Merge pull request #18337 from asgerf/rb/diff-informed

Ruby: enable diff-informed data flow queries

Author: asgerf

ruby/ql/lib/codeql/ruby/experimental/UnicodeBypassValidationQuery.qll

@@ -158,6 +158,8 @@ private module UnicodeBypassValidationConfig implements DataFlow::StateConfigSig
     ) and
     state = PostValidationState()
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /**

ruby/ql/lib/codeql/ruby/experimental/ZipSlipQuery.qll

@@ -29,6 +29,8 @@ private module ZipSlipConfig implements DataFlow::ConfigSig {
   }
 
   predicate isBarrier(DataFlow::Node node) { node instanceof ZipSlip::Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /**

ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll

@@ -118,6 +118,10 @@ private module ExconDisablesCertificateValidationConfig implements DataFlow::Con
   predicate isSink(DataFlow::Node sink) {
     sink = any(ExconHttpRequest req).getCertificateValidationControllingValue()
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // Used for a library model
+  }
 }
 
 private module ExconDisablesCertificateValidationFlow =

ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll

@@ -99,6 +99,10 @@ private module FaradayDisablesCertificateValidationConfig implements DataFlow::S
   predicate isSink(DataFlow::Node sink, FlowState state) {
     sink = any(FaradayHttpRequest req).getCertificateValidationControllingValue(state)
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // Used for a library model
+  }
 }
 
 private module FaradayDisablesCertificateValidationFlow =

ruby/ql/lib/codeql/ruby/frameworks/http_clients/HttpClient.qll

@@ -80,6 +80,10 @@ private module HttpClientDisablesCertificateValidationConfig implements DataFlow
   predicate isSink(DataFlow::Node sink) {
     sink = any(HttpClientRequest req).getCertificateValidationControllingValue()
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // Used for a library model
+  }
 }
 
 private module HttpClientDisablesCertificateValidationFlow =

ruby/ql/lib/codeql/ruby/frameworks/http_clients/Httparty.qll

@@ -70,6 +70,10 @@ private module HttpartyDisablesCertificateValidationConfig implements DataFlow::
   predicate isSink(DataFlow::Node sink) {
     sink = any(HttpartyRequest req).getCertificateValidationControllingValue()
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // Used for a library model
+  }
 }
 
 private module HttpartyDisablesCertificateValidationFlow =

ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll

@@ -103,6 +103,10 @@ private module NetHttpDisablesCertificateValidationConfig implements DataFlow::C
   predicate isSink(DataFlow::Node sink) {
     sink = any(NetHttpRequest req).getCertificateValidationControllingValue()
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // Used for a library model
+  }
 }
 
 private module NetHttpDisablesCertificateValidationFlow =

ruby/ql/lib/codeql/ruby/frameworks/http_clients/OpenURI.qll

@@ -110,6 +110,10 @@ private module OpenUriDisablesCertificateValidationConfig implements DataFlow::C
     or
     sink = any(OpenUriKernelOpenRequest req).getCertificateValidationControllingValue()
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // Used for a library model
+  }
 }
 
 private module OpenUriDisablesCertificateValidationFlow =

ruby/ql/lib/codeql/ruby/frameworks/http_clients/RestClient.qll

@@ -73,6 +73,10 @@ private module RestClientDisablesCertificateValidationConfig implements DataFlow
   predicate isSink(DataFlow::Node sink) {
     sink = any(RestClientHttpRequest req).getCertificateValidationControllingValue()
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // Used for a library model
+  }
 }
 
 private module RestClientDisablesCertificateValidationFlow =

ruby/ql/lib/codeql/ruby/frameworks/http_clients/Typhoeus.qll

@@ -64,6 +64,10 @@ private module TyphoeusDisablesCertificateValidationConfig implements DataFlow::
   predicate isSink(DataFlow::Node sink) {
     sink = any(TyphoeusHttpRequest req).getCertificateValidationControllingValue()
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // Used for a library model
+  }
 }
 
 private module TyphoeusDisablesCertificateValidationFlow =