Skip to content

Commit 0b30ecf

Browse files
asgerfasgerf
committed
Ruby: add select clause back to Summaries.ql
1 parent 8e2ffc2 commit 0b30ecf

File tree

2 files changed

+157
-0
lines changed

2 files changed

+157
-0
lines changed

‎ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,158 @@
11
failures
2+
edges
3+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:2:6:2:12 | tainted |
4+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:2:6:2:12 | tainted |
5+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:4:24:4:30 | tainted : |
6+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:4:24:4:30 | tainted : |
7+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:16:36:16:42 | tainted : |
8+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:16:36:16:42 | tainted : |
9+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:20:25:20:31 | tainted : |
10+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:26:31:26:37 | tainted : |
11+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:30:24:30:30 | tainted : |
12+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:31:27:31:33 | tainted : |
13+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:34:16:34:22 | tainted |
14+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:34:16:34:22 | tainted |
15+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:35:16:35:22 | tainted |
16+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:35:16:35:22 | tainted |
17+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:36:21:36:27 | tainted |
18+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:36:21:36:27 | tainted |
19+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:37:36:37:42 | tainted |
20+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:37:36:37:42 | tainted |
21+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:51:24:51:30 | tainted : |
22+
| summaries.rb:1:11:1:36 | call to identity : | summaries.rb:54:23:54:29 | tainted : |
23+
| summaries.rb:1:20:1:36 | call to source : | summaries.rb:1:11:1:36 | call to identity : |
24+
| summaries.rb:1:20:1:36 | call to source : | summaries.rb:1:11:1:36 | call to identity : |
25+
| summaries.rb:4:12:7:3 | call to apply_block : | summaries.rb:9:6:9:13 | tainted2 |
26+
| summaries.rb:4:12:7:3 | call to apply_block : | summaries.rb:9:6:9:13 | tainted2 |
27+
| summaries.rb:4:24:4:30 | tainted : | summaries.rb:4:12:7:3 | call to apply_block : |
28+
| summaries.rb:4:24:4:30 | tainted : | summaries.rb:4:12:7:3 | call to apply_block : |
29+
| summaries.rb:4:24:4:30 | tainted : | summaries.rb:4:36:4:36 | x : |
30+
| summaries.rb:4:24:4:30 | tainted : | summaries.rb:4:36:4:36 | x : |
31+
| summaries.rb:4:36:4:36 | x : | summaries.rb:5:8:5:8 | x |
32+
| summaries.rb:4:36:4:36 | x : | summaries.rb:5:8:5:8 | x |
33+
| summaries.rb:11:17:11:17 | x : | summaries.rb:12:8:12:8 | x |
34+
| summaries.rb:11:17:11:17 | x : | summaries.rb:12:8:12:8 | x |
35+
| summaries.rb:16:12:16:43 | call to apply_lambda : | summaries.rb:18:6:18:13 | tainted3 |
36+
| summaries.rb:16:12:16:43 | call to apply_lambda : | summaries.rb:18:6:18:13 | tainted3 |
37+
| summaries.rb:16:36:16:42 | tainted : | summaries.rb:11:17:11:17 | x : |
38+
| summaries.rb:16:36:16:42 | tainted : | summaries.rb:11:17:11:17 | x : |
39+
| summaries.rb:16:36:16:42 | tainted : | summaries.rb:16:12:16:43 | call to apply_lambda : |
40+
| summaries.rb:16:36:16:42 | tainted : | summaries.rb:16:12:16:43 | call to apply_lambda : |
41+
| summaries.rb:20:12:20:32 | call to firstArg : | summaries.rb:21:6:21:13 | tainted4 |
42+
| summaries.rb:20:25:20:31 | tainted : | summaries.rb:20:12:20:32 | call to firstArg : |
43+
| summaries.rb:26:12:26:38 | call to secondArg : | summaries.rb:27:6:27:13 | tainted5 |
44+
| summaries.rb:26:31:26:37 | tainted : | summaries.rb:26:12:26:38 | call to secondArg : |
45+
| summaries.rb:30:24:30:30 | tainted : | summaries.rb:30:6:30:42 | call to onlyWithBlock |
46+
| summaries.rb:31:27:31:33 | tainted : | summaries.rb:31:6:31:34 | call to onlyWithoutBlock |
47+
| summaries.rb:40:7:40:17 | call to source : | summaries.rb:41:24:41:24 | t : |
48+
| summaries.rb:40:7:40:17 | call to source : | summaries.rb:42:24:42:24 | t : |
49+
| summaries.rb:40:7:40:17 | call to source : | summaries.rb:44:8:44:8 | t : |
50+
| summaries.rb:41:24:41:24 | t : | summaries.rb:41:8:41:25 | call to matchedByName |
51+
| summaries.rb:42:24:42:24 | t : | summaries.rb:42:8:42:25 | call to matchedByName |
52+
| summaries.rb:44:8:44:8 | t : | summaries.rb:44:8:44:27 | call to matchedByNameRcv |
53+
| summaries.rb:48:24:48:41 | call to source : | summaries.rb:48:8:48:42 | call to preserveTaint |
54+
| summaries.rb:51:24:51:30 | tainted : | summaries.rb:51:6:51:31 | call to namedArg |
55+
| summaries.rb:54:23:54:29 | tainted : | summaries.rb:54:40:54:40 | x : |
56+
| summaries.rb:54:40:54:40 | x : | summaries.rb:55:8:55:8 | x |
57+
| summaries.rb:62:24:62:53 | call to source : | summaries.rb:62:8:62:54 | call to preserveTaint |
58+
| summaries.rb:65:26:65:56 | call to source : | summaries.rb:65:8:65:57 | call to preserveTaint |
59+
nodes
60+
| summaries.rb:1:11:1:36 | call to identity : | semmle.label | call to identity : |
61+
| summaries.rb:1:11:1:36 | call to identity : | semmle.label | call to identity : |
62+
| summaries.rb:1:20:1:36 | call to source : | semmle.label | call to source : |
63+
| summaries.rb:1:20:1:36 | call to source : | semmle.label | call to source : |
64+
| summaries.rb:2:6:2:12 | tainted | semmle.label | tainted |
65+
| summaries.rb:2:6:2:12 | tainted | semmle.label | tainted |
66+
| summaries.rb:4:12:7:3 | call to apply_block : | semmle.label | call to apply_block : |
67+
| summaries.rb:4:12:7:3 | call to apply_block : | semmle.label | call to apply_block : |
68+
| summaries.rb:4:24:4:30 | tainted : | semmle.label | tainted : |
69+
| summaries.rb:4:24:4:30 | tainted : | semmle.label | tainted : |
70+
| summaries.rb:4:36:4:36 | x : | semmle.label | x : |
71+
| summaries.rb:4:36:4:36 | x : | semmle.label | x : |
72+
| summaries.rb:5:8:5:8 | x | semmle.label | x |
73+
| summaries.rb:5:8:5:8 | x | semmle.label | x |
74+
| summaries.rb:9:6:9:13 | tainted2 | semmle.label | tainted2 |
75+
| summaries.rb:9:6:9:13 | tainted2 | semmle.label | tainted2 |
76+
| summaries.rb:11:17:11:17 | x : | semmle.label | x : |
77+
| summaries.rb:11:17:11:17 | x : | semmle.label | x : |
78+
| summaries.rb:12:8:12:8 | x | semmle.label | x |
79+
| summaries.rb:12:8:12:8 | x | semmle.label | x |
80+
| summaries.rb:16:12:16:43 | call to apply_lambda : | semmle.label | call to apply_lambda : |
81+
| summaries.rb:16:12:16:43 | call to apply_lambda : | semmle.label | call to apply_lambda : |
82+
| summaries.rb:16:36:16:42 | tainted : | semmle.label | tainted : |
83+
| summaries.rb:16:36:16:42 | tainted : | semmle.label | tainted : |
84+
| summaries.rb:18:6:18:13 | tainted3 | semmle.label | tainted3 |
85+
| summaries.rb:18:6:18:13 | tainted3 | semmle.label | tainted3 |
86+
| summaries.rb:20:12:20:32 | call to firstArg : | semmle.label | call to firstArg : |
87+
| summaries.rb:20:25:20:31 | tainted : | semmle.label | tainted : |
88+
| summaries.rb:21:6:21:13 | tainted4 | semmle.label | tainted4 |
89+
| summaries.rb:26:12:26:38 | call to secondArg : | semmle.label | call to secondArg : |
90+
| summaries.rb:26:31:26:37 | tainted : | semmle.label | tainted : |
91+
| summaries.rb:27:6:27:13 | tainted5 | semmle.label | tainted5 |
92+
| summaries.rb:30:6:30:42 | call to onlyWithBlock | semmle.label | call to onlyWithBlock |
93+
| summaries.rb:30:24:30:30 | tainted : | semmle.label | tainted : |
94+
| summaries.rb:31:6:31:34 | call to onlyWithoutBlock | semmle.label | call to onlyWithoutBlock |
95+
| summaries.rb:31:27:31:33 | tainted : | semmle.label | tainted : |
96+
| summaries.rb:34:16:34:22 | tainted | semmle.label | tainted |
97+
| summaries.rb:34:16:34:22 | tainted | semmle.label | tainted |
98+
| summaries.rb:35:16:35:22 | tainted | semmle.label | tainted |
99+
| summaries.rb:35:16:35:22 | tainted | semmle.label | tainted |
100+
| summaries.rb:36:21:36:27 | tainted | semmle.label | tainted |
101+
| summaries.rb:36:21:36:27 | tainted | semmle.label | tainted |
102+
| summaries.rb:37:36:37:42 | tainted | semmle.label | tainted |
103+
| summaries.rb:37:36:37:42 | tainted | semmle.label | tainted |
104+
| summaries.rb:40:7:40:17 | call to source : | semmle.label | call to source : |
105+
| summaries.rb:41:8:41:25 | call to matchedByName | semmle.label | call to matchedByName |
106+
| summaries.rb:41:24:41:24 | t : | semmle.label | t : |
107+
| summaries.rb:42:8:42:25 | call to matchedByName | semmle.label | call to matchedByName |
108+
| summaries.rb:42:24:42:24 | t : | semmle.label | t : |
109+
| summaries.rb:44:8:44:8 | t : | semmle.label | t : |
110+
| summaries.rb:44:8:44:27 | call to matchedByNameRcv | semmle.label | call to matchedByNameRcv |
111+
| summaries.rb:48:8:48:42 | call to preserveTaint | semmle.label | call to preserveTaint |
112+
| summaries.rb:48:24:48:41 | call to source : | semmle.label | call to source : |
113+
| summaries.rb:51:6:51:31 | call to namedArg | semmle.label | call to namedArg |
114+
| summaries.rb:51:24:51:30 | tainted : | semmle.label | tainted : |
115+
| summaries.rb:54:23:54:29 | tainted : | semmle.label | tainted : |
116+
| summaries.rb:54:40:54:40 | x : | semmle.label | x : |
117+
| summaries.rb:55:8:55:8 | x | semmle.label | x |
118+
| summaries.rb:62:8:62:54 | call to preserveTaint | semmle.label | call to preserveTaint |
119+
| summaries.rb:62:24:62:53 | call to source : | semmle.label | call to source : |
120+
| summaries.rb:65:8:65:57 | call to preserveTaint | semmle.label | call to preserveTaint |
121+
| summaries.rb:65:26:65:56 | call to source : | semmle.label | call to source : |
122+
subpaths
2123
invalidSpecComponent
3124
invalidOutputSpecComponent
125+
#select
126+
| summaries.rb:2:6:2:12 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:2:6:2:12 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
127+
| summaries.rb:2:6:2:12 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:2:6:2:12 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
128+
| summaries.rb:5:8:5:8 | x | summaries.rb:1:20:1:36 | call to source : | summaries.rb:5:8:5:8 | x | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
129+
| summaries.rb:5:8:5:8 | x | summaries.rb:1:20:1:36 | call to source : | summaries.rb:5:8:5:8 | x | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
130+
| summaries.rb:9:6:9:13 | tainted2 | summaries.rb:1:20:1:36 | call to source : | summaries.rb:9:6:9:13 | tainted2 | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
131+
| summaries.rb:9:6:9:13 | tainted2 | summaries.rb:1:20:1:36 | call to source : | summaries.rb:9:6:9:13 | tainted2 | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
132+
| summaries.rb:12:8:12:8 | x | summaries.rb:1:20:1:36 | call to source : | summaries.rb:12:8:12:8 | x | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
133+
| summaries.rb:12:8:12:8 | x | summaries.rb:1:20:1:36 | call to source : | summaries.rb:12:8:12:8 | x | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
134+
| summaries.rb:18:6:18:13 | tainted3 | summaries.rb:1:20:1:36 | call to source : | summaries.rb:18:6:18:13 | tainted3 | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
135+
| summaries.rb:18:6:18:13 | tainted3 | summaries.rb:1:20:1:36 | call to source : | summaries.rb:18:6:18:13 | tainted3 | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
136+
| summaries.rb:21:6:21:13 | tainted4 | summaries.rb:1:20:1:36 | call to source : | summaries.rb:21:6:21:13 | tainted4 | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
137+
| summaries.rb:27:6:27:13 | tainted5 | summaries.rb:1:20:1:36 | call to source : | summaries.rb:27:6:27:13 | tainted5 | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
138+
| summaries.rb:30:6:30:42 | call to onlyWithBlock | summaries.rb:1:20:1:36 | call to source : | summaries.rb:30:6:30:42 | call to onlyWithBlock | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
139+
| summaries.rb:31:6:31:34 | call to onlyWithoutBlock | summaries.rb:1:20:1:36 | call to source : | summaries.rb:31:6:31:34 | call to onlyWithoutBlock | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
140+
| summaries.rb:34:16:34:22 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:34:16:34:22 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
141+
| summaries.rb:34:16:34:22 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:34:16:34:22 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
142+
| summaries.rb:35:16:35:22 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:35:16:35:22 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
143+
| summaries.rb:35:16:35:22 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:35:16:35:22 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
144+
| summaries.rb:36:21:36:27 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:36:21:36:27 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
145+
| summaries.rb:36:21:36:27 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:36:21:36:27 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
146+
| summaries.rb:37:36:37:42 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:37:36:37:42 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
147+
| summaries.rb:37:36:37:42 | tainted | summaries.rb:1:20:1:36 | call to source : | summaries.rb:37:36:37:42 | tainted | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
148+
| summaries.rb:41:8:41:25 | call to matchedByName | summaries.rb:40:7:40:17 | call to source : | summaries.rb:41:8:41:25 | call to matchedByName | $@ | summaries.rb:40:7:40:17 | call to source : | call to source : |
149+
| summaries.rb:42:8:42:25 | call to matchedByName | summaries.rb:40:7:40:17 | call to source : | summaries.rb:42:8:42:25 | call to matchedByName | $@ | summaries.rb:40:7:40:17 | call to source : | call to source : |
150+
| summaries.rb:44:8:44:27 | call to matchedByNameRcv | summaries.rb:40:7:40:17 | call to source : | summaries.rb:44:8:44:27 | call to matchedByNameRcv | $@ | summaries.rb:40:7:40:17 | call to source : | call to source : |
151+
| summaries.rb:48:8:48:42 | call to preserveTaint | summaries.rb:48:24:48:41 | call to source : | summaries.rb:48:8:48:42 | call to preserveTaint | $@ | summaries.rb:48:24:48:41 | call to source : | call to source : |
152+
| summaries.rb:51:6:51:31 | call to namedArg | summaries.rb:1:20:1:36 | call to source : | summaries.rb:51:6:51:31 | call to namedArg | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
153+
| summaries.rb:55:8:55:8 | x | summaries.rb:1:20:1:36 | call to source : | summaries.rb:55:8:55:8 | x | $@ | summaries.rb:1:20:1:36 | call to source : | call to source : |
154+
| summaries.rb:62:8:62:54 | call to preserveTaint | summaries.rb:62:24:62:53 | call to source : | summaries.rb:62:8:62:54 | call to preserveTaint | $@ | summaries.rb:62:24:62:53 | call to source : | call to source : |
155+
| summaries.rb:65:8:65:57 | call to preserveTaint | summaries.rb:65:26:65:56 | call to source : | summaries.rb:65:8:65:57 | call to preserveTaint | $@ | summaries.rb:65:26:65:56 | call to source : | call to source : |
4156
warning
5157
| CSV type row should have 5 columns but has 2: test;TooFewColumns |
6158
| CSV type row should have 5 columns but has 8: test;TooManyColumns;;;Member[Foo].Instance;too;many;columns |

‎ruby/ql/test/library-tests/dataflow/summaries/Summaries.ql

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import codeql.ruby.dataflow.internal.FlowSummaryImpl
99
import codeql.ruby.dataflow.internal.AccessPathSyntax
1010
import codeql.ruby.frameworks.data.ModelsAsData
1111
import TestUtilities.InlineFlowTest
12+
import DataFlow::PathGraph
1213

1314
query predicate invalidSpecComponent(SummarizedCallable sc, string s, string c) {
1415
(sc.propagatesFlowExt(s, _, _) or sc.propagatesFlowExt(_, s, _)) and
@@ -132,3 +133,7 @@ class CustomTaintSink extends DefaultTaintFlowConf {
132133
sink = ModelOutput::getASinkNode("test-sink").getARhs()
133134
}
134135
}
136+
137+
from DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Configuration conf
138+
where conf.hasFlowPath(source, sink)
139+
select sink, source, sink, "$@", source, source.toString()

0 commit comments

Comments
 (0)