Ruby: add ActionMailer#params as a RemoteFlowSource

Author: nickrolfe

ruby/ql/lib/codeql/ruby/Frameworks.qll

@@ -5,6 +5,7 @@
 private import codeql.ruby.frameworks.Core
 private import codeql.ruby.frameworks.ActionCable
 private import codeql.ruby.frameworks.ActionController
+private import codeql.ruby.frameworks.ActionMailer
 private import codeql.ruby.frameworks.ActiveRecord
 private import codeql.ruby.frameworks.ActiveResource
 private import codeql.ruby.frameworks.ActiveStorage

ruby/ql/lib/codeql/ruby/frameworks/ActionMailer.qll

@@ -0,0 +1,48 @@
+/**
+ * Provides modeling for the `ActionMailer` library.
+ */
+
+private import codeql.ruby.AST
+private import codeql.ruby.ApiGraphs
+private import codeql.ruby.frameworks.internal.Rails
+
+/**
+ * A `ClassDeclaration` for a class that extends `ActionMailer::Base`.
+ * For example,
+ *
+ * ```rb
+ * class FooMailer < ActionMailer::Base
+ *   ...
+ * end
+ * ```
+ */
+class ActionMailerMailerClass extends ClassDeclaration {
+  ActionMailerMailerClass() {
+    this.getSuperclassExpr() =
+      [
+        API::getTopLevelMember("ActionMailer").getMember("Base"),
+        // In Rails applications `ApplicationMailer` typically extends
+        // `ActionMailer::Base`, but we treat it separately in case the
+        // `ApplicationMailer` definition is not in the database.
+        API::getTopLevelMember("ApplicationMailer")
+      ].getASubclass().getAValueReachableFromSource().asExpr().getExpr()
+  }
+}
+
+/** A method call with a `self` receiver from within a mailer class */
+private class ActionMailerContextCall extends MethodCall {
+  private ActionMailerMailerClass mailerClass;
+
+  ActionMailerContextCall() {
+    this.getReceiver() instanceof SelfVariableAccess and
+    this.getEnclosingModule() = mailerClass
+  }
+
+  /** Gets the mailer class containing this method. */
+  ActionMailerMailerClass getMailerClass() { result = mailerClass }
+}
+
+/** A call to `params` from within a mailer. */
+class ActionMailerParamsCall extends ActionMailerContextCall, ParamsCallImpl {
+  ActionMailerParamsCall() { this.getMethodName() = "params" }
+}

ruby/ql/test/library-tests/frameworks/ActionController.expected

@@ -115,6 +115,7 @@ paramsCalls
 | action_controller/params_flow.rb:144:10:144:15 | call to params |
 | action_controller/params_flow.rb:145:32:145:37 | call to params |
 | action_controller/params_flow.rb:148:22:148:27 | call to params |
+| action_mailer/mailer.rb:3:10:3:15 | call to params |
 | active_record/ActiveRecord.rb:28:30:28:35 | call to params |
 | active_record/ActiveRecord.rb:29:29:29:34 | call to params |
 | active_record/ActiveRecord.rb:30:31:30:36 | call to params |
@@ -189,6 +190,7 @@ paramsSources
 | action_controller/params_flow.rb:144:10:144:15 | call to params |
 | action_controller/params_flow.rb:145:32:145:37 | call to params |
 | action_controller/params_flow.rb:148:22:148:27 | call to params |
+| action_mailer/mailer.rb:3:10:3:15 | call to params |
 | active_record/ActiveRecord.rb:28:30:28:35 | call to params |
 | active_record/ActiveRecord.rb:29:29:29:34 | call to params |
 | active_record/ActiveRecord.rb:30:31:30:36 | call to params |

ruby/ql/test/library-tests/frameworks/action_mailer/mailer.rb

@@ -0,0 +1,5 @@
+class MyMailer < ActionMailer::Base
+  def foo
+    sink params[:foo] # $hasTaintFlow
+  end
+end

ruby/ql/test/library-tests/frameworks/action_mailer/params-flow.expected

@@ -0,0 +1,9 @@
+failures
+edges
+| mailer.rb:3:10:3:15 | call to params :  | mailer.rb:3:10:3:21 | ...[...] |
+nodes
+| mailer.rb:3:10:3:15 | call to params :  | semmle.label | call to params :  |
+| mailer.rb:3:10:3:21 | ...[...] | semmle.label | ...[...] |
+subpaths
+#select
+| mailer.rb:3:10:3:21 | ...[...] | mailer.rb:3:10:3:15 | call to params :  | mailer.rb:3:10:3:21 | ...[...] | $@ | mailer.rb:3:10:3:15 | call to params :  | call to params :  |

ruby/ql/test/library-tests/frameworks/action_mailer/params-flow.ql

@@ -0,0 +1,18 @@
+/**
+ * @kind path-problem
+ */
+
+import ruby
+import TestUtilities.InlineFlowTest
+import PathGraph
+import codeql.ruby.frameworks.Rails
+
+class ParamsTaintFlowConf extends DefaultTaintFlowConf {
+  override predicate isSource(DataFlow::Node n) {
+    n.asExpr().getExpr() instanceof Rails::ParamsCall
+  }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, ParamsTaintFlowConf conf
+where conf.hasFlowPath(source, sink)
+select sink, source, sink, "$@", source, source.toString()