Merge pull request #10714 from hvitved/ruby/initialize

Ruby: Model flow through `initialize` constructors

Author: hvitved

ruby/ql/lib/change-notes/2022-12-14-constructor-flow.md

@@ -0,0 +1,14 @@
+---
+ category: majorAnalysis
+---
+ * Flow through `initialize` constructors is now taken into account. For example, in
+ ```rb
+class C
+  def initialize(x)
+    @field = x
+  end
+end
+
+C.new(y)
+```
+there will be flow from `y` to the field `@field` on the constructed `C` object.

ruby/ql/lib/codeql/ruby/ast/Call.qll

@@ -53,9 +53,12 @@ class Call extends Expr instanceof CallImpl {
 
   /** Gets a potential target of this call, if any. */
   final Callable getATarget() {
-    exists(DataFlowCall c | this = c.asCall().getExpr() |
-      TCfgScope(result) = [viableCallable(c), viableCallableLambda(c, _)]
+    exists(DataFlowCall c |
+      this = c.asCall().getExpr() and
+      TCfgScope(result) = viableCallableLambda(c, _)
     )
+    or
+    result = getTarget(this.getAControlFlowNode())
   }
 
   override AstNode getAChild(string pred) {