Add SubshellHeredocExecution

This is a form of command execution:

    result = <<`EOF`
    echo foo bar #{baz}
    EOF

Author: hmac

ql/lib/codeql/ruby/frameworks/StandardLibrary.qll

@@ -26,6 +26,25 @@ class SubshellLiteralExecution extends SystemCommandExecution::Range {
   override predicate isShellInterpreted(DataFlow::Node arg) { arg = getAnArgument() }
 }
 
+/**
+ * A system command executed via shell heredoc syntax.
+ * E.g.
+ * ```ruby
+ * <<`EOF`
+ * cat foo.text
+ * EOF
+ * ```
+ */
+class SubshellHeredocExecution extends SystemCommandExecution::Range {
+  HereDoc heredoc;
+
+  SubshellHeredocExecution() { this.asExpr().getExpr() = heredoc and heredoc.isSubShell() }
+
+  override DataFlow::Node getAnArgument() { result.asExpr().getExpr() = heredoc.getComponent(_) }
+
+  override predicate isShellInterpreted(DataFlow::Node arg) { arg = getAnArgument() }
+}
+
 /**
  * A system command executed via the `Kernel.system` method.
  * `Kernel.system` accepts three argument forms:

ql/test/library-tests/frameworks/CommandExecution.rb

@@ -63,3 +63,7 @@
 Open3.pipeline_w("echo foo")
 Open3.pipeline_start("echo foo")
 Open3.pipeline("echo foo")
+
+<<`EOF`
+echo foo
+EOF

ql/test/library-tests/frameworks/StandardLibrary.expected

@@ -4,6 +4,8 @@ subshellLiteralExecutions
 | CommandExecution.rb:3:1:3:12 | `echo foo` |
 | CommandExecution.rb:4:1:4:12 | `echo foo` |
 | CommandExecution.rb:5:1:5:12 | `echo foo` |
+subshellHeredocExecutions
+| CommandExecution.rb:67:1:67:7 | <<`EOF` |
 kernelSystemCallExecutions
 | CommandExecution.rb:7:1:7:18 | call to system |
 | CommandExecution.rb:8:1:8:21 | call to system |

ql/test/library-tests/frameworks/StandardLibrary.ql

@@ -2,6 +2,8 @@ import codeql.ruby.frameworks.StandardLibrary
 
 query predicate subshellLiteralExecutions(SubshellLiteralExecution e) { any() }
 
+query predicate subshellHeredocExecutions(SubshellHeredocExecution e) { any() }
+
 query predicate kernelSystemCallExecutions(KernelSystemCall c) { any() }
 
 query predicate kernelExecCallExecutions(KernelExecCall c) { any() }

ql/test/query-tests/security/cwe-078/CommandInjection.expected

@@ -3,14 +3,17 @@ edges
 | CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:7:16:7:18 | cmd |
 | CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:8:14:8:16 | cmd |
 | CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:9:17:9:22 | #{...} |
+| CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:11:9:11:14 | #{...} |
 nodes
 | CommandInjection.rb:5:15:5:20 | call to params :  | semmle.label | call to params :  |
 | CommandInjection.rb:6:10:6:15 | #{...} | semmle.label | #{...} |
 | CommandInjection.rb:7:16:7:18 | cmd | semmle.label | cmd |
 | CommandInjection.rb:8:14:8:16 | cmd | semmle.label | cmd |
 | CommandInjection.rb:9:17:9:22 | #{...} | semmle.label | #{...} |
+| CommandInjection.rb:11:9:11:14 | #{...} | semmle.label | #{...} |
 #select
 | CommandInjection.rb:6:10:6:15 | #{...} | CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:6:10:6:15 | #{...} | This command depends on $@. | CommandInjection.rb:5:15:5:20 | call to params | a user-provided value |
 | CommandInjection.rb:7:16:7:18 | cmd | CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:7:16:7:18 | cmd | This command depends on $@. | CommandInjection.rb:5:15:5:20 | call to params | a user-provided value |
 | CommandInjection.rb:8:14:8:16 | cmd | CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:8:14:8:16 | cmd | This command depends on $@. | CommandInjection.rb:5:15:5:20 | call to params | a user-provided value |
 | CommandInjection.rb:9:17:9:22 | #{...} | CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:9:17:9:22 | #{...} | This command depends on $@. | CommandInjection.rb:5:15:5:20 | call to params | a user-provided value |
+| CommandInjection.rb:11:9:11:14 | #{...} | CommandInjection.rb:5:15:5:20 | call to params :  | CommandInjection.rb:11:9:11:14 | #{...} | This command depends on $@. | CommandInjection.rb:5:15:5:20 | call to params | a user-provided value |

ql/test/query-tests/security/cwe-078/CommandInjection.rb

@@ -7,6 +7,9 @@ def create
         system(cmd)
         exec(cmd)
         %x(echo #{cmd})
+        result = <<`EOF`
+        #{cmd}
+EOF
 
         safe_cmd = Shellwords.escape(cmd)
         `echo #{safe_cmd}`