Skip to content

Commit 18fa91b

Browse files
am0o0hmac
authored andcommitted
add transform method that is an alias for to_ruby
1 parent a75a004 commit 18fa91b

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

ruby/ql/lib/codeql/ruby/frameworks/Yaml.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,8 @@ private class YamlParseStep extends AdditionalTaintStep {
4141
exists(API::Node parseSuccessors | parseSuccessors = yamlNode() |
4242
succ =
4343
[
44-
parseSuccessors.getMethod("to_ruby").getReturn().asSource(),
45-
parseSuccessors.getMethod("to_ruby").getReturn().getAnElement().asSource()
44+
parseSuccessors.getMethod(["to_ruby", "transform"]).getReturn().asSource(),
45+
parseSuccessors.getMethod(["to_ruby", "transform"]).getReturn().getAnElement().asSource()
4646
] and
4747
pred = parseSuccessors.asSource()
4848
)

ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ module UnsafeDeserialization {
105105
exists(API::Node toRubyReceiver |
106106
toRubyReceiver = yamlNode() and this = toRubyReceiver.asSource()
107107
|
108-
exists(toRubyReceiver.getMethod("to_ruby"))
108+
exists(toRubyReceiver.getMethod(["to_ruby", "transform"]))
109109
)
110110
}
111111
}

0 commit comments

Comments
 (0)