Ruby: do not generate API graph edges from Attribute contents

asgerf · asgerf · commit 125761755a14 · 2022-10-11T09:03:52.000+02:00
Models should use Method[x] edges, not attribute edges
diff --git a/ruby/ql/lib/codeql/ruby/ApiGraphs.qll b/ruby/ql/lib/codeql/ruby/ApiGraphs.qll
@@ -522,7 +522,8 @@ module API {
       or
       exists(TypeTrackerSpecific::TypeTrackerContent c |
         TypeTrackerSpecific::basicLoadStep(node, ref, c) and
-        lbl = Label::content(c.getAStoreContent())
+        lbl = Label::content(c.getAStoreContent()) and
+        not c.isSingleton(any(DataFlow::Content::AttributeNameContent k))
       )
       // note: method calls are not handled here as there is no DataFlow::Node for the intermediate MkMethodAccessNode API node
     }

Original file line number	Diff line number	Diff line change
`@@ -522,7 +522,8 @@ module API {`
`522`	`522`	`or`
`523`	`523`	`exists(TypeTrackerSpecific::TypeTrackerContent c \|`
`524`	`524`	`TypeTrackerSpecific::basicLoadStep(node, ref, c) and`
`525`		`- lbl = Label::content(c.getAStoreContent())`
	`525`	`+ lbl = Label::content(c.getAStoreContent()) and`
	`526`	`+ not c.isSingleton(any(DataFlow::Content::AttributeNameContent k))`
`526`	`527`	`)`
`527`	`528`	`// note: method calls are not handled here as there is no DataFlow::Node for the intermediate MkMethodAccessNode API node`
`528`	`529`	`}`