Ruby: avoid toString in query warning

Author: alexrford

ruby/ql/lib/codeql/ruby/security/CodeInjectionCustomizations.qll

@@ -31,7 +31,12 @@ module CodeInjection {
 
     /** Flow states used to distinguish whether an attacker controls the entire string. */
     class State extends TState {
-      string toString() {
+      string toString() { result = this.getStringRepresentation() }
+
+      /**
+       * Gets a canonical string representation of this state.
+       */
+      string getStringRepresentation() {
         this = TSubString() and result = "substring"
         or
         this = TFull() and result = "full"

ruby/ql/src/queries/security/cwe-094/CodeInjection.ql

@@ -29,7 +29,7 @@ where
         otherSink) and
       otherSink.getNode() = sink.getNode()
     |
-      otherSink order by otherSink.getState().toString()
+      otherSink order by otherSink.getState().getStringRepresentation()
     )
 select sink.getNode(), source, sink, "This code execution depends on a $@.", sourceNode,
   "user-provided value"