Ruby: Model various JSON methods

Author: hmac

ruby/ql/lib/codeql/ruby/Frameworks.qll

@@ -24,3 +24,4 @@ private import codeql.ruby.frameworks.XmlParsing
 private import codeql.ruby.frameworks.ActionDispatch
 private import codeql.ruby.frameworks.PosixSpawn
 private import codeql.ruby.frameworks.StringFormatters
+private import codeql.ruby.frameworks.Json

ruby/ql/lib/codeql/ruby/frameworks/Json.qll

@@ -0,0 +1,22 @@
+/** Provides modelling for the `json` gem. */
+
+private import codeql.ruby.frameworks.data.ModelsAsData
+
+/** Provides modelling for the `json` gem. */
+module Json {
+  /**
+   * Flow summaries for common `JSON` methods.
+   * Not all of these methods are strictly defined in the `json` gem.
+   * The `JSON` namespace is heavily overloaded by other JSON parsing gems such as `oj`, `json_pure`, `multi_json` etc.
+   * This summary covers common methods we've seen called on `JSON` in the wild.
+   */
+  private class JsonSummary extends ModelInput::SummaryModelCsv {
+    override predicate row(string row) {
+      row =
+        [
+          "json;;Member[JSON].Method[parse,parse!,load,restore];Argument[0];ReturnValue;taint",
+          "json;;Member[JSON].Method[generate,fast_generate,dump,unparse,fast_unparse];Argument[0];ReturnValue;taint",
+        ]
+    }
+  }
+}

ruby/ql/test/library-tests/frameworks/json/JsonDataFlow.expected

@@ -0,0 +1,32 @@
+failures
+edges
+| json.rb:1:17:1:26 | call to source :  | json.rb:1:6:1:27 | call to parse |
+| json.rb:2:18:2:27 | call to source :  | json.rb:2:6:2:28 | call to parse! |
+| json.rb:3:16:3:25 | call to source :  | json.rb:3:6:3:26 | call to load |
+| json.rb:4:19:4:28 | call to source :  | json.rb:4:6:4:29 | call to restore |
+| json.rb:6:20:6:29 | call to source :  | json.rb:6:6:6:30 | call to generate |
+| json.rb:7:25:7:34 | call to source :  | json.rb:7:6:7:35 | call to fast_generate |
+| json.rb:8:16:8:25 | call to source :  | json.rb:8:6:8:26 | call to dump |
+| json.rb:9:19:9:28 | call to source :  | json.rb:9:6:9:29 | call to unparse |
+| json.rb:10:24:10:33 | call to source :  | json.rb:10:6:10:34 | call to fast_unparse |
+nodes
+| json.rb:1:6:1:27 | call to parse | semmle.label | call to parse |
+| json.rb:1:17:1:26 | call to source :  | semmle.label | call to source :  |
+| json.rb:2:6:2:28 | call to parse! | semmle.label | call to parse! |
+| json.rb:2:18:2:27 | call to source :  | semmle.label | call to source :  |
+| json.rb:3:6:3:26 | call to load | semmle.label | call to load |
+| json.rb:3:16:3:25 | call to source :  | semmle.label | call to source :  |
+| json.rb:4:6:4:29 | call to restore | semmle.label | call to restore |
+| json.rb:4:19:4:28 | call to source :  | semmle.label | call to source :  |
+| json.rb:6:6:6:30 | call to generate | semmle.label | call to generate |
+| json.rb:6:20:6:29 | call to source :  | semmle.label | call to source :  |
+| json.rb:7:6:7:35 | call to fast_generate | semmle.label | call to fast_generate |
+| json.rb:7:25:7:34 | call to source :  | semmle.label | call to source :  |
+| json.rb:8:6:8:26 | call to dump | semmle.label | call to dump |
+| json.rb:8:16:8:25 | call to source :  | semmle.label | call to source :  |
+| json.rb:9:6:9:29 | call to unparse | semmle.label | call to unparse |
+| json.rb:9:19:9:28 | call to source :  | semmle.label | call to source :  |
+| json.rb:10:6:10:34 | call to fast_unparse | semmle.label | call to fast_unparse |
+| json.rb:10:24:10:33 | call to source :  | semmle.label | call to source :  |
+subpaths
+#select

ruby/ql/test/library-tests/frameworks/json/JsonDataFlow.ql

@@ -0,0 +1,12 @@
+/**
+ * @kind path-problem
+ */
+
+import codeql.ruby.AST
+import TestUtilities.InlineFlowTest
+import codeql.ruby.Frameworks
+import PathGraph
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, DefaultValueFlowConf conf
+where conf.hasFlowPath(source, sink)
+select sink, source, sink, "$@", source, source.toString()

ruby/ql/test/library-tests/frameworks/json/json.rb

@@ -0,0 +1,10 @@
+sink JSON.parse(source "a") # $hasTaintFlow=a
+sink JSON.parse!(source "a") # $hasTaintFlow=a
+sink JSON.load(source "a") # $hasTaintFlow=a
+sink JSON.restore(source "a") # $hasTaintFlow=a
+
+sink JSON.generate(source "a") # $hasTaintFlow=a
+sink JSON.fast_generate(source "a") # $hasTaintFlow=a
+sink JSON.dump(source "a") # $hasTaintFlow=a
+sink JSON.unparse(source "a") # $hasTaintFlow=a
+sink JSON.fast_unparse(source "a") # $hasTaintFlow=a