Skip to content

Commit f1c82b6

Browse files
asgerfasgerf
committed
Ruby: Implement Fuzzy for Ruby
1 parent 919cb07 commit f1c82b6

File tree

4 files changed

+71
-0
lines changed

4 files changed

+71
-0
lines changed

‎ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsSpecific.qll

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,25 @@ API::Node getExtraSuccessorFromInvoke(InvokeNode node, AccessPathToken token) {
176176
)
177177
}
178178

179+
pragma[inline]
180+
API::Node getAFuzzySuccessor(API::Node node) {
181+
result = node.getAMember()
182+
or
183+
result = node.getMethod(_)
184+
or
185+
result =
186+
node.getArgumentAtPosition(any(DataFlowDispatch::ArgumentPosition apos | not apos.isSelf()))
187+
or
188+
result =
189+
node.getParameterAtPosition(any(DataFlowDispatch::ParameterPosition ppos | not ppos.isSelf()))
190+
or
191+
result = node.getReturn()
192+
or
193+
result = node.getAnElement()
194+
or
195+
result = node.getInstance()
196+
}
197+
179198
/**
180199
* Holds if `invoke` matches the Ruby-specific call site filter in `token`.
181200
*/

‎ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,14 @@ edges
4545
| summaries.rb:1:1:1:7 | tainted | summaries.rb:147:16:147:22 | tainted |
4646
| summaries.rb:1:1:1:7 | tainted | summaries.rb:150:39:150:45 | tainted |
4747
| summaries.rb:1:1:1:7 | tainted | summaries.rb:150:39:150:45 | tainted |
48+
| summaries.rb:1:1:1:7 | tainted | summaries.rb:154:20:154:26 | tainted |
49+
| summaries.rb:1:1:1:7 | tainted | summaries.rb:154:20:154:26 | tainted |
50+
| summaries.rb:1:1:1:7 | tainted | summaries.rb:155:28:155:34 | tainted |
51+
| summaries.rb:1:1:1:7 | tainted | summaries.rb:155:28:155:34 | tainted |
52+
| summaries.rb:1:1:1:7 | tainted | summaries.rb:156:27:156:33 | tainted |
53+
| summaries.rb:1:1:1:7 | tainted | summaries.rb:156:27:156:33 | tainted |
54+
| summaries.rb:1:1:1:7 | tainted | summaries.rb:158:15:158:21 | tainted |
55+
| summaries.rb:1:1:1:7 | tainted | summaries.rb:158:15:158:21 | tainted |
4856
| summaries.rb:1:11:1:36 | call to identity | summaries.rb:1:1:1:7 | tainted |
4957
| summaries.rb:1:11:1:36 | call to identity | summaries.rb:1:1:1:7 | tainted |
5058
| summaries.rb:1:20:1:36 | call to source | summaries.rb:1:11:1:36 | call to identity |
@@ -232,6 +240,9 @@ edges
232240
| summaries.rb:122:16:122:22 | [post] tainted | summaries.rb:145:26:145:32 | tainted |
233241
| summaries.rb:122:16:122:22 | [post] tainted | summaries.rb:147:16:147:22 | tainted |
234242
| summaries.rb:122:16:122:22 | [post] tainted | summaries.rb:150:39:150:45 | tainted |
243+
| summaries.rb:122:16:122:22 | [post] tainted | summaries.rb:154:20:154:26 | tainted |
244+
| summaries.rb:122:16:122:22 | [post] tainted | summaries.rb:155:28:155:34 | tainted |
245+
| summaries.rb:122:16:122:22 | [post] tainted | summaries.rb:156:27:156:33 | tainted |
235246
| summaries.rb:122:16:122:22 | tainted | summaries.rb:122:16:122:22 | [post] tainted |
236247
| summaries.rb:122:16:122:22 | tainted | summaries.rb:122:25:122:25 | [post] y |
237248
| summaries.rb:122:16:122:22 | tainted | summaries.rb:122:33:122:33 | [post] z |
@@ -475,6 +486,18 @@ nodes
475486
| summaries.rb:147:16:147:22 | tainted | semmle.label | tainted |
476487
| summaries.rb:150:39:150:45 | tainted | semmle.label | tainted |
477488
| summaries.rb:150:39:150:45 | tainted | semmle.label | tainted |
489+
| summaries.rb:154:20:154:26 | tainted | semmle.label | tainted |
490+
| summaries.rb:154:20:154:26 | tainted | semmle.label | tainted |
491+
| summaries.rb:155:28:155:34 | tainted | semmle.label | tainted |
492+
| summaries.rb:155:28:155:34 | tainted | semmle.label | tainted |
493+
| summaries.rb:156:27:156:33 | tainted | semmle.label | tainted |
494+
| summaries.rb:156:27:156:33 | tainted | semmle.label | tainted |
495+
| summaries.rb:158:15:158:21 | tainted | semmle.label | tainted |
496+
| summaries.rb:158:15:158:21 | tainted | semmle.label | tainted |
497+
| summaries.rb:163:20:163:36 | call to source | semmle.label | call to source |
498+
| summaries.rb:163:20:163:36 | call to source | semmle.label | call to source |
499+
| summaries.rb:166:20:166:36 | call to source | semmle.label | call to source |
500+
| summaries.rb:166:20:166:36 | call to source | semmle.label | call to source |
478501
subpaths
479502
invalidSpecComponent
480503
#select
@@ -574,6 +597,18 @@ invalidSpecComponent
574597
| summaries.rb:147:16:147:22 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:147:16:147:22 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
575598
| summaries.rb:150:39:150:45 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:150:39:150:45 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
576599
| summaries.rb:150:39:150:45 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:150:39:150:45 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
600+
| summaries.rb:154:20:154:26 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:154:20:154:26 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
601+
| summaries.rb:154:20:154:26 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:154:20:154:26 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
602+
| summaries.rb:155:28:155:34 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:155:28:155:34 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
603+
| summaries.rb:155:28:155:34 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:155:28:155:34 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
604+
| summaries.rb:156:27:156:33 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:156:27:156:33 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
605+
| summaries.rb:156:27:156:33 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:156:27:156:33 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
606+
| summaries.rb:158:15:158:21 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:158:15:158:21 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
607+
| summaries.rb:158:15:158:21 | tainted | summaries.rb:1:20:1:36 | call to source | summaries.rb:158:15:158:21 | tainted | $@ | summaries.rb:1:20:1:36 | call to source | call to source |
608+
| summaries.rb:163:20:163:36 | call to source | summaries.rb:163:20:163:36 | call to source | summaries.rb:163:20:163:36 | call to source | $@ | summaries.rb:163:20:163:36 | call to source | call to source |
609+
| summaries.rb:163:20:163:36 | call to source | summaries.rb:163:20:163:36 | call to source | summaries.rb:163:20:163:36 | call to source | $@ | summaries.rb:163:20:163:36 | call to source | call to source |
610+
| summaries.rb:166:20:166:36 | call to source | summaries.rb:166:20:166:36 | call to source | summaries.rb:166:20:166:36 | call to source | $@ | summaries.rb:166:20:166:36 | call to source | call to source |
611+
| summaries.rb:166:20:166:36 | call to source | summaries.rb:166:20:166:36 | call to source | summaries.rb:166:20:166:36 | call to source | $@ | summaries.rb:166:20:166:36 | call to source | call to source |
577612
warning
578613
| CSV type row should have 3 columns but has 1: TooFewColumns |
579614
| CSV type row should have 3 columns but has 6: TooManyColumns;;Member[Foo].Instance;too;many;columns |

‎ruby/ql/test/library-tests/dataflow/summaries/Summaries.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ private class SinkFromModel extends ModelInput::SinkModelCsv {
145145
"Foo!;Method[getSinks].ReturnValue.Element[any].Method[mySink].Argument[0];test-sink", //
146146
"Foo!;Method[arraySink].Argument[0].Element[any];test-sink", //
147147
"Foo!;Method[secondArrayElementIsSink].Argument[0].Element[1];test-sink", //
148+
"FuzzyLib!;Fuzzy.Method[fuzzyCall].Argument[0];test-sink"
148149
]
149150
}
150151
}

‎ruby/ql/test/library-tests/dataflow/summaries/summaries.rb

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,3 +150,19 @@ def userDefinedFunction(x, y)
150150
Foo.secondArrayElementIsSink(["safe", tainted, "safe"]) # $ hasValueFlow=tainted
151151
Foo.secondArrayElementIsSink(["safe", "safe", tainted])
152152
Foo.secondArrayElementIsSink([tainted] * 10) # $ MISSING: hasValueFlow=tainted
153+
154+
FuzzyLib.fuzzyCall(tainted) # $ hasValueFlow=tainted
155+
FuzzyLib.foo.bar.fuzzyCall(tainted) # $ hasValueFlow=tainted
156+
FuzzyLib.foo[0].fuzzyCall(tainted) # $ hasValueFlow=tainted
157+
FuzzyLib.foo do |x|
158+
x.fuzzyCall(tainted) # $ hasValueFlow=tainted
159+
x.otherCall(tainted)
160+
end
161+
class FuzzySub < FuzzyLib::Foo
162+
def blah
163+
self.fuzzyCall(source("tainted")) # $ hasValueFlow=tainted
164+
end
165+
def self.blah
166+
self.fuzzyCall(source("tainted")) # $ hasValueFlow=tainted
167+
end
168+
end

0 commit comments

Comments
 (0)