Skip to content

Commit 32b80f8

Browse files
hmachmac
committed
Ruby: Add tests for hash flow
1 parent 187a68b commit 32b80f8

File tree

4 files changed

+51
-0
lines changed

4 files changed

+51
-0
lines changed

‎ruby/ql/lib/codeql/ruby/frameworks/core/Array.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1855,6 +1855,7 @@ module Enumerable {
18551855

18561856
override predicate propagatesFlow(string input, string output, boolean preservesValue) {
18571857
input = "Argument[self].Element[any]" and
1858+
// For `Hash#map`, the value flows to parameter 1
18581859
output = "Argument[block].Parameter[0, 1]" and
18591860
preservesValue = true
18601861
or

‎ruby/ql/lib/codeql/ruby/frameworks/core/Hash.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -524,6 +524,8 @@ private class ValuesSummary extends SimpleSummarizedCallable {
524524
}
525525
}
526526

527+
// We don't (yet) track data flow through hash keys, but this is still useful in cases where a
528+
// whole hash(like) object is tainted, such as `ActionController#params`.
527529
private class KeysSummary extends SimpleSummarizedCallable {
528530
KeysSummary() { this = "keys" }
529531

‎ruby/ql/test/library-tests/dataflow/hash-flow/hash-flow.expected

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1089,6 +1089,19 @@ edges
10891089
| hash_flow.rb:994:30:994:40 | call to taint | hash_flow.rb:994:14:994:47 | ...[...] [element :b] | provenance | |
10901090
| hash_flow.rb:996:14:996:15 | h2 [element :b] | hash_flow.rb:996:14:996:19 | ...[...] | provenance | |
10911091
| hash_flow.rb:998:14:998:15 | h2 [element :b] | hash_flow.rb:998:14:998:18 | ...[...] | provenance | |
1092+
| hash_flow.rb:1006:5:1006:5 | [post] h [element] | hash_flow.rb:1007:12:1007:12 | h [element] | provenance | |
1093+
| hash_flow.rb:1006:14:1006:24 | call to taint | hash_flow.rb:1006:5:1006:5 | [post] h [element] | provenance | |
1094+
| hash_flow.rb:1007:5:1007:8 | keys [element] | hash_flow.rb:1008:10:1008:13 | keys [element] | provenance | |
1095+
| hash_flow.rb:1007:12:1007:12 | h [element] | hash_flow.rb:1007:12:1007:17 | call to keys [element] | provenance | |
1096+
| hash_flow.rb:1007:12:1007:17 | call to keys [element] | hash_flow.rb:1007:5:1007:8 | keys [element] | provenance | |
1097+
| hash_flow.rb:1008:10:1008:13 | keys [element] | hash_flow.rb:1008:10:1008:17 | ...[...] | provenance | |
1098+
| hash_flow.rb:1012:5:1012:5 | h [element :a] | hash_flow.rb:1013:5:1013:5 | h [element :a] | provenance | |
1099+
| hash_flow.rb:1012:9:1012:45 | call to [] [element :a] | hash_flow.rb:1012:5:1012:5 | h [element :a] | provenance | |
1100+
| hash_flow.rb:1012:14:1012:24 | call to taint | hash_flow.rb:1012:9:1012:45 | call to [] [element :a] | provenance | |
1101+
| hash_flow.rb:1013:5:1013:5 | h [element :a] | hash_flow.rb:1013:15:1013:15 | k | provenance | |
1102+
| hash_flow.rb:1013:5:1013:5 | h [element :a] | hash_flow.rb:1013:18:1013:18 | v | provenance | |
1103+
| hash_flow.rb:1013:15:1013:15 | k | hash_flow.rb:1015:14:1015:14 | k | provenance | |
1104+
| hash_flow.rb:1013:18:1013:18 | v | hash_flow.rb:1014:14:1014:14 | v | provenance | |
10921105
nodes
10931106
| hash_flow.rb:10:5:10:8 | hash [element 0] | semmle.label | hash [element 0] |
10941107
| hash_flow.rb:10:5:10:8 | hash [element :a] | semmle.label | hash [element :a] |
@@ -2251,6 +2264,21 @@ nodes
22512264
| hash_flow.rb:996:14:996:19 | ...[...] | semmle.label | ...[...] |
22522265
| hash_flow.rb:998:14:998:15 | h2 [element :b] | semmle.label | h2 [element :b] |
22532266
| hash_flow.rb:998:14:998:18 | ...[...] | semmle.label | ...[...] |
2267+
| hash_flow.rb:1006:5:1006:5 | [post] h [element] | semmle.label | [post] h [element] |
2268+
| hash_flow.rb:1006:14:1006:24 | call to taint | semmle.label | call to taint |
2269+
| hash_flow.rb:1007:5:1007:8 | keys [element] | semmle.label | keys [element] |
2270+
| hash_flow.rb:1007:12:1007:12 | h [element] | semmle.label | h [element] |
2271+
| hash_flow.rb:1007:12:1007:17 | call to keys [element] | semmle.label | call to keys [element] |
2272+
| hash_flow.rb:1008:10:1008:13 | keys [element] | semmle.label | keys [element] |
2273+
| hash_flow.rb:1008:10:1008:17 | ...[...] | semmle.label | ...[...] |
2274+
| hash_flow.rb:1012:5:1012:5 | h [element :a] | semmle.label | h [element :a] |
2275+
| hash_flow.rb:1012:9:1012:45 | call to [] [element :a] | semmle.label | call to [] [element :a] |
2276+
| hash_flow.rb:1012:14:1012:24 | call to taint | semmle.label | call to taint |
2277+
| hash_flow.rb:1013:5:1013:5 | h [element :a] | semmle.label | h [element :a] |
2278+
| hash_flow.rb:1013:15:1013:15 | k | semmle.label | k |
2279+
| hash_flow.rb:1013:18:1013:18 | v | semmle.label | v |
2280+
| hash_flow.rb:1014:14:1014:14 | v | semmle.label | v |
2281+
| hash_flow.rb:1015:14:1015:14 | k | semmle.label | k |
22542282
subpaths
22552283
hashLiteral
22562284
| hash_flow.rb:10:12:21:5 | call to [] |
@@ -2324,6 +2352,8 @@ hashLiteral
23242352
| hash_flow.rb:946:13:950:5 | call to [] |
23252353
| hash_flow.rb:971:9:971:38 | ...[...] |
23262354
| hash_flow.rb:994:14:994:47 | ...[...] |
2355+
| hash_flow.rb:1005:9:1005:10 | call to [] |
2356+
| hash_flow.rb:1012:9:1012:45 | call to [] |
23272357
#select
23282358
| hash_flow.rb:22:10:22:17 | ...[...] | hash_flow.rb:11:15:11:24 | call to taint | hash_flow.rb:22:10:22:17 | ...[...] | $@ | hash_flow.rb:11:15:11:24 | call to taint | call to taint |
23292359
| hash_flow.rb:24:10:24:17 | ...[...] | hash_flow.rb:13:12:13:21 | call to taint | hash_flow.rb:24:10:24:17 | ...[...] | $@ | hash_flow.rb:13:12:13:21 | call to taint | call to taint |
@@ -2569,3 +2599,6 @@ hashLiteral
25692599
| hash_flow.rb:975:10:975:13 | ...[...] | hash_flow.rb:971:23:971:31 | call to taint | hash_flow.rb:975:10:975:13 | ...[...] | $@ | hash_flow.rb:971:23:971:31 | call to taint | call to taint |
25702600
| hash_flow.rb:996:14:996:19 | ...[...] | hash_flow.rb:994:30:994:40 | call to taint | hash_flow.rb:996:14:996:19 | ...[...] | $@ | hash_flow.rb:994:30:994:40 | call to taint | call to taint |
25712601
| hash_flow.rb:998:14:998:18 | ...[...] | hash_flow.rb:994:30:994:40 | call to taint | hash_flow.rb:998:14:998:18 | ...[...] | $@ | hash_flow.rb:994:30:994:40 | call to taint | call to taint |
2602+
| hash_flow.rb:1008:10:1008:17 | ...[...] | hash_flow.rb:1006:14:1006:24 | call to taint | hash_flow.rb:1008:10:1008:17 | ...[...] | $@ | hash_flow.rb:1006:14:1006:24 | call to taint | call to taint |
2603+
| hash_flow.rb:1014:14:1014:14 | v | hash_flow.rb:1012:14:1012:24 | call to taint | hash_flow.rb:1014:14:1014:14 | v | $@ | hash_flow.rb:1012:14:1012:24 | call to taint | call to taint |
2604+
| hash_flow.rb:1015:14:1015:14 | k | hash_flow.rb:1012:14:1012:24 | call to taint | hash_flow.rb:1015:14:1015:14 | k | $@ | hash_flow.rb:1012:14:1012:24 | call to taint | call to taint |

‎ruby/ql/test/library-tests/dataflow/hash-flow/hash_flow.rb

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1000,3 +1000,18 @@ def m54(i)
10001000
end
10011001

10021002
M54.new.m54(:b)
1003+
1004+
def m55
1005+
h = {}
1006+
h[f()] = taint(55.1)
1007+
keys = h.keys
1008+
sink(keys[:a]) # $ hasValueFlow=55.1
1009+
end
1010+
1011+
def m56
1012+
h = { a: taint(56.1), taint(56.2) => :b }
1013+
h.map do |k, v|
1014+
sink(v) # $ hasValueFlow=56.1
1015+
sink(k) # $ MISSING: hasValueFlow=56.2 SPURIOUS: hasValueFlow=56.1
1016+
end
1017+
end

0 commit comments

Comments
 (0)