hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Fix some Ql4Ql violations.

Browse Source
This commit is contained in:
Michael Nebel
2025-09-01 15:19:25 +02:00
parent b4d6cb6e5f
commit c5cf46bc2c
6 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ruby/ql/lib/codeql/ruby/ApiGraphs.qll
View File

@@ -1,5 +1,5 @@
/**
* Provides an implementation of _API graphs_, which allow efficient modelling of how a given
* Provides an implementation of _API graphs_, which allow efficient modeling of how a given
* value is used by the code base or how values produced by the code base are consumed by a library.
*
* See `API::Node` for more details.

2
ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
View File

@@ -50,7 +50,7 @@ module Kernel {
}
/**
* Private methods in the `Kernel` module.
* Holds if `method` is a name of a private method in the `Kernel` module.
* These can be be invoked on `self`, on `Kernel`, or using a low-level primitive like `send` or `instance_eval`.
* ```ruby
* puts "hello world"

35
ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll
View File

@@ -25,27 +25,28 @@ private import codeql.ruby.DataFlow
*/
class ExconHttpRequest extends Http::Client::Request::Range instanceof DataFlow::CallNode {
API::Node requestNode;
API::Node connectionNode;
DataFlow::Node connectionUse;
ExconHttpRequest() {
this = requestNode.asSource() and
connectionUse = connectionNode.asSource() and
connectionNode =
[
// one-off requests
API::getTopLevelMember("Excon"),
// connection re-use
API::getTopLevelMember("Excon").getInstance(),
API::getTopLevelMember("Excon").getMember("Connection").getInstance()
] and
requestNode =
connectionNode
.getReturn([
// Excon#request exists but Excon.request doesn't.
// This shouldn't be a problem - in real code the latter would raise NoMethodError anyway.
"get", "head", "delete", "options", "post", "put", "patch", "trace", "request"
])
exists(API::Node connectionNode |
connectionUse = connectionNode.asSource() and
connectionNode =
[
// one-off requests
API::getTopLevelMember("Excon"),
// connection re-use
API::getTopLevelMember("Excon").getInstance(),
API::getTopLevelMember("Excon").getMember("Connection").getInstance()
] and
requestNode =
connectionNode
.getReturn([
// Excon#request exists but Excon.request doesn't.
// This shouldn't be a problem - in real code the latter would raise NoMethodError anyway.
"get", "head", "delete", "options", "post", "put", "patch", "trace", "request"
])
)
}
override DataFlow::Node getResponseBody() { result = requestNode.getAMethodCall("body") }

3
ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll
View File

@@ -27,11 +27,10 @@ private import codeql.ruby.DataFlow
class NetHttpRequest extends Http::Client::Request::Range instanceof DataFlow::CallNode {
private DataFlow::CallNode request;
API::Node requestNode;
API::Node connectionNode;
private boolean returnsResponseBody;
NetHttpRequest() {
exists(string method |
exists(string method, API::Node connectionNode |
request = requestNode.asSource() and
this = request and
requestNode = connectionNode.getReturn(method)

2
ruby/ql/lib/codeql/ruby/regexp/internal/ParseRegExp.qll
View File

@@ -194,7 +194,7 @@ abstract class RegExp extends Ast::StringlikeLiteral {
}
/**
* Holds if the character set starting at `charset_start` contains a character range
* Holds if the character set starting at `charsetStart` contains a character range
* with lower bound found between `start` and `lowerEnd`
* and upper bound found between `upperStart` and `end`.
*/

4
ruby/ql/lib/codeql/ruby/security/ImproperMemoizationQuery.qll
View File

@@ -45,7 +45,7 @@ private class MemoCandidate extends Method {
}
/**
* Holds if parameter `p` of `m` is read in the right hand side of `assign`.
* Holds if parameter `p` of `m` is read in the right hand side of `a`.
*/
private predicate parameterUsedInMemoValue(Method m, Parameter p, MemoStmt a) {
p = m.getAParameter() and
@@ -54,7 +54,7 @@ private predicate parameterUsedInMemoValue(Method m, Parameter p, MemoStmt a) {
}
/**
* Holds if parameter `p` of `m` is read in the left hand side of `assign`.
* Holds if parameter `p` of `m` is read in the left hand side of `a`.
*/
private predicate parameterUsedInMemoKey(Method m, Parameter p, HashMemoStmt a) {
p = m.getAParameter() and