Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ruby: demonstrate data flow not working with instance variables #7447

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
+32 −1
Draft

Ruby: demonstrate data flow not working with instance variables #7447

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter
Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
View file
Open in desktop
@@ -301,7 +301,7 @@ private class ActiveRecordModelClassSelfReference extends ActiveRecordModelInsta
}

// A (locally tracked) active record model object
private class ActiveRecordInstance extends DataFlow::Node {
class ActiveRecordInstance extends DataFlow::Node {
private ActiveRecordModelInstantiation instantiation;

ActiveRecordInstance() { this = instantiation or instantiation.flowsTo(this) }
10 ruby/ql/test/library-tests/frameworks/ActiveRecord.expected
View file
Open in desktop
@@ -33,6 +33,8 @@ activeRecordModelClassMethodCalls
| ActiveRecordInjection.rb:85:5:85:33 | call to find_by |
| ActiveRecordInjection.rb:88:5:88:34 | call to find |
| ActiveRecordInjection.rb:94:5:94:45 | call to delete_by |
| ActiveRecordInjection.rb:101:12:101:23 | call to find |
| ActiveRecordInjection.rb:106:13:106:24 | call to find |
potentiallyUnsafeSqlExecutingMethodCall
| ActiveRecordInjection.rb:10:5:10:68 | call to find |
| ActiveRecordInjection.rb:23:5:23:25 | call to destroy_by |
@@ -51,3 +53,11 @@ activeRecordModelInstantiations
| ActiveRecordInjection.rb:80:7:80:40 | call to find_by | ActiveRecordInjection.rb:5:1:17:3 | User |
| ActiveRecordInjection.rb:85:5:85:33 | call to find_by | ActiveRecordInjection.rb:5:1:17:3 | User |
| ActiveRecordInjection.rb:88:5:88:34 | call to find | ActiveRecordInjection.rb:5:1:17:3 | User |
| ActiveRecordInjection.rb:101:12:101:23 | call to find | ActiveRecordInjection.rb:5:1:17:3 | User |
| ActiveRecordInjection.rb:106:13:106:24 | call to find | ActiveRecordInjection.rb:5:1:17:3 | User |
activeRecordInstanceCalls
| ActiveRecordInjection.rb:10:5:10:68 | self | ActiveRecordInjection.rb:10:5:10:68 | call to find |
| ActiveRecordInjection.rb:15:5:15:40 | call to find_by | ActiveRecordInjection.rb:15:5:15:46 | call to users |
| ActiveRecordInjection.rb:23:5:23:25 | self | ActiveRecordInjection.rb:23:5:23:25 | call to destroy_by |
| ActiveRecordInjection.rb:102:5:102:8 | user | ActiveRecordInjection.rb:102:5:102:16 | call to destroy |
| ActiveRecordInjection.rb:107:5:107:9 | @user | ActiveRecordInjection.rb:107:5:107:17 | call to destroy |
8 ruby/ql/test/library-tests/frameworks/ActiveRecord.ql
View file
Open in desktop
@@ -1,5 +1,6 @@
import codeql.ruby.controlflow.CfgNodes
import codeql.ruby.frameworks.ActiveRecord
import codeql.ruby.DataFlow

query predicate activeRecordModelClasses(ActiveRecordModelClass cls) { any() }

@@ -16,3 +17,10 @@ query predicate activeRecordModelInstantiations(
) {
i.getClass() = cls
}


query predicate activeRecordInstanceCalls(
ActiveRecordInstance instance, DataFlow::CallNode call
) {
call.getReceiver() = instance
}
13 ruby/ql/test/library-tests/frameworks/ActiveRecordInjection.rb
View file
Open in desktop
@@ -94,3 +94,16 @@ def yet_another_handler
Admin.delete_by(params[:admin_condition])
end
end


class JeffController < ApplicationController
def destroy
user = User.find(1)
user.destroy
end

def destroy_broken
@user = User.find(1)
@user.destroy
end
end