hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: more accurate modeling of which ActionCable channel methods become endpoints

Browse Source
This commit is contained in:
Nick Rolfe
2022-11-09 16:14:11 +00:00
parent 611ed93e39
commit cfde7e9edc
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
ruby/ql/lib/codeql/ruby/frameworks/ActionCable.qll
View File

@@ -43,8 +43,17 @@ module ActionCable {
.getConstant("Channel")
.getConstant("Base")
.getADescendentModule()
.getAnOwnInstanceMethod() and
// as long as it's public
.getAnInstanceMethod() and
// as long as it's not an instance method of
// `ActionCable::Channel::Base` itself, which might exist in the
// database
not m =
DataFlow::getConstant("ActionCable")
.getConstant("Channel")
.getConstant("Base")
.asModule()
.getAnInstanceMethod() and
// and as long as it's public
m.asCallableAstNode().isPublic() and
// and is not called `subscribed` or `unsubscribed`.
not m.getMethodName() = ["subscribed", "unsubscribed"]