Allow implicit read steps on sinks

joefarebrother · joefarebrother · commit b0c03f6d68a9 · 2024-06-12T15:11:32.000+01:00
diff --git a/ruby/ql/lib/codeql/ruby/security/CleartextLoggingQuery.qll b/ruby/ql/lib/codeql/ruby/security/CleartextLoggingQuery.qll
@@ -44,6 +44,11 @@ private module Config implements DataFlow::ConfigSig {
   predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
     CL::isAdditionalTaintStep(nodeFrom, nodeTo)
   }
+
+  predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet cs) {
+    exists(cs) and
+    isSink(node)
+  }
 }
 
 /**
diff --git a/ruby/ql/lib/codeql/ruby/security/CleartextStorageQuery.qll b/ruby/ql/lib/codeql/ruby/security/CleartextStorageQuery.qll
@@ -43,6 +43,11 @@ private module Config implements DataFlow::ConfigSig {
   predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
     CS::isAdditionalTaintStep(nodeFrom, nodeTo)
   }
+
+  predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet cs) {
+    exists(cs) and
+    isSink(node)
+  }
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -44,6 +44,11 @@ private module Config implements DataFlow::ConfigSig {`
`44`	`44`	`predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {`
`45`	`45`	`CL::isAdditionalTaintStep(nodeFrom, nodeTo)`
`46`	`46`	`}`
	`47`	`+`
	`48`	`+ predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet cs) {`
	`49`	`+ exists(cs) and`
	`50`	`+ isSink(node)`
	`51`	`+ }`
`47`	`52`	`}`
`48`	`53`
`49`	`54`	`/**`
Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,11 @@ private module Config implements DataFlow::ConfigSig {`
`43`	`43`	`predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {`
`44`	`44`	`CS::isAdditionalTaintStep(nodeFrom, nodeTo)`
`45`	`45`	`}`
	`46`	`+`
	`47`	`+ predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet cs) {`
	`48`	`+ exists(cs) and`
	`49`	`+ isSink(node)`
	`50`	`+ }`
`46`	`51`	`}`
`47`	`52`
`48`	`53`	`/**`