientRequests(HttpClientRequest e) { result = e.getResponseBody() }

72
ruby/ql/test/library-tests/frameworks/http_clients/HttpClients.expected Normal file
View File

@@ -0,0 +1,72 @@
| Excon.rb:3:9:3:40 | call to get | Excon | Excon.rb:3:19:3:39 | "http://example.com/" | Excon.rb:4:1:4:10 | call to body |
| Excon.rb:6:9:6:60 | call to post | Excon | Excon.rb:6:20:6:40 | "http://example.com/" | Excon.rb:7:1:7:10 | call to body |
| Excon.rb:9:9:9:59 | call to put | Excon | Excon.rb:9:19:9:39 | "http://example.com/" | Excon.rb:10:1:10:10 | call to body |
| Excon.rb:12:9:12:61 | call to patch | Excon | Excon.rb:12:21:12:41 | "http://example.com/" | Excon.rb:13:1:13:10 | call to body |
| Excon.rb:15:9:15:43 | call to delete | Excon | Excon.rb:15:22:15:42 | "http://example.com/" | Excon.rb:16:1:16:10 | call to body |
| Excon.rb:18:9:18:41 | call to head | Excon | Excon.rb:18:20:18:40 | "http://example.com/" | Excon.rb:19:1:19:10 | call to body |
| Excon.rb:21:9:21:44 | call to options | Excon | Excon.rb:21:23:21:43 | "http://example.com/" | Excon.rb:22:1:22:10 | call to body |
| Excon.rb:24:9:24:42 | call to trace | Excon | Excon.rb:24:21:24:41 | "http://example.com/" | Excon.rb:25:1:25:10 | call to body |
| Excon.rb:28:9:28:34 | call to get | Excon | Excon.rb:27:25:27:44 | "http://example.com" | Excon.rb:29:1:29:10 | call to body |
| Excon.rb:28:9:28:34 | call to get | Excon | Excon.rb:28:31:28:33 | "/" | Excon.rb:29:1:29:10 | call to body |
| Excon.rb:31:10:31:39 | call to post | Excon | Excon.rb:27:25:27:44 | "http://example.com" | Excon.rb:32:1:32:11 | call to body |
| Excon.rb:31:10:31:39 | call to post | Excon | Excon.rb:31:33:31:38 | "/foo" | Excon.rb:32:1:32:11 | call to body |
| Excon.rb:35:9:35:34 | call to get | Excon | Excon.rb:34:37:34:56 | "http://example.com" | Excon.rb:36:1:36:10 | call to body |
| Excon.rb:35:9:35:34 | call to get | Excon | Excon.rb:35:31:35:33 | "/" | Excon.rb:36:1:36:10 | call to body |
| Excon.rb:38:10:38:39 | call to post | Excon | Excon.rb:34:37:34:56 | "http://example.com" | Excon.rb:39:1:39:11 | call to body |
| Excon.rb:38:10:38:39 | call to post | Excon | Excon.rb:38:33:38:38 | "/foo" | Excon.rb:39:1:39:11 | call to body |
| Faraday.rb:3:9:3:42 | call to get | Faraday | Faraday.rb:3:21:3:41 | "http://example.com/" | Faraday.rb:4:1:4:10 | call to body |
| Faraday.rb:6:9:6:62 | call to post | Faraday | Faraday.rb:6:22:6:42 | "http://example.com/" | Faraday.rb:7:1:7:10 | call to body |
| Faraday.rb:9:9:9:61 | call to put | Faraday | Faraday.rb:9:21:9:41 | "http://example.com/" | Faraday.rb:10:1:10:10 | call to body |
| Faraday.rb:12:9:12:63 | call to patch | Faraday | Faraday.rb:12:23:12:43 | "http://example.com/" | Faraday.rb:13:1:13:10 | call to body |
| Faraday.rb:15:9:15:45 | call to delete | Faraday | Faraday.rb:15:24:15:44 | "http://example.com/" | Faraday.rb:16:1:16:10 | call to body |
| Faraday.rb:18:9:18:43 | call to head | Faraday | Faraday.rb:18:22:18:42 | "http://example.com/" | Faraday.rb:19:1:19:10 | call to body |
| Faraday.rb:24:9:24:44 | call to trace | Faraday | Faraday.rb:24:23:24:43 | "http://example.com/" | Faraday.rb:25:1:25:10 | call to body |
| Faraday.rb:28:9:28:27 | call to get | Faraday | Faraday.rb:27:26:27:45 | "http://example.com" | Faraday.rb:29:1:29:10 | call to body |
| Faraday.rb:28:9:28:27 | call to get | Faraday | Faraday.rb:28:24:28:26 | "/" | Faraday.rb:29:1:29:10 | call to body |
| Faraday.rb:31:10:31:46 | call to post | Faraday | Faraday.rb:27:26:27:45 | "http://example.com" | Faraday.rb:32:1:32:11 | call to body |
| Faraday.rb:31:10:31:46 | call to post | Faraday | Faraday.rb:31:26:31:31 | "/foo" | Faraday.rb:32:1:32:11 | call to body |
| Faraday.rb:35:10:35:28 | call to get | Faraday | Faraday.rb:34:26:34:50 | Pair | Faraday.rb:36:1:36:11 | call to body |
| Faraday.rb:35:10:35:28 | call to get | Faraday | Faraday.rb:34:31:34:50 | "http://example.com" | Faraday.rb:36:1:36:11 | call to body |
| Faraday.rb:35:10:35:28 | call to get | Faraday | Faraday.rb:35:25:35:27 | "/" | Faraday.rb:36:1:36:11 | call to body |
| HttpClient.rb:3:9:3:45 | call to get | HTTPClient | HttpClient.rb:3:24:3:44 | "http://example.com/" | HttpClient.rb:4:1:4:10 | call to body |
| HttpClient.rb:6:9:6:65 | call to post | HTTPClient | HttpClient.rb:6:25:6:45 | "http://example.com/" | HttpClient.rb:7:1:7:13 | call to content |
| HttpClient.rb:9:9:9:64 | call to put | HTTPClient | HttpClient.rb:9:24:9:44 | "http://example.com/" | HttpClient.rb:10:1:10:15 | call to http_body |
| HttpClient.rb:12:9:12:48 | call to delete | HTTPClient | HttpClient.rb:12:27:12:47 | "http://example.com/" | HttpClient.rb:13:1:13:10 | call to dump |
| HttpClient.rb:15:9:15:46 | call to head | HTTPClient | HttpClient.rb:15:25:15:45 | "http://example.com/" | HttpClient.rb:16:1:16:10 | call to body |
| HttpClient.rb:18:9:18:49 | call to options | HTTPClient | HttpClient.rb:18:28:18:48 | "http://example.com/" | HttpClient.rb:19:1:19:13 | call to content |
| HttpClient.rb:21:9:21:47 | call to trace | HTTPClient | HttpClient.rb:21:26:21:46 | "http://example.com/" | HttpClient.rb:22:1:22:15 | call to http_body |
| HttpClient.rb:24:9:24:53 | call to get_content | HTTPClient | HttpClient.rb:24:32:24:52 | "http://example.com/" | HttpClient.rb:24:9:24:53 | call to get_content |
| HttpClient.rb:26:10:26:74 | call to post_content | HTTPClient | HttpClient.rb:26:34:26:54 | "http://example.com/" | HttpClient.rb:26:10:26:74 | call to post_content |
| Httparty.rb:5:1:5:35 | call to get | HTTParty | Httparty.rb:5:14:5:34 | "http://example.com/" | Httparty.rb:5:1:5:35 | call to get |
| Httparty.rb:7:1:7:55 | call to post | HTTParty | Httparty.rb:7:15:7:35 | "http://example.com/" | Httparty.rb:7:1:7:55 | call to post |
| Httparty.rb:9:1:9:54 | call to put | HTTParty | Httparty.rb:9:14:9:34 | "http://example.com/" | Httparty.rb:9:1:9:54 | call to put |
| Httparty.rb:11:1:11:56 | call to patch | HTTParty | Httparty.rb:11:16:11:36 | "http://example.com/" | Httparty.rb:11:1:11:56 | call to patch |
| Httparty.rb:15:9:15:46 | call to delete | HTTParty | Httparty.rb:15:25:15:45 | "http://example.com/" | Httparty.rb:16:1:16:10 | call to body |
| Httparty.rb:18:9:18:44 | call to head | HTTParty | Httparty.rb:18:23:18:43 | "http://example.com/" | Httparty.rb:19:1:19:10 | call to body |
| Httparty.rb:21:9:21:47 | call to options | HTTParty | Httparty.rb:21:26:21:46 | "http://example.com/" | Httparty.rb:22:1:22:10 | call to body |
| NetHttp.rb:4:1:4:18 | call to get | Net::HTTP | NetHttp.rb:4:15:4:17 | uri | NetHttp.rb:4:1:4:18 | call to get |
| NetHttp.rb:6:8:6:50 | call to post | Net::HTTP | NetHttp.rb:6:23:6:36 | call to parse | NetHttp.rb:7:1:7:9 | call to body |
| NetHttp.rb:6:8:6:50 | call to post | Net::HTTP | NetHttp.rb:6:23:6:36 | call to parse | NetHttp.rb:8:1:8:14 | call to read_body |
| NetHttp.rb:6:8:6:50 | call to post | Net::HTTP | NetHttp.rb:6:23:6:36 | call to parse | NetHttp.rb:9:1:9:11 | call to entity |
| NetHttp.rb:13:6:13:17 | call to get | Net::HTTP | NetHttp.rb:13:14:13:16 | "/" | NetHttp.rb:18:1:18:7 | call to body |
| NetHttp.rb:14:6:14:18 | call to post | Net::HTTP | NetHttp.rb:14:15:14:17 | "/" | NetHttp.rb:19:1:19:12 | call to read_body |
| NetHttp.rb:15:6:15:17 | call to put | Net::HTTP | NetHttp.rb:15:14:15:16 | "/" | NetHttp.rb:20:1:20:9 | call to entity |
| NetHttp.rb:24:3:24:33 | call to get | Net::HTTP | NetHttp.rb:24:29:24:32 | path | NetHttp.rb:27:1:27:28 | call to body |
| OpenURI.rb:3:9:3:41 | call to open | OpenURI | OpenURI.rb:3:21:3:40 | "http://example.com" | OpenURI.rb:4:1:4:10 | call to read |
| OpenURI.rb:6:9:6:34 | call to open | OpenURI | OpenURI.rb:6:14:6:33 | "http://example.com" | OpenURI.rb:7:1:7:15 | call to readlines |
| OpenURI.rb:9:9:9:38 | call to open | OpenURI | OpenURI.rb:9:18:9:37 | "http://example.com" | OpenURI.rb:10:1:10:10 | call to read |
| RestClient.rb:3:9:3:45 | call to get | RestClient | RestClient.rb:3:24:3:44 | "http://example.com/" | RestClient.rb:4:1:4:10 | call to body |
| RestClient.rb:6:9:6:59 | call to post | RestClient | RestClient.rb:6:25:6:44 | "http://example.com" | RestClient.rb:7:1:7:10 | call to body |
| RestClient.rb:9:9:9:58 | call to put | RestClient | RestClient.rb:9:24:9:43 | "http://example.com" | RestClient.rb:10:1:10:10 | call to body |
| RestClient.rb:12:9:12:60 | call to patch | RestClient | RestClient.rb:12:26:12:45 | "http://example.com" | RestClient.rb:13:1:13:10 | call to body |
| RestClient.rb:15:9:15:47 | call to delete | RestClient | RestClient.rb:15:27:15:46 | "http://example.com" | RestClient.rb:16:1:16:10 | call to body |
| RestClient.rb:18:9:18:45 | call to head | RestClient | RestClient.rb:18:25:18:44 | "http://example.com" | RestClient.rb:19:1:19:10 | call to body |
| RestClient.rb:21:9:21:48 | call to options | RestClient | RestClient.rb:21:28:21:47 | "http://example.com" | RestClient.rb:22:1:22:10 | call to body |
| RestClient.rb:28:9:28:85 | call to execute | RestClient | RestClient.rb:28:56:28:84 | "http://example.com/resource" | RestClient.rb:29:1:29:10 | call to body |
| Typhoeus.rb:3:9:3:43 | call to get | Typhoeus | Typhoeus.rb:3:22:3:42 | "http://example.com/" | Typhoeus.rb:4:1:4:10 | call to body |
| Typhoeus.rb:6:9:6:63 | call to post | Typhoeus | Typhoeus.rb:6:23:6:43 | "http://example.com/" | Typhoeus.rb:7:1:7:10 | call to body |
| Typhoeus.rb:9:9:9:62 | call to put | Typhoeus | Typhoeus.rb:9:22:9:42 | "http://example.com/" | Typhoeus.rb:10:1:10:10 | call to body |
| Typhoeus.rb:12:9:12:64 | call to patch | Typhoeus | Typhoeus.rb:12:24:12:44 | "http://example.com/" | Typhoeus.rb:13:1:13:10 | call to body |
| Typhoeus.rb:15:9:15:46 | call to delete | Typhoeus | Typhoeus.rb:15:25:15:45 | "http://example.com/" | Typhoeus.rb:16:1:16:10 | call to body |
| Typhoeus.rb:18:9:18:44 | call to head | Typhoeus | Typhoeus.rb:18:23:18:43 | "http://example.com/" | Typhoeus.rb:19:1:19:10 | call to body |
| Typhoeus.rb:21:9:21:47 | call to options | Typhoeus | Typhoeus.rb:21:26:21:46 | "http://example.com/" | Typhoeus.rb:22:1:22:10 | call to body |

10
ruby/ql/test/library-tests/frameworks/http_clients/HttpClients.ql Normal file
View File

@@ -0,0 +1,10 @@
import codeql.ruby.Concepts
import codeql.ruby.DataFlow
query predicate httpRequests(
HTTP::Client::Request r, string framework, DataFlow::Node url, DataFlow::Node responseBody
) {
r.getFramework() = framework and
r.getURL() = url and
r.getResponseBody() = responseBody
}

7
ruby/ql/test/library-tests/frameworks/http_clients/Httparty.expected
View File

@@ -1,7 +0,0 @@
| Httparty.rb:5:1:5:35 | call to get | Httparty.rb:5:1:5:35 | call to get |
| Httparty.rb:7:1:7:55 | call to post | Httparty.rb:7:1:7:55 | call to post |
| Httparty.rb:9:1:9:54 | call to put | Httparty.rb:9:1:9:54 | call to put |
| Httparty.rb:11:1:11:56 | call to patch | Httparty.rb:11:1:11:56 | call to patch |
| Httparty.rb:15:9:15:46 | call to delete | Httparty.rb:16:1:16:10 | call to body |
| Httparty.rb:18:9:18:44 | call to head | Httparty.rb:19:1:19:10 | call to body |
| Httparty.rb:21:9:21:47 | call to options | Httparty.rb:22:1:22:10 | call to body |

4
ruby/ql/test/library-tests/frameworks/http_clients/Httparty.ql
View File

@@ -1,4 +0,0 @@
import codeql.ruby.frameworks.http_clients.Httparty
import codeql.ruby.DataFlow
query DataFlow::Node httpartyRequests(HttpartyRequest e) { result = e.getResponseBody() }

8
ruby/ql/test/library-tests/frameworks/http_clients/NetHttp.expected
View File

@@ -1,8 +0,0 @@
| NetHttp.rb:4:1:4:18 | call to get | NetHttp.rb:4:1:4:18 | call to get |
| NetHttp.rb:6:8:6:50 | call to post | NetHttp.rb:7:1:7:9 | call to body |
| NetHttp.rb:6:8:6:50 | call to post | NetHttp.rb:8:1:8:14 | call to read_body |
| NetHttp.rb:6:8:6:50 | call to post | NetHttp.rb:9:1:9:11 | call to entity |
| NetHttp.rb:13:6:13:17 | call to get | NetHttp.rb:18:1:18:7 | call to body |
| NetHttp.rb:14:6:14:18 | call to post | NetHttp.rb:19:1:19:12 | call to read_body |
| NetHttp.rb:15:6:15:17 | call to put | NetHttp.rb:20:1:20:9 | call to entity |
| NetHttp.rb:24:3:24:33 | call to get | NetHttp.rb:27:1:27:28 | call to body |

4
ruby/ql/test/library-tests/frameworks/http_clients/NetHttp.ql
View File

@@ -1,4 +0,0 @@
import codeql.ruby.frameworks.http_clients.NetHttp
import codeql.ruby.DataFlow
query DataFlow::Node netHttpRequests(NetHttpRequest e) { result = e.getResponseBody() }

6
ruby/ql/test/library-tests/frameworks/http_clients/OpenURI.expected
View File

@@ -1,6 +0,0 @@
openUriRequests
| OpenURI.rb:9:9:9:38 | call to open | OpenURI.rb:10:1:10:10 | call to read |
| OpenURI.rb:12:9:12:45 | call to open | OpenURI.rb:13:1:13:10 | call to read |
openUriKernelOpenRequests
| OpenURI.rb:3:9:3:41 | call to open | OpenURI.rb:4:1:4:10 | call to read |
| OpenURI.rb:6:9:6:34 | call to open | OpenURI.rb:7:1:7:15 | call to readlines |

8
ruby/ql/test/library-tests/frameworks/http_clients/OpenURI.ql
View File

@@ -1,8 +0,0 @@
import codeql.ruby.frameworks.http_clients.OpenURI
import codeql.ruby.DataFlow
query DataFlow::Node openUriRequests(OpenUriRequest e) { result = e.getResponseBody() }
query DataFlow::Node openUriKernelOpenRequests(OpenUriKernelOpenRequest e) {
result = e.getResponseBody()
}

8
ruby/ql/test/library-tests/frameworks/http_clients/RestClient.expected
View File

@@ -1,8 +0,0 @@
| RestClient.rb:3:9:3:45 | call to get | RestClient.rb:4:1:4:10 | call to body |
| RestClient.rb:6:9:6:59 | call to post | RestClient.rb:7:1:7:10 | call to body |
| RestClient.rb:9:9:9:58 | call to put | RestClient.rb:10:1:10:10 | call to body |
| RestClient.rb:12:9:12:60 | call to patch | RestClient.rb:13:1:13:10 | call to body |
| RestClient.rb:15:9:15:47 | call to delete | RestClient.rb:16:1:16:10 | call to body |
| RestClient.rb:18:9:18:45 | call to head | RestClient.rb:19:1:19:10 | call to body |
| RestClient.rb:21:9:21:48 | call to options | RestClient.rb:22:1:22:10 | call to body |
| RestClient.rb:25:9:25:21 | call to get | RestClient.rb:26:1:26:10 | call to body |

6
ruby/ql/test/library-tests/frameworks/http_clients/RestClient.ql
View File

@@ -1,6 +0,0 @@
import codeql.ruby.frameworks.http_clients.RestClient
import codeql.ruby.DataFlow
query DataFlow::Node restClientHttpRequests(RestClientHttpRequest e) {
result = e.getResponseBody()
}

5
ruby/ql/test/library-tests/frameworks/http_clients/RestClient.rb
View File

@@ -23,4 +23,7 @@ resp7.body
resource8 = RestClient::Resource.new "http://example.com"
resp8 = resource8.get
resp8.body
resp8.body
resp9 = RestClient::Request.execute(method: :get, url: 'http://example.com/resource')
resp9.body

7
ruby/ql/test/library-tests/frameworks/http_clients/Typhoeus.expected
View File

@@ -1,7 +0,0 @@
| Typhoeus.rb:3:9:3:43 | call to get | Typhoeus.rb:4:1:4:10 | call to body |
| Typhoeus.rb:6:9:6:63 | call to post | Typhoeus.rb:7:1:7:10 | call to body |
| Typhoeus.rb:9:9:9:62 | call to put | Typhoeus.rb:10:1:10:10 | call to body |
| Typhoeus.rb:12:9:12:64 | call to patch | Typhoeus.rb:13:1:13:10 | call to body |
| Typhoeus.rb:15:9:15:46 | call to delete | Typhoeus.rb:16:1:16:10 | call to body |
| Typhoeus.rb:18:9:18:44 | call to head | Typhoeus.rb:19:1:19:10 | call to body |
| Typhoeus.rb:21:9:21:47 | call to options | Typhoeus.rb:22:1:22:10 | call to body |

4
ruby/ql/test/library-tests/frameworks/http_clients/Typhoeus.ql
View File

@@ -1,4 +0,0 @@
import codeql.ruby.frameworks.http_clients.Typhoeus
import codeql.ruby.DataFlow
query DataFlow::Node typhoeusHttpRequests(TyphoeusHttpRequest e) { result = e.getResponseBody() }

1
ruby/ql/test/library-tests/variables/parameter.expected
View File

@@ -28,6 +28,7 @@ parameterVariable
| ssa.rb:1:7:1:7 | b | ssa.rb:1:7:1:7 | b |
| ssa.rb:18:8:18:8 | x | ssa.rb:18:8:18:8 | x |
| ssa.rb:25:8:25:15 | elements | ssa.rb:25:8:25:15 | elements |
| ssa.rb:26:3:28:5 | __synth__0__1 | ssa.rb:26:3:28:5 | __synth__0__1 |
| ssa.rb:33:20:33:20 | x | ssa.rb:33:20:33:20 | x |
| ssa.rb:44:8:44:8 | b | ssa.rb:44:8:44:8 | b |
| ssa.rb:49:9:49:9 | x | ssa.rb:49:9:49:9 | x |

34
ruby/ql/test/library-tests/variables/ssa.expected
View File

@@ -82,8 +82,12 @@ definition
| scopes.rb:13:14:13:14 | ... = ... | scopes.rb:13:14:13:14 | d |
| scopes.rb:13:19:13:32 | ... = ... | scopes.rb:13:4:13:32 | __synth__0 |
| scopes.rb:27:1:27:5 | ... = ... | scopes.rb:27:1:27:1 | x |
| scopes.rb:29:3:29:7 | ... = ... | scopes.rb:29:3:29:3 | x |
| scopes.rb:32:3:32:7 | ... = ... | scopes.rb:32:3:32:3 | x |
| scopes.rb:35:3:35:7 | ... = ... | scopes.rb:35:3:35:3 | x |
| scopes.rb:41:1:49:3 | self (M) | scopes.rb:41:1:49:3 | self |
| scopes.rb:42:2:42:9 | ... = ... | scopes.rb:42:2:42:4 | var |
| scopes.rb:43:2:43:13 | ... = ... | scopes.rb:43:2:43:4 | foo |
| scopes.rb:46:5:46:13 | ... = ... | scopes.rb:46:5:46:8 | var2 |
| ssa.rb:1:1:16:3 | self (m) | ssa.rb:1:1:16:3 | self |
| ssa.rb:1:7:1:7 | b | ssa.rb:1:7:1:7 | b |
@@ -98,8 +102,10 @@ definition
| ssa.rb:25:1:30:3 | <uninitialized> | ssa.rb:26:7:26:10 | elem |
| ssa.rb:25:1:30:3 | self (m2) | ssa.rb:25:1:30:3 | self |
| ssa.rb:25:8:25:15 | elements | ssa.rb:25:8:25:15 | elements |
| ssa.rb:26:7:26:10 | elem | ssa.rb:26:7:26:10 | elem |
| ssa.rb:26:12:26:22 | phi | ssa.rb:26:7:26:10 | elem |
| ssa.rb:26:3:28:5 | ... = ... | ssa.rb:26:7:26:10 | elem |
| ssa.rb:26:3:28:5 | <captured> | ssa.rb:25:1:30:3 | self |
| ssa.rb:26:3:28:5 | __synth__0__1 | ssa.rb:26:3:28:5 | __synth__0__1 |
| ssa.rb:26:3:28:5 | call to each | ssa.rb:26:7:26:10 | elem |
| ssa.rb:33:16:35:5 | <captured> | ssa.rb:32:1:36:3 | self |
| ssa.rb:33:20:33:20 | x | ssa.rb:33:20:33:20 | x |
| ssa.rb:38:1:42:3 | self (m4) | ssa.rb:38:1:42:3 | self |
@@ -264,11 +270,12 @@ read
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:19:9:19:9 | x |
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:20:10:20:10 | x |
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:21:5:21:5 | x |
| ssa.rb:25:1:30:3 | self (m2) | ssa.rb:25:1:30:3 | self | ssa.rb:27:5:27:13 | self |
| ssa.rb:25:1:30:3 | self (m2) | ssa.rb:25:1:30:3 | self | ssa.rb:29:3:29:11 | self |
| ssa.rb:25:8:25:15 | elements | ssa.rb:25:8:25:15 | elements | ssa.rb:26:15:26:22 | elements |
| ssa.rb:26:7:26:10 | elem | ssa.rb:26:7:26:10 | elem | ssa.rb:27:10:27:13 | elem |
| ssa.rb:26:12:26:22 | phi | ssa.rb:26:7:26:10 | elem | ssa.rb:29:8:29:11 | elem |
| ssa.rb:26:3:28:5 | ... = ... | ssa.rb:26:7:26:10 | elem | ssa.rb:27:10:27:13 | elem |
| ssa.rb:26:3:28:5 | <captured> | ssa.rb:25:1:30:3 | self | ssa.rb:27:5:27:13 | self |
| ssa.rb:26:3:28:5 | __synth__0__1 | ssa.rb:26:3:28:5 | __synth__0__1 | ssa.rb:26:3:28:5 | __synth__0__1 |
| ssa.rb:26:3:28:5 | call to each | ssa.rb:26:7:26:10 | elem | ssa.rb:29:8:29:11 | elem |
| ssa.rb:33:16:35:5 | <captured> | ssa.rb:32:1:36:3 | self | ssa.rb:34:5:34:10 | self |
| ssa.rb:33:20:33:20 | x | ssa.rb:33:20:33:20 | x | ssa.rb:34:10:34:10 | x |
| ssa.rb:38:1:42:3 | self (m4) | ssa.rb:38:1:42:3 | self | ssa.rb:39:3:39:9 | self |
@@ -392,11 +399,12 @@ firstRead
| ssa.rb:10:5:10:9 | ... = ... | ssa.rb:2:3:2:3 | i | ssa.rb:11:10:11:10 | i |
| ssa.rb:18:1:23:3 | self (m1) | ssa.rb:18:1:23:3 | self | ssa.rb:20:5:20:10 | self |
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:19:9:19:9 | x |
| ssa.rb:25:1:30:3 | self (m2) | ssa.rb:25:1:30:3 | self | ssa.rb:27:5:27:13 | self |
| ssa.rb:25:1:30:3 | self (m2) | ssa.rb:25:1:30:3 | self | ssa.rb:29:3:29:11 | self |
| ssa.rb:25:8:25:15 | elements | ssa.rb:25:8:25:15 | elements | ssa.rb:26:15:26:22 | elements |
| ssa.rb:26:7:26:10 | elem | ssa.rb:26:7:26:10 | elem | ssa.rb:27:10:27:13 | elem |
| ssa.rb:26:12:26:22 | phi | ssa.rb:26:7:26:10 | elem | ssa.rb:29:8:29:11 | elem |
| ssa.rb:26:3:28:5 | ... = ... | ssa.rb:26:7:26:10 | elem | ssa.rb:27:10:27:13 | elem |
| ssa.rb:26:3:28:5 | <captured> | ssa.rb:25:1:30:3 | self | ssa.rb:27:5:27:13 | self |
| ssa.rb:26:3:28:5 | __synth__0__1 | ssa.rb:26:3:28:5 | __synth__0__1 | ssa.rb:26:3:28:5 | __synth__0__1 |
| ssa.rb:26:3:28:5 | call to each | ssa.rb:26:7:26:10 | elem | ssa.rb:29:8:29:11 | elem |
| ssa.rb:33:16:35:5 | <captured> | ssa.rb:32:1:36:3 | self | ssa.rb:34:5:34:10 | self |
| ssa.rb:33:20:33:20 | x | ssa.rb:33:20:33:20 | x | ssa.rb:34:10:34:10 | x |
| ssa.rb:38:1:42:3 | self (m4) | ssa.rb:38:1:42:3 | self | ssa.rb:39:3:39:9 | self |
@@ -519,8 +527,10 @@ lastRead
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:21:5:21:5 | x |
| ssa.rb:25:1:30:3 | self (m2) | ssa.rb:25:1:30:3 | self | ssa.rb:29:3:29:11 | self |
| ssa.rb:25:8:25:15 | elements | ssa.rb:25:8:25:15 | elements | ssa.rb:26:15:26:22 | elements |
| ssa.rb:26:7:26:10 | elem | ssa.rb:26:7:26:10 | elem | ssa.rb:27:10:27:13 | elem |
| ssa.rb:26:12:26:22 | phi | ssa.rb:26:7:26:10 | elem | ssa.rb:29:8:29:11 | elem |
| ssa.rb:26:3:28:5 | ... = ... | ssa.rb:26:7:26:10 | elem | ssa.rb:27:10:27:13 | elem |
| ssa.rb:26:3:28:5 | <captured> | ssa.rb:25:1:30:3 | self | ssa.rb:27:5:27:13 | self |
| ssa.rb:26:3:28:5 | __synth__0__1 | ssa.rb:26:3:28:5 | __synth__0__1 | ssa.rb:26:3:28:5 | __synth__0__1 |
| ssa.rb:26:3:28:5 | call to each | ssa.rb:26:7:26:10 | elem | ssa.rb:29:8:29:11 | elem |
| ssa.rb:33:16:35:5 | <captured> | ssa.rb:32:1:36:3 | self | ssa.rb:34:5:34:10 | self |
| ssa.rb:33:20:33:20 | x | ssa.rb:33:20:33:20 | x | ssa.rb:34:10:34:10 | x |
| ssa.rb:38:1:42:3 | self (m4) | ssa.rb:38:1:42:3 | self | ssa.rb:41:3:41:13 | self |
@@ -591,8 +601,6 @@ adjacentReads
| ssa.rb:18:1:23:3 | self (m1) | ssa.rb:18:1:23:3 | self | ssa.rb:20:5:20:10 | self | ssa.rb:20:5:20:10 | self |
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:19:9:19:9 | x | ssa.rb:20:10:20:10 | x |
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:20:10:20:10 | x | ssa.rb:21:5:21:5 | x |
| ssa.rb:25:1:30:3 | self (m2) | ssa.rb:25:1:30:3 | self | ssa.rb:27:5:27:13 | self | ssa.rb:27:5:27:13 | self |
| ssa.rb:25:1:30:3 | self (m2) | ssa.rb:25:1:30:3 | self | ssa.rb:27:5:27:13 | self | ssa.rb:29:3:29:11 | self |
| ssa.rb:38:1:42:3 | self (m4) | ssa.rb:38:1:42:3 | self | ssa.rb:39:3:39:9 | self | ssa.rb:39:8:39:9 | self |
| ssa.rb:38:1:42:3 | self (m4) | ssa.rb:38:1:42:3 | self | ssa.rb:39:8:39:9 | self | ssa.rb:41:3:41:13 | self |
| ssa.rb:66:11:70:5 | <captured> | ssa.rb:64:1:72:3 | self | ssa.rb:67:5:67:10 | self | ssa.rb:68:5:68:17 | self |
@@ -608,8 +616,6 @@ phi
| ssa.rb:5:3:13:5 | phi | ssa.rb:2:3:2:3 | i | ssa.rb:10:5:10:9 | ... = ... |
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:18:8:18:8 | x |
| ssa.rb:19:9:19:9 | phi | ssa.rb:18:8:18:8 | x | ssa.rb:21:5:21:10 | ... = ... |
| ssa.rb:26:12:26:22 | phi | ssa.rb:26:7:26:10 | elem | ssa.rb:25:1:30:3 | <uninitialized> |
| ssa.rb:26:12:26:22 | phi | ssa.rb:26:7:26:10 | elem | ssa.rb:26:7:26:10 | elem |
| ssa.rb:45:3:45:12 | phi | ssa.rb:45:3:45:3 | x | ssa.rb:44:1:47:3 | <uninitialized> |
| ssa.rb:45:3:45:12 | phi | ssa.rb:45:3:45:3 | x | ssa.rb:45:3:45:7 | ... = ... |
| ssa.rb:50:3:50:8 | phi | ssa.rb:49:14:49:14 | y | ssa.rb:49:1:51:3 | <uninitialized> |

3
ruby/ql/test/library-tests/variables/varaccess.expected
View File

@@ -316,6 +316,7 @@ explicitWrite
| ssa.rb:10:5:10:5 | i | ssa.rb:10:5:10:9 | ... = ... |
| ssa.rb:21:5:21:5 | x | ssa.rb:21:5:21:10 | ... -= ... |
| ssa.rb:21:5:21:5 | x | ssa.rb:21:5:21:10 | ... = ... |
| ssa.rb:26:7:26:10 | elem | ssa.rb:26:3:28:5 | ... = ... |
| ssa.rb:40:3:40:4 | m3 | ssa.rb:40:3:40:9 | ... = ... |
| ssa.rb:45:3:45:3 | x | ssa.rb:45:3:45:7 | ... = ... |
| ssa.rb:49:14:49:14 | y | ssa.rb:49:14:49:19 | ... = ... |
@@ -358,6 +359,7 @@ implicitWrite
| ssa.rb:1:7:1:7 | b |
| ssa.rb:18:8:18:8 | x |
| ssa.rb:25:8:25:15 | elements |
| ssa.rb:26:3:28:5 | __synth__0__1 |
| ssa.rb:26:7:26:10 | elem |
| ssa.rb:33:20:33:20 | x |
| ssa.rb:44:8:44:8 | b |
@@ -502,6 +504,7 @@ readAccess
| ssa.rb:20:5:20:10 | self |
| ssa.rb:20:10:20:10 | x |
| ssa.rb:21:5:21:5 | x |
| ssa.rb:26:3:28:5 | __synth__0__1 |
| ssa.rb:26:15:26:22 | elements |
| ssa.rb:27:5:27:13 | self |
| ssa.rb:27:10:27:13 | elem |

1
ruby/ql/test/library-tests/variables/variable.expected
View File

@@ -123,6 +123,7 @@
| ssa.rb:18:8:18:8 | x |
| ssa.rb:25:1:30:3 | self |
| ssa.rb:25:8:25:15 | elements |
| ssa.rb:26:3:28:5 | __synth__0__1 |
| ssa.rb:26:7:26:10 | elem |
| ssa.rb:32:1:36:3 | self |
| ssa.rb:33:20:33:20 | x |

1
ruby/ql/test/library-tests/variables/varscopes.expected
View File

@@ -59,6 +59,7 @@
| ssa.rb:1:1:88:3 | ssa.rb |
| ssa.rb:18:1:23:3 | m1 |
| ssa.rb:25:1:30:3 | m2 |
| ssa.rb:26:3:28:5 | { ... } |
| ssa.rb:32:1:36:3 | m3 |
| ssa.rb:33:16:35:5 | do ... end |
| ssa.rb:38:1:42:3 | m4 |

24
ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.expected Normal file
View File

@@ -0,0 +1,24 @@
edges
| RegExpInjection.rb:4:12:4:17 | call to params : | RegExpInjection.rb:5:13:5:21 | /#{...}/ |
| RegExpInjection.rb:10:12:10:17 | call to params : | RegExpInjection.rb:11:13:11:27 | /foo#{...}bar/ |
| RegExpInjection.rb:16:12:16:17 | call to params : | RegExpInjection.rb:17:24:17:27 | name |
| RegExpInjection.rb:22:12:22:17 | call to params : | RegExpInjection.rb:23:24:23:33 | ... + ... |
| RegExpInjection.rb:54:12:54:17 | call to params : | RegExpInjection.rb:55:28:55:37 | ... + ... |
nodes
| RegExpInjection.rb:4:12:4:17 | call to params : | semmle.label | call to params : |
| RegExpInjection.rb:5:13:5:21 | /#{...}/ | semmle.label | /#{...}/ |
| RegExpInjection.rb:10:12:10:17 | call to params : | semmle.label | call to params : |
| RegExpInjection.rb:11:13:11:27 | /foo#{...}bar/ | semmle.label | /foo#{...}bar/ |
| RegExpInjection.rb:16:12:16:17 | call to params : | semmle.label | call to params : |
| RegExpInjection.rb:17:24:17:27 | name | semmle.label | name |
| RegExpInjection.rb:22:12:22:17 | call to params : | semmle.label | call to params : |
| RegExpInjection.rb:23:24:23:33 | ... + ... | semmle.label | ... + ... |
| RegExpInjection.rb:54:12:54:17 | call to params : | semmle.label | call to params : |
| RegExpInjection.rb:55:28:55:37 | ... + ... | semmle.label | ... + ... |
subpaths
#select
| RegExpInjection.rb:5:13:5:21 | /#{...}/ | RegExpInjection.rb:4:12:4:17 | call to params : | RegExpInjection.rb:5:13:5:21 | /#{...}/ | This regular expression is constructed from a $@. | RegExpInjection.rb:4:12:4:17 | call to params | user-provided value |
| RegExpInjection.rb:11:13:11:27 | /foo#{...}bar/ | RegExpInjection.rb:10:12:10:17 | call to params : | RegExpInjection.rb:11:13:11:27 | /foo#{...}bar/ | This regular expression is constructed from a $@. | RegExpInjection.rb:10:12:10:17 | call to params | user-provided value |
| RegExpInjection.rb:17:24:17:27 | name | RegExpInjection.rb:16:12:16:17 | call to params : | RegExpInjection.rb:17:24:17:27 | name | This regular expression is constructed from a $@. | RegExpInjection.rb:16:12:16:17 | call to params | user-provided value |
| RegExpInjection.rb:23:24:23:33 | ... + ... | RegExpInjection.rb:22:12:22:17 | call to params : | RegExpInjection.rb:23:24:23:33 | ... + ... | This regular expression is constructed from a $@. | RegExpInjection.rb:22:12:22:17 | call to params | user-provided value |
| RegExpInjection.rb:55:28:55:37 | ... + ... | RegExpInjection.rb:54:12:54:17 | call to params : | RegExpInjection.rb:55:28:55:37 | ... + ... | This regular expression is constructed from a $@. | RegExpInjection.rb:54:12:54:17 | call to params | user-provided value |

1
ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.qlref Normal file
View File

@@ -0,0 +1 @@
queries/security/cwe-1333/RegExpInjection.ql

57
ruby/ql/test/query-tests/security/cwe-1333-regexp-injection/RegExpInjection.rb Normal file
View File

@@ -0,0 +1,57 @@
class FooController < ActionController::Base
# BAD
def route0
name = params[:name]
regex = /#{name}/
end
# BAD
def route1
name = params[:name]
regex = /foo#{name}bar/
end
# BAD
def route2
name = params[:name]
regex = Regexp.new(name)
end
# BAD
def route3
name = params[:name]
regex = Regexp.new("@" + name)
end
# GOOD - string is compared against a constant string
def route4
name = params[:name]
regex = Regexp.new("@" + name) if name == "foo"
end
# GOOD - string is compared against a constant string array
def route5
name = params[:name]
if ["John", "Paul", "George", "Ringo"].include?(name)
regex = /@#{name}/
end
end
# GOOD - string is explicitly escaped
def route6
name = params[:name]
regex = Regexp.new(Regexp.escape(name))
end
# GOOD - string is explicitly escaped
def route7
name = params[:name]
regex = Regexp.new(Regexp.quote(name))
end
# BAD
def route8
name = params[:name]
regex = Regexp.compile("@" + name)
end
end

4
ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.expected Normal file
View File

@@ -0,0 +1,4 @@
| railsapp/app/controllers/users_controller.rb:4:3:4:47 | call to skip_before_action | Potential CSRF vulnerability due to forgery protection being disabled. |
| railsapp/config/application.rb:15:5:15:53 | call to allow_forgery_protection= | Potential CSRF vulnerability due to forgery protection being disabled. |
| railsapp/config/environments/development.rb:5:3:5:51 | call to allow_forgery_protection= | Potential CSRF vulnerability due to forgery protection being disabled. |
| railsapp/config/environments/production.rb:5:3:5:51 | call to allow_forgery_protection= | Potential CSRF vulnerability due to forgery protection being disabled. |

1
ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.qlref Normal file
View File

@@ -0,0 +1 @@
queries/security/cwe-352/CSRFProtectionDisabled.ql

2
ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/application_controller.rb Normal file
View File

@@ -0,0 +1,2 @@
class ApplicationController < ActionController::Base
end

11
ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/users_controller.rb Normal file
View File

@@ -0,0 +1,11 @@
class UsersController < ApplicationController
# BAD: Disabling forgery protection may open the application to CSRF attacks
skip_before_action :verify_authenticity_token
def change_email
user = User.find_by(name: params[:user_name])
user.email = params[:new_email]
user.save!
end
end

17
ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb Normal file
View File

@@ -0,0 +1,17 @@
require_relative 'boot'
require 'rails/all'
# Require the gems listed in Gemfile, including any gems
# you've limited to :test, :development, or :production.
Bundler.require(*Rails.groups)
module Railsapp
class Application < Rails::Application
# Initialize configuration defaults for originally generated Rails version.
config.load_defaults 6.0
# BAD: Disabling forgery protection may open the application to CSRF attacks
config.action_controller.allow_forgery_protection = false
end
end

5
ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environment.rb Normal file
View File

@@ -0,0 +1,5 @@
# Load the Rails application.
require_relative 'application'
# Initialize the Rails application.
Rails.application.initialize!

6
ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/development.rb Normal file
View File

@@ -0,0 +1,6 @@
Rails.application.configure do
# Settings specified here will take precedence over those in config/application.rb.
# GOOD: disabling CSRF protection in the development environment should not be flagged
config.action_controller.allow_forgery_protection = false
end

6
ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/production.rb Normal file
View File

@@ -0,0 +1,6 @@
Rails.application.configure do
# Settings specified here will take precedence over those in config/application.rb.
# BAD: Disabling forgery protection may open the application to CSRF attacks
config.action_controller.allow_forgery_protection = false
end

11
ruby/ql/test/query-tests/security/cwe-352/railsapp/config/environments/test.rb Normal file
View File

@@ -0,0 +1,11 @@
# The test environment is used exclusively to run your application's
# test suite. You never need to work with it otherwise. Remember that
# your test database is "scratch space" for the test suite and is wiped
# and recreated between test runs. Don't rely on the data there!
Rails.application.configure do
# Settings specified here will take precedence over those in config/application.rb.
# GOOD: disabling CSRF protection in the test environment should not be flagged
config.action_controller.allow_forgery_protection = false
end

8
ruby/ql/test/query-tests/security/cwe-352/railsapp/test/controllers/users_controller_test.rb Normal file
View File

@@ -0,0 +1,8 @@
require "test_helper"
class UsersControllerTest < ActiveSupport::TestCase
setup do
# GOOD: disabling CSRF protection in tests should not be flagged
config.action_controller.allow_forgery_protection = false
end
end

8
ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.expected Normal file
View File

@@ -0,0 +1,8 @@
edges
| ServerSideRequestForgery.rb:9:32:9:37 | call to params : | ServerSideRequestForgery.rb:10:31:10:62 | "#{...}/logins" |
nodes
| ServerSideRequestForgery.rb:9:32:9:37 | call to params : | semmle.label | call to params : |
| ServerSideRequestForgery.rb:10:31:10:62 | "#{...}/logins" | semmle.label | "#{...}/logins" |
subpaths
#select
| ServerSideRequestForgery.rb:10:31:10:62 | "#{...}/logins" | ServerSideRequestForgery.rb:9:32:9:37 | call to params : | ServerSideRequestForgery.rb:10:31:10:62 | "#{...}/logins" | The URL of this request depends on $@. | ServerSideRequestForgery.rb:9:32:9:37 | call to params | a user-provided value |

1
ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.qlref Normal file
View File

@@ -0,0 +1 @@
queries/security/cwe-918/ServerSideRequestForgery.ql

21
ruby/ql/test/query-tests/security/cwe-918/ServerSideRequestForgery.rb Normal file
View File

@@ -0,0 +1,21 @@
require "excon"
require "json"
class PostsController < ActionController::Base
def create
user = params[:user_id]
# BAD - user can control the entire URL of the request
users_service_domain = params[:users_service_domain]
response = Excon.post("#{users_service_domain}/logins", body: {user_id: user}).body
token = JSON.parse(response)["token"]
# GOOD - user can only control the suffix of the URL
users_service_path = params[:users_service_path]
response = Excon.post("users-service/#{users_service_path}", body: {user_id: user}).body
token = JSON.parse(response)["token"]
@post = Post.create(params[:post].merge(user_token: token))
render @post
end
end