Ruby: add some rb/weak-cookie-configuration tests

Author: alexrford

ruby/ql/test/query-tests/security/cwe-732/WeakCookieConfiguration.expected

@@ -0,0 +1,5 @@
+| app/config/application.rb:14:5:14:50 | call to encrypted_cookie_cipher= | DES is a weak cipher. |
+| app/config/application.rb:17:5:17:50 | call to encrypted_cookie_cipher= | AES-256-ECB is a weak cipher. |
+| app/config/application.rb:23:5:23:62 | call to use_authenticated_cookie_encryption= | use_authenticated_cookie_encryption=false selects a weaker block mode for authenticated cookies. |
+| app/config/application.rb:32:5:32:55 | call to cookies_same_site_protection= | Setting 'SameSite' to 'None' may make an application more vulnerable to CSRF attacks. |
+| app/config/application.rb:35:5:35:55 | call to cookies_same_site_protection= | Unsetting 'SameSite' can disable same-site cookie restrictions in some browsers. |

ruby/ql/test/query-tests/security/cwe-732/WeakCookieConfiguration.qlref

@@ -0,0 +1 @@
+queries/security/cwe-732/WeakCookieConfiguration.ql

ruby/ql/test/query-tests/security/cwe-732/app/config/application.rb

@@ -0,0 +1,37 @@
+require 'rails'
+
+module App
+  class Application < Rails::Application
+    config.load_defaults 6.0
+
+    # GOOD: strong cipher
+    config.action_dispatch.encrypted_cookie_cipher = "aes-256-gcm"
+
+    # GOOD: strong cipher
+    config.action_dispatch.encrypted_cookie_cipher = "ChaCha"
+
+    # BAD: weak block encryption algorithm
+    config.action_dispatch.encrypted_cookie_cipher = "DES"
+
+    # BAD: weak block encryption mode
+    config.action_dispatch.encrypted_cookie_cipher = "AES-256-ECB"
+
+    # GOOD
+    config.action_dispatch.use_authenticated_cookie_encryption = true
+
+    # BAD: less secure block encryption mode
+    config.action_dispatch.use_authenticated_cookie_encryption = false
+
+    # GOOD
+    config.action_dispatch.cookies_same_site_protection = :lax
+
+    # GOOD
+    config.action_dispatch.cookies_same_site_protection = "strict"
+
+    # BAD: disabling same-site protections for sending cookies
+    config.action_dispatch.cookies_same_site_protection = :none
+
+    # BAD: not all browsers default to `lax` if unset
+    config.action_dispatch.cookies_same_site_protection = nil
+  end
+end