hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Model to_json ActiveSupport extension

Browse Source
This commit is contained in:
Harry Maclean
2022-11-07 12:52:20 +13:00
parent 5259d4af63
commit eff763d127
3 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
ruby/ql/lib/codeql/ruby/frameworks/ActiveSupport.qll
View File

@@ -104,6 +104,17 @@ module ActiveSupport {
override predicate runsArbitraryCode() { none() }
}
/** Flow summary for `Object#to_json`, which serializes the receiver as a JSON string. */
private class ToJsonSummary extends SimpleSummarizedCallable {
ToJsonSummary() { this = "to_json" }
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
input = ["Argument[self]", "Argument[self].Element[any]"] and
output = "ReturnValue" and
preservesValue = false
}
}
}
/**

11
ruby/ql/test/library-tests/frameworks/active_support/ActiveSupportDataFlow.expected
View File

@@ -197,6 +197,11 @@ edges
| active_support.rb:320:35:320:35 | x : | active_support.rb:320:10:320:36 | call to dump |
| active_support.rb:324:9:324:18 | call to source : | active_support.rb:325:35:325:35 | x : |
| active_support.rb:325:35:325:35 | x : | active_support.rb:325:10:325:36 | call to load |
| active_support.rb:329:9:329:18 | call to source : | active_support.rb:330:10:330:10 | x : |
| active_support.rb:329:9:329:18 | call to source : | active_support.rb:331:10:331:10 | x : |
| active_support.rb:330:10:330:10 | x : | active_support.rb:332:10:332:10 | y [element 0] : |
| active_support.rb:331:10:331:10 | x : | active_support.rb:331:10:331:18 | call to to_json |
| active_support.rb:332:10:332:10 | y [element 0] : | active_support.rb:332:10:332:18 | call to to_json |
| hash_extensions.rb:2:14:2:24 | call to source : | hash_extensions.rb:3:9:3:9 | h [element :a] : |
| hash_extensions.rb:2:14:2:24 | call to source : | hash_extensions.rb:3:9:3:9 | h [element :a] : |
| hash_extensions.rb:3:9:3:9 | h [element :a] : | hash_extensions.rb:3:9:3:24 | call to stringify_keys [element] : |
@@ -559,6 +564,12 @@ nodes
| active_support.rb:324:9:324:18 | call to source : | semmle.label | call to source : |
| active_support.rb:325:10:325:36 | call to load | semmle.label | call to load |
| active_support.rb:325:35:325:35 | x : | semmle.label | x : |
| active_support.rb:329:9:329:18 | call to source : | semmle.label | call to source : |
| active_support.rb:330:10:330:10 | x : | semmle.label | x : |
| active_support.rb:331:10:331:10 | x : | semmle.label | x : |
| active_support.rb:331:10:331:18 | call to to_json | semmle.label | call to to_json |
| active_support.rb:332:10:332:10 | y [element 0] : | semmle.label | y [element 0] : |
| active_support.rb:332:10:332:18 | call to to_json | semmle.label | call to to_json |
| hash_extensions.rb:2:14:2:24 | call to source : | semmle.label | call to source : |
| hash_extensions.rb:2:14:2:24 | call to source : | semmle.label | call to source : |
| hash_extensions.rb:3:9:3:9 | h [element :a] : | semmle.label | h [element :a] : |

7
ruby/ql/test/library-tests/frameworks/active_support/active_support.rb
View File

@@ -324,3 +324,10 @@ def m_json_load
x = source "a"
sink ActiveSupport::JSON.load(x) # $hasTaintFlow=a
end
def m_to_json
x = source "a"
y = [x]
sink x.to_json # $hasTaintFlow=a
sink y.to_json # $hasTaintFlow=a
end