codeql/ruby/ql/test/library-tests/dataflow/global/instance_variables.rb

def taint x
    x
end

def sink x
    puts "SINK: #{x}"
end

class Foo
    def set_field x
        @field = x
    end
    def get_field
        return @field
    end
    def inc_field
        @field += 1
    end
    @foo = taint("7")
    sink(@foo) # $ hasValueFlow=7

    def initialize(field = nil)
        @field = field
        taint(31)
    end

    def call_initialize(field)
        initialize(field)
    end

    def self.bar x
        new(taint(36))
        new(x)
    end

    sink(new(taint(34)).get_field) # $ hasValueFlow=34
end

sink(Foo.bar(taint(35)).get_field) # $ hasValueFlow=35

class Bar < Foo
    def self.new arg
        taint(32)
    end
end

class Baz < Foo
    def initialize x
        sink x # $ hasValueFlow=36
    end
end

foo = Foo.new
foo.set_field(taint(42))
sink(foo.get_field) # $ hasValueFlow=42

bar = Foo.new
bar.set_field(taint(5))
sink(bar.inc_field) # $ hasTaintFlow=5

foo1 = Foo.new
foo1.field = taint(20)
sink(foo1.field) # $ hasValueFlow=20

foo2 = Foo.new
foo2.field = taint(21)
sink(foo2.get_field) # $ hasValueFlow=21

foo3 = Foo.new
foo3.set_field(taint(22))
sink(foo3.field) # $ hasValueFlow=22

foo4 = 4
foo4.other = taint(23)
sink(foo4.other) # no field flow for constants

foo5 = Foo.new
(foo5).set_field(taint(24))
sink(foo5.get_field) # $ hasValueFlow=24

foo6 = Foo.new
(foo3; (foo5; foo6)).set_field(taint(25))
sink(foo3.get_field) # $ hasValueFlow=22
sink(foo5.get_field) # $ hasValueFlow=24
sink(foo6.get_field) # $ hasValueFlow=25

foo7 = Foo.new
foo8 = Foo.new
(if foo7 then foo7 else foo8 end).set_field(taint(26))
sink(foo7.get_field) # $ hasValueFlow=26
sink(foo8.get_field) # $ hasValueFlow=26

foo9 = Foo.new
foo10 = Foo.new
(case when foo9 then foo9 else foo10 end).set_field(taint(27))
sink(foo9.get_field) # $ hasValueFlow=27
sink(foo10.get_field) # $ hasValueFlow=27

def set_field_on x
    x.set_field(taint(28))
end

foo11 = Foo.new
set_field_on(foo11)
sink(foo11.get_field) # $ hasValueFlow=28

foo12 = Foo.new
set_field_on (foo12) # space after `set_field_on` is important for this test
sink(foo12.get_field) # $ hasValueFlow=28

foo13 = Foo.new
foo14 = Foo.new
set_field_on(foo14 = foo13)
sink(foo13.get_field) # $ hasValueFlow=28

foo15 = Foo.new(taint(29))
sink(foo15.get_field) # $ hasValueFlow=29
foo16 = Foo.new
sink(foo16.call_initialize(taint(30))) # $ hasValueFlow=31
sink(foo16.get_field) # $ hasValueFlow=30
bar = Bar.new(taint(33))
sink(bar) # $ hasValueFlow=32
sink(bar.get_field)