diff --git a/ruby/ql/lib/change-notes/2022-10-13-faraday-run-request.md b/ruby/ql/lib/change-notes/2022-10-13-faraday-run-request.md new file mode 100644 index 00000000000..017b57884f5 --- /dev/null +++ b/ruby/ql/lib/change-notes/2022-10-13-faraday-run-request.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The response value returned by the `Faraday#run_request` method is now also considered a source of remote input. diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll index 139a484f87a..295299e5068 100644 --- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll +++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll @@ -37,7 +37,8 @@ class FaradayHttpRequest extends Http::Client::Request::Range, DataFlow::CallNod API::getTopLevelMember("Faraday").getInstance() ] and requestNode = - connectionNode.getReturn(["get", "head", "delete", "post", "put", "patch", "trace"]) and + connectionNode + .getReturn(["get", "head", "delete", "post", "put", "patch", "trace", "run_request"]) and this = requestNode.asSource() and connectionUse = connectionNode.asSource() }