@@ -506,25 +506,25 @@ private module ParamsSummaries {
506506 ]
507507 }
508508
509- /** Gets a field of an instance of `ActionController::Parameters` */
510- private DataFlow:: LocalSourceNode paramsField ( ) {
509+ /** Gets a node that may be tainted from an `ActionController::Parameters` instance, through field accesses and hash/array element reads. */
510+ private DataFlow:: LocalSourceNode taintFromParamsBase ( ) {
511511 result =
512512 [
513513 paramsInstance ( ) ,
514514 paramsInstance ( ) .getAMethodCall ( methodReturnsTaintFromSelf ( ) ) .getAnElementRead * ( )
515515 ]
516516 }
517517
518- private DataFlow:: LocalSourceNode paramsFieldType ( TypeTracker t ) {
518+ private DataFlow:: LocalSourceNode taintFromParamsType ( TypeTracker t ) {
519519 t .start ( ) and
520- result = paramsField ( )
520+ result = taintFromParamsBase ( )
521521 or
522- exists ( TypeTracker t2 | result = paramsFieldType ( t2 ) .track ( t2 , t ) )
522+ exists ( TypeTracker t2 | result = taintFromParamsType ( t2 ) .track ( t2 , t ) )
523523 }
524524
525- /** Gets a node with a type that can be a field of `ActionController::Parameters` */
526- private DataFlow:: LocalSourceNode paramsFieldType ( ) {
527- paramsFieldType ( TypeTracker:: end ( ) ) .flowsTo ( result )
525+ /** Gets a node with a type that may be tainted from an `ActionController::Parameters` instance. */
526+ private DataFlow:: LocalSourceNode taintFromParamsType ( ) {
527+ taintFromParamsType ( TypeTracker:: end ( ) ) .flowsTo ( result )
528528 }
529529
530530 /**
@@ -602,7 +602,7 @@ private module ParamsSummaries {
602602
603603 override MethodCall getACall ( ) {
604604 result =
605- paramsFieldType ( )
605+ taintFromParamsType ( )
606606 .getAMethodCall ( [ "original_filename" , "content_type" , "headers" ] )
607607 .asExpr ( )
608608 .getExpr ( ) and
@@ -622,7 +622,7 @@ private module ParamsSummaries {
622622 UploadedFileReadSummary ( ) { this = "ActionDispatch::Http::UploadedFile#read" }
623623
624624 override MethodCall getACall ( ) {
625- result = paramsFieldType ( ) .getAMethodCall ( "read" ) .asExpr ( ) .getExpr ( ) and
625+ result = taintFromParamsType ( ) .getAMethodCall ( "read" ) .asExpr ( ) .getExpr ( ) and
626626 result .getNumberOfArguments ( ) in [ 0 .. 2 ]
627627 }
628628
0 commit comments