Skip to content

Commit 04de315

Browse files
hvitvedhvitved
committed
Ruby: Deprecate models-as-data CSV interface
1 parent 5cebcad commit 04de315

23 files changed

Lines changed: 378 additions & 500 deletions

File tree

‎ruby/ql/lib/codeql/ruby/Frameworks.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ private import codeql.ruby.frameworks.XmlParsing
2626
private import codeql.ruby.frameworks.ActionDispatch
2727
private import codeql.ruby.frameworks.PosixSpawn
2828
private import codeql.ruby.frameworks.StringFormatters
29-
private import codeql.ruby.frameworks.Json
3029
private import codeql.ruby.frameworks.Erb
3130
private import codeql.ruby.frameworks.Slim
3231
private import codeql.ruby.frameworks.Sinatra

‎ruby/ql/lib/codeql/ruby/frameworks/ActiveStorage.model.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/ruby-all
4+
extensible: summaryModel
5+
data:
6+
- ['ActiveStorage::Filename!', 'Method[new]', 'Argument[0]', 'ReturnValue', 'taint']
7+
- ['ActiveStorage::Filename', 'Method[sanitized]', 'Argument[self]', 'ReturnValue', 'taint']
8+
9+
- addsTo:
10+
pack: codeql/ruby-all
11+
extensible: typeModel
12+
data:
13+
# ActiveStorage::Blob.compose(blobs : [Blob]) : Blob
14+
- ['ActiveStorage::Blob', 'ActiveStorage::Blob!', 'Method[compose].ReturnValue']
15+
# ActiveStorage::Blob.create_and_upload! : Blob
16+
- ['ActiveStorage::Blob', 'ActiveStorage::Blob!', 'Method[create_and_upload!].ReturnValue']
17+
# ActiveStorage::Blob.create_before_direct_upload! : Blob
18+
- ['ActiveStorage::Blob', 'ActiveStorage::Blob!', 'Method[create_before_direct_upload!].ReturnValue']
19+
# ActiveStorage::Blob.find_signed(!) : Blob
20+
- ['ActiveStorage::Blob', 'ActiveStorage::Blob!', 'Method[find_signed,find_signed!].ReturnValue']
21+
# gives error: Invalid name 'Element' in access path
22+
# - ['ActiveStorage::Blob', 'ActiveStorage::Blob!', 'Method[compose].Argument[0].Element[any]']

‎ruby/ql/lib/codeql/ruby/frameworks/ActiveStorage.qll‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -26,39 +26,6 @@ module ActiveStorage {
2626
}
2727
}
2828

29-
/** Taint related to `ActiveStorage::Filename`. */
30-
private class FilenameSummaries extends ModelInput::SummaryModelCsv {
31-
override predicate row(string row) {
32-
row =
33-
[
34-
"ActiveStorage::Filename!;Method[new];Argument[0];ReturnValue;taint",
35-
"ActiveStorage::Filename;Method[sanitized];Argument[self];ReturnValue;taint",
36-
]
37-
}
38-
}
39-
40-
/**
41-
* `Blob` is an instance of `ActiveStorage::Blob`.
42-
*/
43-
private class BlobTypeSummary extends ModelInput::TypeModelCsv {
44-
override predicate row(string row) {
45-
// package1;type1;package2;type2;path
46-
row =
47-
[
48-
// ActiveStorage::Blob.create_and_upload! : Blob
49-
"ActiveStorage::Blob;ActiveStorage::Blob!;Method[create_and_upload!].ReturnValue",
50-
// ActiveStorage::Blob.create_before_direct_upload! : Blob
51-
"ActiveStorage::Blob;ActiveStorage::Blob!;Method[create_before_direct_upload!].ReturnValue",
52-
// ActiveStorage::Blob.compose(blobs : [Blob]) : Blob
53-
"ActiveStorage::Blob;ActiveStorage::Blob!;Method[compose].ReturnValue",
54-
// gives error: Invalid name 'Element' in access path
55-
// "ActiveStorage::Blob;ActiveStorage::Blob!;Method[compose].Argument[0].Element[any]",
56-
// ActiveStorage::Blob.find_signed(!) : Blob
57-
"ActiveStorage::Blob;ActiveStorage::Blob!;Method[find_signed,find_signed!].ReturnValue",
58-
]
59-
}
60-
}
61-
6229
private class BlobInstance extends DataFlow::Node {
6330
BlobInstance() {
6431
this = ModelOutput::getATypeNode("ActiveStorage::Blob").getAValueReachableFromSource()

‎ruby/ql/lib/codeql/ruby/frameworks/ActiveSupport.model.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/ruby-all
4+
extensible: summaryModel
5+
data:
6+
# `ActiveSupport::SafeBuffer` wraps a string, providing HTML-safe methods
7+
# for concatenation.
8+
# It is possible to insert tainted data into `SafeBuffer` that won't get
9+
# sanitized, and this taint is then propagated via most of the methods.
10+
#
11+
# TODO: SafeBuffer also reponds to all String methods.
12+
# Can we model this without repeating all the existing summaries we have
13+
# for String?
14+
15+
# SafeBuffer.new(x) does not sanitize x
16+
- ['ActionView::SafeBuffer!', 'Method[new]', 'Argument[0]', 'ReturnValue', 'taint']
17+
# These methods preserve taint in self
18+
- ['ActionView::SafeBuffer', 'Method[concat,insert,prepend,to_s,to_param]', 'Argument[self]', 'ReturnValue', 'taint']
19+
# SafeBuffer#safe_concat(x) does not sanitize x
20+
- ['ActionView::SafeBuffer', 'Method[safe_concat]', 'Argument[0]', 'Argument[self]', 'taint']
21+
- ['ActionView::SafeBuffer', 'Method[safe_concat]', 'Argument[0]', 'ReturnValue', 'taint']
22+
- ['ActiveSupport::JSON!', 'Method[decode,load]', 'Argument[0]', 'ReturnValue', 'taint']
23+
- ['ActiveSupport::JSON!', 'Method[encode,dump]', 'Argument[0]', 'ReturnValue', 'taint']
24+
- ['Pathname', 'Method[existence]', 'Argument[self]', 'ReturnValue', 'taint']
25+
26+
- addsTo:
27+
pack: codeql/ruby-all
28+
extensible: typeModel
29+
data:
30+
- ['Pathname', 'Pathname', 'Method[existence].ReturnValue']

‎ruby/ql/lib/codeql/ruby/frameworks/ActiveSupport.qll‎

Lines changed: 0 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -478,60 +478,4 @@ module ActiveSupport {
478478
}
479479
}
480480
}
481-
482-
/**
483-
* Type summaries for extensions to the `Pathname` module.
484-
*/
485-
private class PathnameTypeSummary extends ModelInput::TypeModelCsv {
486-
override predicate row(string row) {
487-
// type1;type2;path
488-
// Pathname#existence : Pathname
489-
row = "Pathname;Pathname;Method[existence].ReturnValue"
490-
}
491-
}
492-
493-
/** Taint flow summaries for extensions to the `Pathname` module. */
494-
private class PathnameTaintSummary extends ModelInput::SummaryModelCsv {
495-
override predicate row(string row) {
496-
// Pathname#existence
497-
row = "Pathname;Method[existence];Argument[self];ReturnValue;taint"
498-
}
499-
}
500-
501-
/**
502-
* `ActiveSupport::SafeBuffer` wraps a string, providing HTML-safe methods
503-
* for concatenation.
504-
* It is possible to insert tainted data into `SafeBuffer` that won't get
505-
* sanitized, and this taint is then propagated via most of the methods.
506-
*/
507-
private class SafeBufferSummary extends ModelInput::SummaryModelCsv {
508-
// TODO: SafeBuffer also reponds to all String methods.
509-
// Can we model this without repeating all the existing summaries we have
510-
// for String?
511-
override predicate row(string row) {
512-
row =
513-
[
514-
// SafeBuffer.new(x) does not sanitize x
515-
"ActionView::SafeBuffer!;Method[new];Argument[0];ReturnValue;taint",
516-
// SafeBuffer#safe_concat(x) does not sanitize x
517-
"ActionView::SafeBuffer;Method[safe_concat];Argument[0];ReturnValue;taint",
518-
"ActionView::SafeBuffer;Method[safe_concat];Argument[0];Argument[self];taint",
519-
// These methods preserve taint in self
520-
"ActionView::SafeBuffer;Method[concat,insert,prepend,to_s,to_param];Argument[self];ReturnValue;taint",
521-
]
522-
}
523-
}
524-
525-
/** `ActiveSupport::JSON` */
526-
module Json {
527-
private class JsonSummary extends ModelInput::SummaryModelCsv {
528-
override predicate row(string row) {
529-
row =
530-
[
531-
"ActiveSupport::JSON!;Method[encode,dump];Argument[0];ReturnValue;taint",
532-
"ActiveSupport::JSON!;Method[decode,load];Argument[0];ReturnValue;taint",
533-
]
534-
}
535-
}
536-
}
537481
}

‎ruby/ql/lib/codeql/ruby/frameworks/Core.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import core.Module
1313
import core.Array
1414
import core.Hash
1515
import core.String
16-
import core.Regexp
1716
import core.IO
1817
import core.Digest
1918
import core.Base64

‎ruby/ql/lib/codeql/ruby/frameworks/Json.model.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/ruby-all
4+
extensible: summaryModel
5+
data:
6+
# Not all of these methods are strictly defined in the `json` gem.
7+
# The `JSON` namespace is heavily overloaded by other JSON parsing gems such as `oj`, `json_pure`, `multi_json` etc.
8+
# This summary covers common methods we've seen called on `JSON` in the wild.
9+
- ['JSON!', 'Method[generate,fast_generate,pretty_generate,dump,unparse,fast_unparse]', 'Argument[0]', 'ReturnValue', 'taint']
10+
- ['JSON!', 'Method[parse,parse!,load,restore]', 'Argument[0]', 'ReturnValue', 'taint']
11+

‎ruby/ql/lib/codeql/ruby/frameworks/Json.qll‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎ruby/ql/lib/codeql/ruby/frameworks/actiondispatch/internal/Mime.model.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/ruby-all
4+
extensible: typeModel
5+
data:
6+
- ['Mime::Type', 'Mime!', 'Method[fetch].ReturnValue']
7+
- ['Mime::Type', 'Mime::Type!', 'Method[lookup].ReturnValue']
8+
- ['Mime::Type', 'Mime::Type!', 'Method[lookup_by_extension].ReturnValue']
9+
- ['Mime::Type', 'Mime::Type!', 'Method[register].ReturnValue']
10+
- ['Mime::Type', 'Mime::Type!', 'Method[register_alias].ReturnValue']

‎ruby/ql/lib/codeql/ruby/frameworks/actiondispatch/internal/Mime.qll‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -9,31 +9,6 @@ private import codeql.ruby.frameworks.data.ModelsAsData
99
* Models MIME type handling using the `ActionDispatch` library, which is part of Rails.
1010
*/
1111
module Mime {
12-
/**
13-
* Type summaries for the `Mime::Type` class, i.e. method calls that produce new
14-
* `Mime::Type` instances.
15-
*/
16-
private class MimeTypeTypeSummary extends ModelInput::TypeModelCsv {
17-
override predicate row(string row) {
18-
// type1;type2;path
19-
row =
20-
[
21-
// Mime[type] : Mime::Type (omitted)
22-
// Method names with brackets like [] cannot be represented in MaD.
23-
// Mime.fetch(type) : Mime::Type
24-
"Mime::Type;Mime!;Method[fetch].ReturnValue",
25-
// Mime::Type.lookup(str) : Mime::Type
26-
"Mime::Type;Mime::Type!;Method[lookup].ReturnValue",
27-
// Mime::Type.lookup_by_extension(str) : Mime::Type
28-
"Mime::Type;Mime::Type!;Method[lookup_by_extension].ReturnValue",
29-
// Mime::Type.register(str) : Mime::Type
30-
"Mime::Type;Mime::Type!;Method[register].ReturnValue",
31-
// Mime::Type.register_alias(str) : Mime::Type
32-
"Mime::Type;Mime::Type!;Method[register_alias].ReturnValue",
33-
]
34-
}
35-
}
36-
3712
/**
3813
* An argument to `Mime::Type#match?`, which is converted to a RegExp via
3914
* `Regexp.new`.

0 commit comments

Comments
 (0)