@@ -7,7 +7,6 @@ private import codeql.ruby.CFG
7
7
private import codeql.ruby.Concepts
8
8
private import codeql.ruby.ApiGraphs
9
9
private import codeql.ruby.DataFlow
10
- private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
11
10
12
11
/**
13
12
* A call that makes an HTTP request using `Faraday`.
@@ -78,32 +77,29 @@ class FaradayHttpRequest extends Http::Client::Request::Range, DataFlow::CallNod
78
77
override predicate disablesCertificateValidation (
79
78
DataFlow:: Node disablingNode , DataFlow:: Node argumentOrigin
80
79
) {
81
- any ( FaradayDisablesCertificateValidationConfiguration config )
82
- .hasFlow ( argumentOrigin , disablingNode ) and
80
+ FaradayDisablesCertificateValidationFlow:: flow ( argumentOrigin , disablingNode ) and
83
81
disablingNode = this .getCertificateValidationControllingValue ( _)
84
82
}
85
83
86
84
override string getFramework ( ) { result = "Faraday" }
87
85
}
88
86
89
87
/** A configuration to track values that can disable certificate validation for Faraday. */
90
- private class FaradayDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries:: Configuration
91
- {
92
- FaradayDisablesCertificateValidationConfiguration ( ) {
93
- this = "FaradayDisablesCertificateValidationConfiguration"
94
- }
88
+ private module FaradayDisablesCertificateValidationConfig implements DataFlow:: StateConfigSig {
89
+ class FlowState = string ;
95
90
96
- override predicate isSource (
97
- DataFlow:: Node source , DataFlowImplForHttpClientLibraries:: FlowState state
98
- ) {
91
+ predicate isSource ( DataFlow:: Node source , FlowState state ) {
99
92
source .asExpr ( ) .getExpr ( ) .( BooleanLiteral ) .isFalse ( ) and
100
93
state = "verify"
101
94
or
102
95
source = API:: getTopLevelMember ( "OpenSSL" ) .getMember ( "SSL" ) .getMember ( "VERIFY_NONE" ) .asSource ( ) and
103
96
state = "verify_mode"
104
97
}
105
98
106
- override predicate isSink ( DataFlow:: Node sink , DataFlowImplForHttpClientLibraries :: FlowState state ) {
99
+ predicate isSink ( DataFlow:: Node sink , FlowState state ) {
107
100
sink = any ( FaradayHttpRequest req ) .getCertificateValidationControllingValue ( state )
108
101
}
109
102
}
103
+
104
+ private module FaradayDisablesCertificateValidationFlow =
105
+ DataFlow:: GlobalWithState< FaradayDisablesCertificateValidationConfig > ;
0 commit comments