Ruby: refine summaries for Hash#reverse_merge etc.

- revert the changes to the taint summaries specific to ActionController
  params
- make the general flow summaries value-preserving and use
  WithElement[any]

Author: nickrolfe

ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll

@@ -592,12 +592,15 @@ private module ParamsSummaries {
   /**
    * `#merge`
    * Returns a new ActionController::Parameters with all keys from other_hash merged into current hash.
+   * `#reverse_merge`
+   * `#with_defaults`
+   * Returns a new ActionController::Parameters with all keys from current hash merged into other_hash.
    */
   private class MergeSummary extends SummarizedCallable {
     MergeSummary() { this = "ActionController::Parameters#merge" }
 
     override MethodCall getACall() {
-      result.getMethodName() = "merge" and
+      result.getMethodName() = ["merge", "reverse_merge", "with_defaults"] and
       exists(ParamsInstance i |
         i.asExpr().getExpr() = [result.getReceiver(), result.getArgument(0)]
       )
@@ -613,12 +616,16 @@ private module ParamsSummaries {
   /**
    * `#merge!`
    * Returns current ActionController::Parameters instance with current hash merged into other_hash.
+   * `#reverse_merge!`
+   * `#with_defaults!`
+   * `#reverse_update`
+   * Returns a new ActionController::Parameters with all keys from current hash merged into other_hash.
    */
   private class MergeBangSummary extends SummarizedCallable {
     MergeBangSummary() { this = "ActionController::Parameters#merge!" }
 
     override MethodCall getACall() {
-      result.getMethodName() = "merge!" and
+      result.getMethodName() = ["merge!", "reverse_merge!", "with_defaults!", "reverse_update"] and
       exists(ParamsInstance i |
         i.asExpr().getExpr() = [result.getReceiver(), result.getArgument(0)]
       )

ruby/ql/lib/codeql/ruby/frameworks/ActiveSupport.qll

@@ -127,9 +127,9 @@ module ActiveSupport {
         ReverseMergeSummary() { this = ["reverse_merge", "with_defaults"] }
 
         override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
-          input = ["Argument[self]", "Argument[0]"] and
+          input = "Argument[self,0].WithElement[any]" and
           output = "ReturnValue" and
-          preservesValue = false
+          preservesValue = true
         }
       }
 
@@ -140,9 +140,9 @@ module ActiveSupport {
         ReverseMergeBangSummary() { this = ["reverse_merge!", "with_defaults!", "reverse_update"] }
 
         override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
-          input = ["Argument[self]", "Argument[0]"] and
+          input = "Argument[self,0].WithElement[any]" and
           output = ["ReturnValue", "Argument[self]"] and
-          preservesValue = false
+          preservesValue = true
         }
       }