Skip to content

Commit 528ef0e

Browse files
committed
Ruby: Use separate dataflow copy for HTTP client libs
As discussed with @hvitved offline. This helps out to ensrue we don't needlessly evaluate dataflow for configurations that are not needed anyway. That is, if other library modeling also used the same dataflow configuration, which ends up being used in query A, then dataflow for all the `DataFlowImplForLibraries` configurations would be computeted at once. When we get to evaluate the query `RequestWithoutValidation.ql` these results mgith have been forgotten since the predicates are not cached, and everything will have to be computeted again. In principle we could be added a dataflow copy for each framework. However, since we know that the `disablesCertificateValidation` member-predicates for all the HTTP client libraries will all be used at the same time, and only for the one query, we only add ONE additional copy. Note that the only use of `DataFlowImplForLibraries` before this PR is using `tainttrackingforlibraries.TaintTrackingImpl` (based on DataFlowImplForLibraries) for regex computation. https://github.com/github/codeql/blob/c904ba1d160298df731ba24760b14b209ed6c977/ruby/ql/lib/codeql/ruby/Regexp.qll#L153 Since this is currently transitively imported from Frameworks.qll (through Core.qll, and core/String.qll), the previous approach didn't actually violate the assumption about all configurations always being in scope, but it might have been more by accident, than by purpose.
1 parent 25d09cd commit 528ef0e

File tree

10 files changed

+4469
-18
lines changed

10 files changed

+4469
-18
lines changed

config/identical-files.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll",
3131
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll",
3232
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForLibraries.qll",
33+
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForHttpClientLibraries.qll",
3334
"swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl.qll"
3435
],
3536
"DataFlow Java/C++/C#/Python Common": [

0 commit comments

Comments
 (0)