hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 20:58:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

improve XSS::Shared::isFlowFromHelperMethod performance

Browse Source
This commit is contained in:
Alex Ford
2021-10-12 20:13:32 +01:00
parent 9afc1f9275
commit 9083cda8df
1 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
ql/lib/codeql/ruby/security/XSS.qll
View File

@@ -184,20 +184,25 @@ private module Shared {
)
}
pragma[noinline]
predicate isHelperMethodNameMatch(ActionControllerHelperMethod helperMethod, MethodCall call) {
helperMethod.getName() = call.getMethodName()
}
predicate isFlowFromHelperMethod(DataFlow::Node node1, DataFlow::Node node2) {
// flow out of controller helper method into template
exists(
ErbFile template, ActionControllerHelperMethod helperMethod,
CfgNodes::ExprNodes::MethodCallCfgNode helperMethodCall
|
template = node2.getLocation().getFile() and
// TODO: this is slow, x-product of helper method names and method calls
helperMethod.getName() = helperMethodCall.getExpr().getMethodName() and
helperMethod.getControllerClass() = getAssociatedControllerClass(template) and
// `node1` is an expr node that may be returned by the helper method
exprNodeReturnedFrom(node1, helperMethod) and
// `node2` is a call to the helper method
node2.asExpr() = helperMethodCall
exists(ErbFile template |
template = node2.getLocation().getFile() |
exists(ActionControllerHelperMethod helperMethod |
helperMethod.getControllerClass() = getAssociatedControllerClass(template) and
// `node1` is an expr node that may be returned by the helper method
exprNodeReturnedFrom(node1, helperMethod) |
exists(CfgNodes::ExprNodes::MethodCallCfgNode helperMethodCall |
// `node2` is a call to the helper method
node2.asExpr() = helperMethodCall and
isHelperMethodNameMatch(helperMethod, helperMethodCall.getExpr())
)
)
)
}