Merge pull request #8389 from hvitved/ruby/regex-unique-get-value

Ruby: Avoid multiple `RegExpEscape::getValue` results

Author: hvitved

ruby/ql/consistency-queries/RegExpConsistency.ql

@@ -12,3 +12,8 @@ query predicate nonConsecutive(RegExpParent parent, int i) {
   i > 0 and
   not exists(parent.getChild(i - 1))
 }
+
+query predicate regExpNormalNonUniqueCharValue(RegExpNormalChar term, string value) {
+  value = term.getValue() and
+  strictcount(term.getValue()) > 1
+}

ruby/ql/lib/codeql/ruby/security/performance/RegExpTreeView.qll

@@ -405,7 +405,9 @@ class RegExpEscape extends RegExpNormalChar {
     result = this.getUnicode()
   }
 
-  predicate isIdentityEscape() { not this.getUnescaped() in ["n", "r", "t"] }
+  predicate isIdentityEscape() {
+    not this.getUnescaped() in ["n", "r", "t"] and not this.isUnicode()
+  }
 
   /**
    * Gets the text for this escape. That is e.g. "\w".

ruby/ql/test/library-tests/regexp/parse.expected

@@ -485,3 +485,5 @@ regexp.rb:
 #   75| [RegExpNamedCharacterProperty] [:digit:]
 
 #   79| [RegExpConstant, RegExpNormalChar] abc
+
+#   82| [RegExpConstant, RegExpEscape] \u{987

ruby/ql/test/library-tests/regexp/regexp.expected

@@ -189,3 +189,85 @@ term
 | regexp.rb:72:17:72:17 | f | RegExpConstant,RegExpNormalChar |
 | regexp.rb:75:2:75:10 | [:digit:] | RegExpNamedCharacterProperty |
 | regexp.rb:79:2:79:4 | abc | RegExpConstant,RegExpNormalChar |
+| regexp.rb:82:2:82:7 | \\u{987 | RegExpConstant,RegExpEscape |
+regExpNormalCharValue
+| regexp.rb:5:2:5:4 | abc | abc |
+| regexp.rb:8:2:8:2 | a | a |
+| regexp.rb:8:4:8:4 | b | b |
+| regexp.rb:8:6:8:6 | c | c |
+| regexp.rb:8:8:8:8 | d | d |
+| regexp.rb:9:2:9:2 | a | a |
+| regexp.rb:10:2:10:2 | a | a |
+| regexp.rb:11:2:11:2 | a | a |
+| regexp.rb:12:2:12:2 | a | a |
+| regexp.rb:15:2:15:4 | foo | foo |
+| regexp.rb:15:6:15:8 | bar | bar |
+| regexp.rb:18:3:18:3 | a | a |
+| regexp.rb:18:4:18:4 | b | b |
+| regexp.rb:18:5:18:5 | c | c |
+| regexp.rb:19:3:19:3 | a | a |
+| regexp.rb:19:5:19:5 | f | f |
+| regexp.rb:19:6:19:6 | A | A |
+| regexp.rb:19:8:19:8 | F | F |
+| regexp.rb:19:9:19:9 | 0 | 0 |
+| regexp.rb:19:11:19:11 | 9 | 9 |
+| regexp.rb:19:12:19:12 | _ | _ |
+| regexp.rb:20:5:20:5 | + | + |
+| regexp.rb:20:6:20:6 | - | - |
+| regexp.rb:20:9:20:10 | \\d | d |
+| regexp.rb:21:3:21:4 | \\w | w |
+| regexp.rb:22:2:22:3 | \\[ | [ |
+| regexp.rb:22:4:22:5 | \\] | ] |
+| regexp.rb:22:7:22:7 | 1 | 1 |
+| regexp.rb:22:8:22:8 | 2 | 2 |
+| regexp.rb:22:9:22:9 | 3 | 3 |
+| regexp.rb:23:4:23:4 | A | A |
+| regexp.rb:23:6:23:6 | Z | Z |
+| regexp.rb:24:3:24:3 | ] | ] |
+| regexp.rb:25:4:25:4 | ] | ] |
+| regexp.rb:26:4:26:4 | - | - |
+| regexp.rb:27:3:27:3 | \| | \| |
+| regexp.rb:30:3:30:3 | [ | [ |
+| regexp.rb:30:4:30:4 | a | a |
+| regexp.rb:30:6:30:6 | f | f |
+| regexp.rb:30:8:30:11 | A-F] | A-F] |
+| regexp.rb:35:2:35:3 | \\w | w |
+| regexp.rb:35:5:35:6 | \\W | W |
+| regexp.rb:36:2:36:3 | \\s | s |
+| regexp.rb:36:4:36:5 | \\S | S |
+| regexp.rb:37:2:37:3 | \\d | d |
+| regexp.rb:37:4:37:5 | \\D | D |
+| regexp.rb:38:2:38:3 | \\h | h |
+| regexp.rb:38:4:38:5 | \\H | H |
+| regexp.rb:39:2:39:3 | \\n | \n |
+| regexp.rb:39:4:39:5 | \\r | \r |
+| regexp.rb:39:6:39:7 | \\t | \t |
+| regexp.rb:42:4:42:6 | abc | abc |
+| regexp.rb:43:4:43:5 | !a | !a |
+| regexp.rb:46:3:46:5 | foo | foo |
+| regexp.rb:46:8:46:10 | bar | bar |
+| regexp.rb:47:2:47:3 | fo | fo |
+| regexp.rb:47:5:47:5 | o | o |
+| regexp.rb:47:7:47:7 | b | b |
+| regexp.rb:47:9:47:10 | ar | ar |
+| regexp.rb:48:3:48:3 | a | a |
+| regexp.rb:48:5:48:5 | b | b |
+| regexp.rb:48:7:48:8 | cd | cd |
+| regexp.rb:48:10:48:10 | e | e |
+| regexp.rb:49:5:49:5 | : | : |
+| regexp.rb:49:8:49:9 | \\w | w |
+| regexp.rb:52:8:52:9 | \\w | w |
+| regexp.rb:53:9:53:9 | f | f |
+| regexp.rb:53:10:53:10 | o | o |
+| regexp.rb:56:3:56:3 | a | a |
+| regexp.rb:56:6:56:6 | b | b |
+| regexp.rb:57:9:57:9 | q | q |
+| regexp.rb:57:12:57:13 | \\s | s |
+| regexp.rb:63:3:63:3 | a | a |
+| regexp.rb:63:5:63:5 | f | f |
+| regexp.rb:72:3:72:3 | A | A |
+| regexp.rb:72:5:72:5 | F | F |
+| regexp.rb:72:15:72:15 | a | a |
+| regexp.rb:72:17:72:17 | f | f |
+| regexp.rb:79:2:79:4 | abc | abc |
+| regexp.rb:82:2:82:7 | \\u{987 | \u0987 |

ruby/ql/test/library-tests/regexp/regexp.ql

@@ -5,3 +5,7 @@ query predicate groupName(RegExpGroup g, string name) { name = g.getName() }
 query predicate groupNumber(RegExpGroup g, int number) { number = g.getNumber() }
 
 query predicate term(RegExpTerm term, string c) { c = term.getPrimaryQlClasses() }
+
+query predicate regExpNormalCharValue(RegExpNormalChar term, string value) {
+  value = term.getValue()
+}

ruby/ql/test/library-tests/regexp/regexp.rb

@@ -76,4 +76,7 @@
 
 # Simple constant interpolation
 A = "a"
-/#{A}bc/
+/#{A}bc/
+
+# unicode
+/\u{9879}/