Revert "Python: Use new dataflow API"

Python: Use new dataflow API

java/ql/test/library-tests/qlengine/selectAtType.expected

@@ -1 +0,0 @@
-ERROR: class or primitive expected in query (selectAtType.ql:5,8-15)

java/ql/test/library-tests/qlengine/selectAtType.ql

@@ -1,5 +0,0 @@
-import java
-
-@classorinterface clasz() { any() }
-
-select clasz()

ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll

@@ -558,9 +558,7 @@ import Cached
 
 /** Holds if `n` should be hidden from path explanations. */
 predicate nodeIsHidden(Node n) {
-  exists(SsaImpl::DefinitionExt def | def = n.(SsaDefinitionExtNode).getDefinitionExt() |
-    not def instanceof Ssa::WriteDefinition
-  )
+  n.(SsaDefinitionExtNode).isHidden()
   or
   n = LocalFlow::getParameterDefNode(_)
   or
@@ -593,6 +591,13 @@ class SsaDefinitionExtNode extends NodeImpl, TSsaDefinitionExtNode {
   /** Gets the underlying variable. */
   Variable getVariable() { result = def.getSourceVariable() }
 
+  /** Holds if this node should be hidden from path explanations. */
+  predicate isHidden() {
+    not def instanceof Ssa::WriteDefinition
+    or
+    isDesugarNode(def.(Ssa::WriteDefinition).getWriteAccess().getExpr())
+  }
+
   override CfgScope getCfgScope() { result = def.getBasicBlock().getScope() }
 
   override Location getLocationImpl() { result = def.getLocation() }
@@ -1593,7 +1598,11 @@ class CastNode extends Node {
  */
 predicate neverSkipInPathGraph(Node n) {
   // ensure that all variable assignments are included in the path graph
-  n.(SsaDefinitionExtNode).getDefinitionExt() instanceof Ssa::WriteDefinition
+  n =
+    any(SsaDefinitionExtNode def |
+      def.getDefinitionExt() instanceof Ssa::WriteDefinition and
+      not def.isHidden()
+    )
 }
 
 class DataFlowExpr = CfgNodes::ExprCfgNode;

ruby/ql/src/experimental/cwe-208/UnsafeHmacComparison.ql

@@ -0,0 +1,45 @@
+/**
+ * @name Unsafe HMAC Comparison
+ * @description An HMAC is being compared using the equality operator.  This may be vulnerable to a cryptographic timing attack
+ *              because the equality operation does not occur in constant time."
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 6.0
+ * @precision high
+ * @id rb/unsafe-hmac-comparison
+ * @tags security
+ *       external/cwe/cwe-208
+ */
+
+private import codeql.ruby.AST
+private import codeql.ruby.DataFlow
+private import codeql.ruby.ApiGraphs
+
+private class OpenSslHmacSource extends DataFlow::Node {
+  OpenSslHmacSource() {
+    exists(API::Node hmacNode | hmacNode = API::getTopLevelMember("OpenSSL").getMember("HMAC") |
+      this = hmacNode.getAMethodCall(["hexdigest", "to_s", "digest", "base64digest"])
+      or
+      this = hmacNode.getAnInstantiation()
+    )
+  }
+}
+
+private module UnsafeHmacComparison {
+  private module Config implements DataFlow::ConfigSig {
+    predicate isSource(DataFlow::Node source) { source instanceof OpenSslHmacSource }
+
+    // Holds if a given sink is an Equality Operation (== or !=)
+    predicate isSink(DataFlow::Node sink) {
+      any(EqualityOperation eqOp).getAnOperand() = sink.asExpr().getExpr()
+    }
+  }
+
+  import DataFlow::Global<Config>
+}
+
+private import UnsafeHmacComparison::PathGraph
+
+from UnsafeHmacComparison::PathNode source, UnsafeHmacComparison::PathNode sink
+where UnsafeHmacComparison::flowPath(source, sink)
+select sink.getNode(), source, sink, "This comparison is potentially vulnerable to a timing attack."

ruby/ql/src/experimental/cwe-208/UnsafeHmacComparison.qlhelp

@@ -0,0 +1,21 @@
+<!DOCTYPE qhelp PUBLIC
+"-//Semmle//qhelp//EN"
+"qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>
+      Using the `==` or `!=` operator to compare a known valid HMAC with a user-supplied HMAC digest could lead to a timing attack, as these operations do not occur in constant time.
+    </p>
+  </overview>
+  <recommendation>
+    <p>
+      Instead of using `==` or `!=` to compare a known valid HMAC with a user-supplied HMAC digest use Rack::Utils#secure_compare, ActiveSupport::SecurityUtils#secure_compare or OpenSSL.secure_compare
+    </p>
+  </recommendation>
+  <example>
+    <p>
+    In this example, the HMAC is validated using the `==` operation.
+    </p>
+    <sample src="./examples/unsafe_hmac_comparison.rb" />
+  </example>
+</qhelp>

ruby/ql/src/experimental/cwe-208/examples/unsafe_hmac_comparison.rb

@@ -0,0 +1,11 @@
+class UnsafeHmacComparison
+    def verify_hmac(host, hmac, salt)
+      sha1 = OpenSSL::Digest.new('sha1')
+      if OpenSSL::HMAC.digest(sha1, salt, host) == hmac
+        puts "HMAC verified"
+      else
+        puts "HMAC not verified"
+      end
+    end
+  end
+  

ruby/ql/test/library-tests/dataflow/array-flow/array-flow.expected

@@ -203,10 +203,8 @@ edges
 | array_flow.rb:80:13:80:21 | call to source | array_flow.rb:80:5:80:5 | a [element 1] |
 | array_flow.rb:81:8:81:8 | c | array_flow.rb:83:10:83:10 | c |
 | array_flow.rb:81:8:81:8 | c | array_flow.rb:83:10:83:10 | c |
-| array_flow.rb:81:15:81:15 | __synth__3 [element 1] | array_flow.rb:81:8:81:8 | c |
-| array_flow.rb:81:15:81:15 | __synth__3 [element 1] | array_flow.rb:81:8:81:8 | c |
-| array_flow.rb:81:15:81:15 | a [element 1] | array_flow.rb:81:15:81:15 | __synth__3 [element 1] |
-| array_flow.rb:81:15:81:15 | a [element 1] | array_flow.rb:81:15:81:15 | __synth__3 [element 1] |
+| array_flow.rb:81:15:81:15 | a [element 1] | array_flow.rb:81:8:81:8 | c |
+| array_flow.rb:81:15:81:15 | a [element 1] | array_flow.rb:81:8:81:8 | c |
 | array_flow.rb:88:5:88:5 | a [element 1] | array_flow.rb:89:9:89:9 | a [element 1] |
 | array_flow.rb:88:5:88:5 | a [element 1] | array_flow.rb:89:9:89:9 | a [element 1] |
 | array_flow.rb:88:13:88:22 | call to source | array_flow.rb:88:5:88:5 | a [element 1] |
@@ -4468,8 +4466,6 @@ nodes
 | array_flow.rb:80:13:80:21 | call to source | semmle.label | call to source |
 | array_flow.rb:81:8:81:8 | c | semmle.label | c |
 | array_flow.rb:81:8:81:8 | c | semmle.label | c |
-| array_flow.rb:81:15:81:15 | __synth__3 [element 1] | semmle.label | __synth__3 [element 1] |
-| array_flow.rb:81:15:81:15 | __synth__3 [element 1] | semmle.label | __synth__3 [element 1] |
 | array_flow.rb:81:15:81:15 | a [element 1] | semmle.label | a [element 1] |
 | array_flow.rb:81:15:81:15 | a [element 1] | semmle.label | a [element 1] |
 | array_flow.rb:83:10:83:10 | c | semmle.label | c |

ruby/ql/test/library-tests/dataflow/hash-flow/hash-flow.expected

@@ -81,8 +81,7 @@ edges
 | hash_flow.rb:96:30:96:33 | hash [element :a] | hash_flow.rb:96:13:96:34 | call to try_convert [element :a] |
 | hash_flow.rb:97:10:97:14 | hash2 [element :a] | hash_flow.rb:97:10:97:18 | ...[...] |
 | hash_flow.rb:105:5:105:5 | b | hash_flow.rb:106:10:106:10 | b |
-| hash_flow.rb:105:21:105:30 | __synth__0 | hash_flow.rb:105:5:105:5 | b |
-| hash_flow.rb:105:21:105:30 | call to taint | hash_flow.rb:105:21:105:30 | __synth__0 |
+| hash_flow.rb:105:21:105:30 | call to taint | hash_flow.rb:105:5:105:5 | b |
 | hash_flow.rb:113:5:113:5 | b | hash_flow.rb:115:10:115:10 | b |
 | hash_flow.rb:113:9:113:12 | [post] hash [element :a] | hash_flow.rb:114:10:114:13 | hash [element :a] |
 | hash_flow.rb:113:9:113:34 | call to store | hash_flow.rb:113:5:113:5 | b |
@@ -1063,7 +1062,6 @@ nodes
 | hash_flow.rb:97:10:97:14 | hash2 [element :a] | semmle.label | hash2 [element :a] |
 | hash_flow.rb:97:10:97:18 | ...[...] | semmle.label | ...[...] |
 | hash_flow.rb:105:5:105:5 | b | semmle.label | b |
-| hash_flow.rb:105:21:105:30 | __synth__0 | semmle.label | __synth__0 |
 | hash_flow.rb:105:21:105:30 | call to taint | semmle.label | call to taint |
 | hash_flow.rb:106:10:106:10 | b | semmle.label | b |
 | hash_flow.rb:113:5:113:5 | b | semmle.label | b |