Merge pull request #15847 from hvitved/ruby/orm-field-as-source-no-args

Ruby: Exclude calls with arguments from `OrmFieldAsSource`

Author: hvitved

ruby/ql/lib/codeql/ruby/security/XSS.qll

@@ -324,7 +324,9 @@ module StoredXss {
     OrmFieldAsSource() {
       exists(DataFlow::CallNode subSrc |
         OrmTracking::flow(subSrc, this.getReceiver()) and
-        subSrc.(OrmInstantiation).methodCallMayAccessField(this.getMethodName())
+        subSrc.(OrmInstantiation).methodCallMayAccessField(this.getMethodName()) and
+        this.getNumberOfArguments() = 0 and
+        not exists(this.getBlock())
       )
     }
   }