Skip to content

Commit 7e479e3

Browse files
hmachmac
committed
Ruby: Fix Hash#keys flow summary
1 parent dde148e commit 7e479e3

File tree

4 files changed

+24
-40
lines changed

4 files changed

+24
-40
lines changed

‎ruby/ql/lib/codeql/ruby/frameworks/core/Hash.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -530,8 +530,8 @@ private class KeysSummary extends SimpleSummarizedCallable {
530530
KeysSummary() { this = "keys" }
531531

532532
override predicate propagatesFlow(string input, string output, boolean preservesValue) {
533-
input = "Argument[self].Element[any]" and
533+
input = "Argument[self]" and
534534
output = "ReturnValue.Element[?]" and
535-
preservesValue = true
535+
preservesValue = false
536536
}
537537
}

‎ruby/ql/test/library-tests/dataflow/hash-flow/hash-flow.expected

Lines changed: 17 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1089,19 +1089,13 @@ edges
10891089
| hash_flow.rb:994:30:994:40 | call to taint | hash_flow.rb:994:14:994:47 | ...[...] [element :b] | provenance | |
10901090
| hash_flow.rb:996:14:996:15 | h2 [element :b] | hash_flow.rb:996:14:996:19 | ...[...] | provenance | |
10911091
| hash_flow.rb:998:14:998:15 | h2 [element :b] | hash_flow.rb:998:14:998:18 | ...[...] | provenance | |
1092-
| hash_flow.rb:1006:5:1006:5 | [post] h [element] | hash_flow.rb:1007:12:1007:12 | h [element] | provenance | |
1093-
| hash_flow.rb:1006:14:1006:24 | call to taint | hash_flow.rb:1006:5:1006:5 | [post] h [element] | provenance | |
1094-
| hash_flow.rb:1007:5:1007:8 | keys [element] | hash_flow.rb:1008:10:1008:13 | keys [element] | provenance | |
1095-
| hash_flow.rb:1007:12:1007:12 | h [element] | hash_flow.rb:1007:12:1007:17 | call to keys [element] | provenance | |
1096-
| hash_flow.rb:1007:12:1007:17 | call to keys [element] | hash_flow.rb:1007:5:1007:8 | keys [element] | provenance | |
1097-
| hash_flow.rb:1008:10:1008:13 | keys [element] | hash_flow.rb:1008:10:1008:17 | ...[...] | provenance | |
1098-
| hash_flow.rb:1012:5:1012:5 | h [element :a] | hash_flow.rb:1013:5:1013:5 | h [element :a] | provenance | |
1099-
| hash_flow.rb:1012:9:1012:45 | call to [] [element :a] | hash_flow.rb:1012:5:1012:5 | h [element :a] | provenance | |
1100-
| hash_flow.rb:1012:14:1012:24 | call to taint | hash_flow.rb:1012:9:1012:45 | call to [] [element :a] | provenance | |
1101-
| hash_flow.rb:1013:5:1013:5 | h [element :a] | hash_flow.rb:1013:15:1013:15 | k | provenance | |
1102-
| hash_flow.rb:1013:5:1013:5 | h [element :a] | hash_flow.rb:1013:18:1013:18 | v | provenance | |
1103-
| hash_flow.rb:1013:15:1013:15 | k | hash_flow.rb:1015:14:1015:14 | k | provenance | |
1104-
| hash_flow.rb:1013:18:1013:18 | v | hash_flow.rb:1014:14:1014:14 | v | provenance | |
1092+
| hash_flow.rb:1011:5:1011:5 | h [element :a] | hash_flow.rb:1012:5:1012:5 | h [element :a] | provenance | |
1093+
| hash_flow.rb:1011:9:1011:45 | call to [] [element :a] | hash_flow.rb:1011:5:1011:5 | h [element :a] | provenance | |
1094+
| hash_flow.rb:1011:14:1011:24 | call to taint | hash_flow.rb:1011:9:1011:45 | call to [] [element :a] | provenance | |
1095+
| hash_flow.rb:1012:5:1012:5 | h [element :a] | hash_flow.rb:1012:15:1012:15 | k | provenance | |
1096+
| hash_flow.rb:1012:5:1012:5 | h [element :a] | hash_flow.rb:1012:18:1012:18 | v | provenance | |
1097+
| hash_flow.rb:1012:15:1012:15 | k | hash_flow.rb:1014:14:1014:14 | k | provenance | |
1098+
| hash_flow.rb:1012:18:1012:18 | v | hash_flow.rb:1013:14:1013:14 | v | provenance | |
11051099
nodes
11061100
| hash_flow.rb:10:5:10:8 | hash [element 0] | semmle.label | hash [element 0] |
11071101
| hash_flow.rb:10:5:10:8 | hash [element :a] | semmle.label | hash [element :a] |
@@ -2264,21 +2258,14 @@ nodes
22642258
| hash_flow.rb:996:14:996:19 | ...[...] | semmle.label | ...[...] |
22652259
| hash_flow.rb:998:14:998:15 | h2 [element :b] | semmle.label | h2 [element :b] |
22662260
| hash_flow.rb:998:14:998:18 | ...[...] | semmle.label | ...[...] |
2267-
| hash_flow.rb:1006:5:1006:5 | [post] h [element] | semmle.label | [post] h [element] |
2268-
| hash_flow.rb:1006:14:1006:24 | call to taint | semmle.label | call to taint |
2269-
| hash_flow.rb:1007:5:1007:8 | keys [element] | semmle.label | keys [element] |
2270-
| hash_flow.rb:1007:12:1007:12 | h [element] | semmle.label | h [element] |
2271-
| hash_flow.rb:1007:12:1007:17 | call to keys [element] | semmle.label | call to keys [element] |
2272-
| hash_flow.rb:1008:10:1008:13 | keys [element] | semmle.label | keys [element] |
2273-
| hash_flow.rb:1008:10:1008:17 | ...[...] | semmle.label | ...[...] |
2261+
| hash_flow.rb:1011:5:1011:5 | h [element :a] | semmle.label | h [element :a] |
2262+
| hash_flow.rb:1011:9:1011:45 | call to [] [element :a] | semmle.label | call to [] [element :a] |
2263+
| hash_flow.rb:1011:14:1011:24 | call to taint | semmle.label | call to taint |
22742264
| hash_flow.rb:1012:5:1012:5 | h [element :a] | semmle.label | h [element :a] |
2275-
| hash_flow.rb:1012:9:1012:45 | call to [] [element :a] | semmle.label | call to [] [element :a] |
2276-
| hash_flow.rb:1012:14:1012:24 | call to taint | semmle.label | call to taint |
2277-
| hash_flow.rb:1013:5:1013:5 | h [element :a] | semmle.label | h [element :a] |
2278-
| hash_flow.rb:1013:15:1013:15 | k | semmle.label | k |
2279-
| hash_flow.rb:1013:18:1013:18 | v | semmle.label | v |
2280-
| hash_flow.rb:1014:14:1014:14 | v | semmle.label | v |
2281-
| hash_flow.rb:1015:14:1015:14 | k | semmle.label | k |
2265+
| hash_flow.rb:1012:15:1012:15 | k | semmle.label | k |
2266+
| hash_flow.rb:1012:18:1012:18 | v | semmle.label | v |
2267+
| hash_flow.rb:1013:14:1013:14 | v | semmle.label | v |
2268+
| hash_flow.rb:1014:14:1014:14 | k | semmle.label | k |
22822269
subpaths
22832270
hashLiteral
22842271
| hash_flow.rb:10:12:21:5 | call to [] |
@@ -2352,8 +2339,7 @@ hashLiteral
23522339
| hash_flow.rb:946:13:950:5 | call to [] |
23532340
| hash_flow.rb:971:9:971:38 | ...[...] |
23542341
| hash_flow.rb:994:14:994:47 | ...[...] |
2355-
| hash_flow.rb:1005:9:1005:10 | call to [] |
2356-
| hash_flow.rb:1012:9:1012:45 | call to [] |
2342+
| hash_flow.rb:1011:9:1011:45 | call to [] |
23572343
#select
23582344
| hash_flow.rb:22:10:22:17 | ...[...] | hash_flow.rb:11:15:11:24 | call to taint | hash_flow.rb:22:10:22:17 | ...[...] | $@ | hash_flow.rb:11:15:11:24 | call to taint | call to taint |
23592345
| hash_flow.rb:24:10:24:17 | ...[...] | hash_flow.rb:13:12:13:21 | call to taint | hash_flow.rb:24:10:24:17 | ...[...] | $@ | hash_flow.rb:13:12:13:21 | call to taint | call to taint |
@@ -2599,6 +2585,5 @@ hashLiteral
25992585
| hash_flow.rb:975:10:975:13 | ...[...] | hash_flow.rb:971:23:971:31 | call to taint | hash_flow.rb:975:10:975:13 | ...[...] | $@ | hash_flow.rb:971:23:971:31 | call to taint | call to taint |
26002586
| hash_flow.rb:996:14:996:19 | ...[...] | hash_flow.rb:994:30:994:40 | call to taint | hash_flow.rb:996:14:996:19 | ...[...] | $@ | hash_flow.rb:994:30:994:40 | call to taint | call to taint |
26012587
| hash_flow.rb:998:14:998:18 | ...[...] | hash_flow.rb:994:30:994:40 | call to taint | hash_flow.rb:998:14:998:18 | ...[...] | $@ | hash_flow.rb:994:30:994:40 | call to taint | call to taint |
2602-
| hash_flow.rb:1008:10:1008:17 | ...[...] | hash_flow.rb:1006:14:1006:24 | call to taint | hash_flow.rb:1008:10:1008:17 | ...[...] | $@ | hash_flow.rb:1006:14:1006:24 | call to taint | call to taint |
2603-
| hash_flow.rb:1014:14:1014:14 | v | hash_flow.rb:1012:14:1012:24 | call to taint | hash_flow.rb:1014:14:1014:14 | v | $@ | hash_flow.rb:1012:14:1012:24 | call to taint | call to taint |
2604-
| hash_flow.rb:1015:14:1015:14 | k | hash_flow.rb:1012:14:1012:24 | call to taint | hash_flow.rb:1015:14:1015:14 | k | $@ | hash_flow.rb:1012:14:1012:24 | call to taint | call to taint |
2588+
| hash_flow.rb:1013:14:1013:14 | v | hash_flow.rb:1011:14:1011:24 | call to taint | hash_flow.rb:1013:14:1013:14 | v | $@ | hash_flow.rb:1011:14:1011:24 | call to taint | call to taint |
2589+
| hash_flow.rb:1014:14:1014:14 | k | hash_flow.rb:1011:14:1011:24 | call to taint | hash_flow.rb:1014:14:1014:14 | k | $@ | hash_flow.rb:1011:14:1011:24 | call to taint | call to taint |

‎ruby/ql/test/library-tests/dataflow/hash-flow/hash-flow.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
import codeql.ruby.AST
66
import codeql.ruby.CFG
77
import TestUtilities.InlineFlowTest
8-
import ValueFlowTest<DefaultFlowConfig>
8+
import DefaultFlowTest
99
import ValueFlow::PathGraph
1010

1111
query predicate hashLiteral(CfgNodes::ExprNodes::HashLiteralCfgNode n) { any() }

‎ruby/ql/test/library-tests/dataflow/hash-flow/hash_flow.rb

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ def m3()
5959
x = {a: taint(3.2), b: 1}
6060
hash2 = Hash[x]
6161
sink(hash2[:a]) # $ hasValueFlow=3.2
62-
sink(hash2[:b])
62+
sink(hash2[:b]) # $ hasTaintFlow=3.2
6363

6464
hash3 = Hash[[[:a, taint(3.3)], [:b, 1]]]
6565
sink(hash3[:a]) # $ hasValueFlow=3.3
@@ -75,7 +75,7 @@ def m3()
7575

7676
hash6 = Hash[{"a" => taint(3.6), "b" => 1}]
7777
sink(hash6["a"]) # $ hasValueFlow=3.6
78-
sink(hash6["b"])
78+
sink(hash6["b"]) # $ hasTaintFlow=3.6
7979
end
8080

8181
m3()
@@ -1002,10 +1002,9 @@ def m54(i)
10021002
M54.new.m54(:b)
10031003

10041004
def m55
1005-
h = {}
1006-
h[f()] = taint(55.1)
1005+
h = taint(55.1)
10071006
keys = h.keys
1008-
sink(keys[:a]) # $ hasValueFlow=55.1
1007+
sink(keys[f()]) # $ hasTaintFlow=55.1
10091008
end
10101009

10111010
def m56

0 commit comments

Comments
 (0)