Merge pull request github#15733 from hvitved/ruby/desugar-hidden

Ruby: Rework hidden synthetic data-flow nodes

Author: hvitved

ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll

@@ -800,7 +800,17 @@ predicate nodeIsHidden(Node n) {
   or
   n = LocalFlow::getParameterDefNode(_)
   or
-  isDesugarNode(n.(ExprNode).getExprNode().getExpr())
+  exists(AstNode desug |
+    isDesugarNode(desug) and
+    desug.isSynthesized() and
+    not desug = [any(ArrayLiteral al).getDesugared(), any(HashLiteral hl).getDesugared()]
+  |
+    desug = n.asExpr().getExpr()
+    or
+    desug = n.(PostUpdateNode).getPreUpdateNode().asExpr().getExpr()
+    or
+    desug = n.(ParameterNode).getParameter()
+  )
   or
   n instanceof FlowSummaryNode
   or

ruby/ql/test/library-tests/dataflow/array-flow/array-flow.expected

@@ -1672,3 +1672,20 @@ def m139(i)
         sink(a2[i]) # $ hasValueFlow=139.2
     end
 end
+
+def m139
+    a = [0, 1, source(139.1)]
+    b = a.map do |x|
+        x
+    end
+    sink b[2] # $ hasValueFlow=139.1
+end
+
+def m140
+    a = [0, 1, source(140.1), source(140.2)]
+    x, y, z, w = a
+    sink x
+    sink y
+    sink z # $ hasValueFlow=140.1
+    sink w # $ hasValueFlow=140.2
+end

ruby/ql/test/library-tests/dataflow/array-flow/array_flow.rb

@@ -162,8 +162,10 @@ edges
 | semantics.rb:116:5:116:5 | h [element :a] | semantics.rb:117:16:117:16 | h [element :a] | provenance |  |
 | semantics.rb:116:5:116:5 | h [element :a] | semantics.rb:121:22:121:22 | h [element :a] | provenance |  |
 | semantics.rb:116:5:116:5 | h [element :a] | semantics.rb:121:22:121:22 | h [element :a] | provenance |  |
-| semantics.rb:116:14:116:14 | a | semantics.rb:116:5:116:5 | h [element :a] | provenance |  |
-| semantics.rb:116:14:116:14 | a | semantics.rb:116:5:116:5 | h [element :a] | provenance |  |
+| semantics.rb:116:9:116:22 | call to [] [element :a] | semantics.rb:116:5:116:5 | h [element :a] | provenance |  |
+| semantics.rb:116:9:116:22 | call to [] [element :a] | semantics.rb:116:5:116:5 | h [element :a] | provenance |  |
+| semantics.rb:116:14:116:14 | a | semantics.rb:116:9:116:22 | call to [] [element :a] | provenance |  |
+| semantics.rb:116:14:116:14 | a | semantics.rb:116:9:116:22 | call to [] [element :a] | provenance |  |
 | semantics.rb:117:14:117:16 | ** ... [element :a] | semantics.rb:117:10:117:17 | call to s16 | provenance |  |
 | semantics.rb:117:14:117:16 | ** ... [element :a] | semantics.rb:117:10:117:17 | call to s16 | provenance |  |
 | semantics.rb:117:16:117:16 | h [element :a] | semantics.rb:117:14:117:16 | ** ... [element :a] | provenance |  |
@@ -212,10 +214,14 @@ edges
 | semantics.rb:135:5:135:7 | arr [element 0] | semantics.rb:136:15:136:17 | arr [element 0] | provenance |  |
 | semantics.rb:135:5:135:7 | arr [element 1] | semantics.rb:136:15:136:17 | arr [element 1] | provenance |  |
 | semantics.rb:135:5:135:7 | arr [element 1] | semantics.rb:136:15:136:17 | arr [element 1] | provenance |  |
-| semantics.rb:135:12:135:12 | a | semantics.rb:135:5:135:7 | arr [element 0] | provenance |  |
-| semantics.rb:135:12:135:12 | a | semantics.rb:135:5:135:7 | arr [element 0] | provenance |  |
-| semantics.rb:135:15:135:15 | b | semantics.rb:135:5:135:7 | arr [element 1] | provenance |  |
-| semantics.rb:135:15:135:15 | b | semantics.rb:135:5:135:7 | arr [element 1] | provenance |  |
+| semantics.rb:135:11:135:16 | call to [] [element 0] | semantics.rb:135:5:135:7 | arr [element 0] | provenance |  |
+| semantics.rb:135:11:135:16 | call to [] [element 0] | semantics.rb:135:5:135:7 | arr [element 0] | provenance |  |
+| semantics.rb:135:11:135:16 | call to [] [element 1] | semantics.rb:135:5:135:7 | arr [element 1] | provenance |  |
+| semantics.rb:135:11:135:16 | call to [] [element 1] | semantics.rb:135:5:135:7 | arr [element 1] | provenance |  |
+| semantics.rb:135:12:135:12 | a | semantics.rb:135:11:135:16 | call to [] [element 0] | provenance |  |
+| semantics.rb:135:12:135:12 | a | semantics.rb:135:11:135:16 | call to [] [element 0] | provenance |  |
+| semantics.rb:135:15:135:15 | b | semantics.rb:135:11:135:16 | call to [] [element 1] | provenance |  |
+| semantics.rb:135:15:135:15 | b | semantics.rb:135:11:135:16 | call to [] [element 1] | provenance |  |
 | semantics.rb:136:14:136:17 | * ... [element 0] | semantics.rb:136:10:136:18 | call to s18 | provenance |  |
 | semantics.rb:136:14:136:17 | * ... [element 0] | semantics.rb:136:10:136:18 | call to s18 | provenance |  |
 | semantics.rb:136:14:136:17 | * ... [element 1] | semantics.rb:136:10:136:18 | call to s18 | provenance |  |
@@ -1275,6 +1281,8 @@ nodes
 | semantics.rb:115:9:115:18 | call to source | semmle.label | call to source |
 | semantics.rb:116:5:116:5 | h [element :a] | semmle.label | h [element :a] |
 | semantics.rb:116:5:116:5 | h [element :a] | semmle.label | h [element :a] |
+| semantics.rb:116:9:116:22 | call to [] [element :a] | semmle.label | call to [] [element :a] |
+| semantics.rb:116:9:116:22 | call to [] [element :a] | semmle.label | call to [] [element :a] |
 | semantics.rb:116:14:116:14 | a | semmle.label | a |
 | semantics.rb:116:14:116:14 | a | semmle.label | a |
 | semantics.rb:117:10:117:17 | call to s16 | semmle.label | call to s16 |
@@ -1332,6 +1340,10 @@ nodes
 | semantics.rb:135:5:135:7 | arr [element 0] | semmle.label | arr [element 0] |
 | semantics.rb:135:5:135:7 | arr [element 1] | semmle.label | arr [element 1] |
 | semantics.rb:135:5:135:7 | arr [element 1] | semmle.label | arr [element 1] |
+| semantics.rb:135:11:135:16 | call to [] [element 0] | semmle.label | call to [] [element 0] |
+| semantics.rb:135:11:135:16 | call to [] [element 0] | semmle.label | call to [] [element 0] |
+| semantics.rb:135:11:135:16 | call to [] [element 1] | semmle.label | call to [] [element 1] |
+| semantics.rb:135:11:135:16 | call to [] [element 1] | semmle.label | call to [] [element 1] |
 | semantics.rb:135:12:135:12 | a | semmle.label | a |
 | semantics.rb:135:12:135:12 | a | semmle.label | a |
 | semantics.rb:135:15:135:15 | b | semmle.label | b |