Files
codeql/ruby/ql/lib
Harry Maclean 72356d1515 Ruby: track flow from *args to positional params
This models flow in the following case:

    def foo(x, y)
      sink x # 1
      sink y # 2
    end

    args = [source 1, source 2]
    foo(*args)

We do this by introducing a SynthSplatParameterNode which accepts
content from the splat argument, if one is given at the callsite.
From this node we add read steps to each positional parameter.
2023-08-09 15:01:40 +01:00
..
2021-10-15 11:47:28 +02:00
2022-09-14 15:30:51 +02:00