Skip to content

Commit a38e59a

Browse files
hmachmac
authored
Merge pull request github#9030 from hmac/hmac/activesupport
Ruby: Model various bits of ActiveSupport
2 parents b16124d + 28c0906 commit a38e59a

File tree

11 files changed

+540
-5
lines changed

11 files changed

+540
-5
lines changed

‎ruby/ql/lib/codeql/ruby/frameworks/ActiveSupport.qll

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@
66
private import ruby
77
private import codeql.ruby.Concepts
88
private import codeql.ruby.DataFlow
9+
private import codeql.ruby.dataflow.FlowSummary
10+
private import codeql.ruby.Concepts
11+
private import codeql.ruby.ApiGraphs
12+
private import codeql.ruby.frameworks.stdlib.Logger::Logger as StdlibLogger
913

1014
/**
1115
* Modeling for `ActiveSupport`.
@@ -32,6 +36,107 @@ module ActiveSupport {
3236

3337
override DataFlow::Node getCode() { result = this.getReceiver() }
3438
}
39+
40+
/**
41+
* Flow summary for methods which transform the receiver in some way, possibly preserving taint.
42+
*/
43+
private class StringTransformSummary extends SummarizedCallable {
44+
// We're modelling a lot of different methods, so we make up a name for this summary.
45+
StringTransformSummary() { this = "ActiveSupportStringTransform" }
46+
47+
override MethodCall getACall() {
48+
result.getMethodName() =
49+
[
50+
"camelize", "camelcase", "classify", "dasherize", "deconstantize", "demodulize",
51+
"foreign_key", "humanize", "indent", "parameterize", "pluralize", "singularize",
52+
"squish", "strip_heredoc", "tableize", "titlecase", "titleize", "underscore",
53+
"upcase_first"
54+
]
55+
}
56+
57+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
58+
input = "Argument[self]" and output = "ReturnValue" and preservesValue = false
59+
}
60+
}
61+
}
62+
63+
/**
64+
* Extensions to the `Enumerable` module.
65+
*/
66+
module Enumerable {
67+
private class ArrayIndex extends int {
68+
ArrayIndex() { this = any(DataFlow::Content::KnownElementContent c).getIndex().getInt() }
69+
}
70+
71+
private class CompactBlankSummary extends SimpleSummarizedCallable {
72+
CompactBlankSummary() { this = "compact_blank" }
73+
74+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
75+
input = "Argument[self].Element[any]" and
76+
output = "ReturnValue.Element[?]" and
77+
preservesValue = true
78+
}
79+
}
80+
81+
private class ExcludingSummary extends SimpleSummarizedCallable {
82+
ExcludingSummary() { this = ["excluding", "without"] }
83+
84+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
85+
input = "Argument[self].Element[any]" and
86+
output = "ReturnValue.Element[?]" and
87+
preservesValue = true
88+
}
89+
}
90+
91+
private class InOrderOfSummary extends SimpleSummarizedCallable {
92+
InOrderOfSummary() { this = "in_order_of" }
93+
94+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
95+
input = "Argument[self].Element[any]" and
96+
output = "ReturnValue.Element[?]" and
97+
preservesValue = true
98+
}
99+
}
100+
101+
/**
102+
* Like `Array#push` but doesn't update the receiver.
103+
*/
104+
private class IncludingSummary extends SimpleSummarizedCallable {
105+
IncludingSummary() { this = "including" }
106+
107+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
108+
(
109+
exists(ArrayIndex i |
110+
input = "Argument[self].Element[" + i + "]" and
111+
output = "ReturnValue.Element[" + i + "]"
112+
)
113+
or
114+
input = "Argument[self].Element[?]" and
115+
output = "ReturnValue.Element[?]"
116+
or
117+
exists(int i | i in [0 .. (mc.getNumberOfArguments() - 1)] |
118+
input = "Argument[" + i + "]" and
119+
output = "ReturnValue.Element[?]"
120+
)
121+
) and
122+
preservesValue = true
123+
}
124+
}
125+
// TODO: index_by, index_with, pick, pluck (they require Hash dataflow)
126+
}
127+
}
128+
129+
/**
130+
* `ActiveSupport::Logger`
131+
*/
132+
module Logger {
133+
private class ActiveSupportLoggerInstantiation extends StdlibLogger::LoggerInstantiation {
134+
ActiveSupportLoggerInstantiation() {
135+
this =
136+
API::getTopLevelMember("ActiveSupport")
137+
.getMember(["Logger", "TaggedLogging"])
138+
.getAnInstantiation()
139+
}
35140
}
36141
}
37142
}

‎ruby/ql/lib/codeql/ruby/frameworks/stdlib/Logger.qll

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ private import codeql.ruby.dataflow.internal.DataFlowDispatch
1616
module Logger {
1717
/** A reference to a `Logger` instance */
1818
private DataFlow::Node loggerInstance() {
19-
result = API::getTopLevelMember("Logger").getAnInstantiation()
19+
result instanceof LoggerInstantiation
2020
or
2121
exists(DataFlow::Node inst |
2222
inst = loggerInstance() and
@@ -33,11 +33,29 @@ module Logger {
3333
)
3434
}
3535

36+
/**
37+
* An instantiation of a logger that responds to the std lib logging methods.
38+
* This can be extended to recognize additional instances that conform to the
39+
* same interface.
40+
*/
41+
abstract class LoggerInstantiation extends DataFlow::Node { }
42+
43+
/**
44+
* An instantiation of the std lib `Logger` class.
45+
*/
46+
private class StdlibLoggerInstantiation extends LoggerInstantiation {
47+
StdlibLoggerInstantiation() { this = API::getTopLevelMember("Logger").getAnInstantiation() }
48+
}
49+
50+
private class LoggerInstance extends DataFlow::Node {
51+
LoggerInstance() { this = loggerInstance() }
52+
}
53+
3654
/**
3755
* A call to a `Logger` instance method that causes a message to be logged.
3856
*/
3957
abstract class LoggerLoggingCall extends Logging::Range, DataFlow::CallNode {
40-
LoggerLoggingCall() { this.getReceiver() = loggerInstance() }
58+
LoggerLoggingCall() { this.getReceiver() instanceof LoggerInstance }
4159
}
4260

4361
/**

‎ruby/ql/test/library-tests/frameworks/active_support.rb

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎ruby/ql/test/library-tests/frameworks/ActiveSupport.expected renamed to ‎ruby/ql/test/library-tests/frameworks/active_support/ActiveSupport.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
1+
constantizeCalls
12
| active_support.rb:1:1:1:22 | call to constantize | active_support.rb:1:1:1:10 | "Foo::Bar" |
23
| active_support.rb:3:1:3:13 | call to constantize | active_support.rb:3:1:3:1 | call to a |
4+
loggerInstantiations
5+
| active_support.rb:5:1:5:33 | call to new |
6+
| active_support.rb:6:1:6:40 | call to new |

‎ruby/ql/test/library-tests/frameworks/ActiveSupport.ql renamed to ‎ruby/ql/test/library-tests/frameworks/active_support/ActiveSupport.ql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
import codeql.ruby.frameworks.ActiveSupport
22
import codeql.ruby.DataFlow
3+
import codeql.ruby.frameworks.stdlib.Logger
34

45
query DataFlow::Node constantizeCalls(ActiveSupport::CoreExtensions::String::Constantize c) {
56
result = c.getCode()
67
}
8+
9+
query predicate loggerInstantiations(Logger::LoggerInstantiation l) { any() }

0 commit comments

Comments
 (0)