Ruby: Exclude vendored library parameters from taint sources.

aschackmull · aschackmull · commit ab2d6f762ecf · 2026-08-05T10:44:30.000+02:00
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/Gem.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/Gem.qll
@@ -90,6 +90,9 @@ module Gem {
       result = this.getAPublicModule().getStmt(_).(SingletonClass)
     }
 
+    /** Holds if this gem is vendored in this codebase. */
+    predicate isVendored() { File.super.getParentContainer+().getBaseName() = "vendor" }
+
     /** Gets a parameter from an exported method, which is an input to this gem. */
     DataFlow::ParameterNode getAnInputParameter() {
       exists(MethodBase method |
@@ -107,6 +110,7 @@ module Gem {
   DataFlow::ParameterNode getALibraryInput() {
     exists(GemSpec spec |
       exists(spec.getName()) and // we only consider `.gemspec` files that have a name
+      not spec.isVendored() and // if the gem is vendored its parameters are not external inputs
       result = spec.getAnInputParameter()
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -90,6 +90,9 @@ module Gem {`
`90`	`90`	`result = this.getAPublicModule().getStmt(_).(SingletonClass)`
`91`	`91`	`}`
`92`	`92`
	`93`	`+ /** Holds if this gem is vendored in this codebase. */`
	`94`	`+ predicate isVendored() { File.super.getParentContainer+().getBaseName() = "vendor" }`
	`95`	`+`
`93`	`96`	`/** Gets a parameter from an exported method, which is an input to this gem. */`
`94`	`97`	`DataFlow::ParameterNode getAnInputParameter() {`
`95`	`98`	`exists(MethodBase method \|`
`@@ -107,6 +110,7 @@ module Gem {`
`107`	`110`	`DataFlow::ParameterNode getALibraryInput() {`
`108`	`111`	`exists(GemSpec spec \|`
`109`	`112`	exists(spec.getName()) and // we only consider `.gemspec` files that have a name
	`113`	`+ not spec.isVendored() and // if the gem is vendored its parameters are not external inputs`
`110`	`114`	`result = spec.getAnInputParameter()`
`111`	`115`	`)`
`112`	`116`	`}`