Skip to content

Commit 2964aef

Browse files
author
Alvaro Muñoz
authored
Update Kernel.qll to include send aliases
Add `public_send` and `__send__` as Code Injection sinks as proposed by @vcsjones
1 parent 19c5d1f commit 2964aef

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ module Kernel {
4343
* ```
4444
*/
4545
private predicate isPublicKernelMethod(string method) {
46-
method in ["class", "clone", "frozen?", "tap", "then", "yield_self", "send"]
46+
method in ["class", "clone", "frozen?", "tap", "then", "yield_self", "send", "public_send", "__send__"]
4747
}
4848

4949
/**
@@ -167,7 +167,7 @@ module Kernel {
167167
* ```
168168
*/
169169
class SendCallCodeExecution extends CodeExecution::Range, KernelMethodCall {
170-
SendCallCodeExecution() { this.getMethodName() = "send" }
170+
SendCallCodeExecution() { this.getMethodName() = ["send", "public_send", "__send__"] }
171171

172172
override DataFlow::Node getCode() { result = this.getArgument(0) }
173173

0 commit comments

Comments
 (0)