Skip to content

Commit f49507e

Browse files
hmachmac
committed
Ruby: Add note about WithElement usage
1 parent df398fb commit f49507e

File tree

4 files changed

+125
-1
lines changed

4 files changed

+125
-1
lines changed

‎ruby/ql/docs/flow_summaries.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,5 +255,22 @@ sink a[0]
255255
sink a[1] # $ hasValueFlow=1
256256
```
257257

258+
It is also important to note that in a summary such as
259+
260+
```ql
261+
input = "Argument[self].WithoutElement[0]" and
262+
output = "ReturnValue"
263+
```
264+
265+
if `Argument[self]` contains data, it will be copied to `ReturnValue`. If you only want to copy data in elements, and not in the container itself, add `WithElement[any]` to the input path:
266+
267+
```ql
268+
input = "Argument[self].WithoutElement[0].WithElement[any]" and
269+
output = "ReturnValue"
270+
```
271+
272+
See tests 53 and 54 for examples of this behaviour.
273+
274+
258275

259276
[^1]: I've chosen this name to avoid overloading the word "argument".

‎ruby/ql/test/library-tests/dataflow/flow-summaries/semantics.expected‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -868,6 +868,42 @@ edges
868868
| semantics.rb:496:9:496:15 | call to s53 [element :bar] : | semantics.rb:499:10:499:10 | x [element :bar] : |
869869
| semantics.rb:499:10:499:10 | x [element :bar] : | semantics.rb:499:10:499:16 | ...[...] |
870870
| semantics.rb:499:10:499:10 | x [element :bar] : | semantics.rb:499:10:499:16 | ...[...] |
871+
| semantics.rb:501:10:501:20 | call to source : | semantics.rb:501:10:501:26 | call to s53 |
872+
| semantics.rb:501:10:501:20 | call to source : | semantics.rb:501:10:501:26 | call to s53 |
873+
| semantics.rb:505:5:505:5 | [post] h [element :foo] : | semantics.rb:506:5:506:5 | h [element :foo] : |
874+
| semantics.rb:505:5:505:5 | [post] h [element :foo] : | semantics.rb:506:5:506:5 | h [element :foo] : |
875+
| semantics.rb:505:15:505:25 | call to source : | semantics.rb:505:5:505:5 | [post] h [element :foo] : |
876+
| semantics.rb:505:15:505:25 | call to source : | semantics.rb:505:5:505:5 | [post] h [element :foo] : |
877+
| semantics.rb:506:5:506:5 | [post] h [element :bar] : | semantics.rb:510:10:510:10 | h [element :bar] : |
878+
| semantics.rb:506:5:506:5 | [post] h [element :bar] : | semantics.rb:510:10:510:10 | h [element :bar] : |
879+
| semantics.rb:506:5:506:5 | [post] h [element :bar] : | semantics.rb:512:9:512:9 | h [element :bar] : |
880+
| semantics.rb:506:5:506:5 | [post] h [element :bar] : | semantics.rb:512:9:512:9 | h [element :bar] : |
881+
| semantics.rb:506:5:506:5 | [post] h [element :foo] : | semantics.rb:509:10:509:10 | h [element :foo] : |
882+
| semantics.rb:506:5:506:5 | [post] h [element :foo] : | semantics.rb:509:10:509:10 | h [element :foo] : |
883+
| semantics.rb:506:5:506:5 | h [element :foo] : | semantics.rb:506:5:506:5 | [post] h [element :foo] : |
884+
| semantics.rb:506:5:506:5 | h [element :foo] : | semantics.rb:506:5:506:5 | [post] h [element :foo] : |
885+
| semantics.rb:506:15:506:25 | call to source : | semantics.rb:506:5:506:5 | [post] h [element :bar] : |
886+
| semantics.rb:506:15:506:25 | call to source : | semantics.rb:506:5:506:5 | [post] h [element :bar] : |
887+
| semantics.rb:507:5:507:5 | [post] h [element] : | semantics.rb:509:10:509:10 | h [element] : |
888+
| semantics.rb:507:5:507:5 | [post] h [element] : | semantics.rb:509:10:509:10 | h [element] : |
889+
| semantics.rb:507:5:507:5 | [post] h [element] : | semantics.rb:510:10:510:10 | h [element] : |
890+
| semantics.rb:507:5:507:5 | [post] h [element] : | semantics.rb:510:10:510:10 | h [element] : |
891+
| semantics.rb:507:12:507:22 | call to source : | semantics.rb:507:5:507:5 | [post] h [element] : |
892+
| semantics.rb:507:12:507:22 | call to source : | semantics.rb:507:5:507:5 | [post] h [element] : |
893+
| semantics.rb:509:10:509:10 | h [element :foo] : | semantics.rb:509:10:509:16 | ...[...] |
894+
| semantics.rb:509:10:509:10 | h [element :foo] : | semantics.rb:509:10:509:16 | ...[...] |
895+
| semantics.rb:509:10:509:10 | h [element] : | semantics.rb:509:10:509:16 | ...[...] |
896+
| semantics.rb:509:10:509:10 | h [element] : | semantics.rb:509:10:509:16 | ...[...] |
897+
| semantics.rb:510:10:510:10 | h [element :bar] : | semantics.rb:510:10:510:16 | ...[...] |
898+
| semantics.rb:510:10:510:10 | h [element :bar] : | semantics.rb:510:10:510:16 | ...[...] |
899+
| semantics.rb:510:10:510:10 | h [element] : | semantics.rb:510:10:510:16 | ...[...] |
900+
| semantics.rb:510:10:510:10 | h [element] : | semantics.rb:510:10:510:16 | ...[...] |
901+
| semantics.rb:512:9:512:9 | h [element :bar] : | semantics.rb:512:9:512:15 | call to s54 [element :bar] : |
902+
| semantics.rb:512:9:512:9 | h [element :bar] : | semantics.rb:512:9:512:15 | call to s54 [element :bar] : |
903+
| semantics.rb:512:9:512:15 | call to s54 [element :bar] : | semantics.rb:515:10:515:10 | x [element :bar] : |
904+
| semantics.rb:512:9:512:15 | call to s54 [element :bar] : | semantics.rb:515:10:515:10 | x [element :bar] : |
905+
| semantics.rb:515:10:515:10 | x [element :bar] : | semantics.rb:515:10:515:16 | ...[...] |
906+
| semantics.rb:515:10:515:10 | x [element :bar] : | semantics.rb:515:10:515:16 | ...[...] |
871907
nodes
872908
| semantics.rb:2:9:2:18 | call to source : | semmle.label | call to source : |
873909
| semantics.rb:2:9:2:18 | call to source : | semmle.label | call to source : |
@@ -1820,4 +1856,44 @@ nodes
18201856
| semantics.rb:499:10:499:10 | x [element :bar] : | semmle.label | x [element :bar] : |
18211857
| semantics.rb:499:10:499:16 | ...[...] | semmle.label | ...[...] |
18221858
| semantics.rb:499:10:499:16 | ...[...] | semmle.label | ...[...] |
1859+
| semantics.rb:501:10:501:20 | call to source : | semmle.label | call to source : |
1860+
| semantics.rb:501:10:501:20 | call to source : | semmle.label | call to source : |
1861+
| semantics.rb:501:10:501:26 | call to s53 | semmle.label | call to s53 |
1862+
| semantics.rb:501:10:501:26 | call to s53 | semmle.label | call to s53 |
1863+
| semantics.rb:505:5:505:5 | [post] h [element :foo] : | semmle.label | [post] h [element :foo] : |
1864+
| semantics.rb:505:5:505:5 | [post] h [element :foo] : | semmle.label | [post] h [element :foo] : |
1865+
| semantics.rb:505:15:505:25 | call to source : | semmle.label | call to source : |
1866+
| semantics.rb:505:15:505:25 | call to source : | semmle.label | call to source : |
1867+
| semantics.rb:506:5:506:5 | [post] h [element :bar] : | semmle.label | [post] h [element :bar] : |
1868+
| semantics.rb:506:5:506:5 | [post] h [element :bar] : | semmle.label | [post] h [element :bar] : |
1869+
| semantics.rb:506:5:506:5 | [post] h [element :foo] : | semmle.label | [post] h [element :foo] : |
1870+
| semantics.rb:506:5:506:5 | [post] h [element :foo] : | semmle.label | [post] h [element :foo] : |
1871+
| semantics.rb:506:5:506:5 | h [element :foo] : | semmle.label | h [element :foo] : |
1872+
| semantics.rb:506:5:506:5 | h [element :foo] : | semmle.label | h [element :foo] : |
1873+
| semantics.rb:506:15:506:25 | call to source : | semmle.label | call to source : |
1874+
| semantics.rb:506:15:506:25 | call to source : | semmle.label | call to source : |
1875+
| semantics.rb:507:5:507:5 | [post] h [element] : | semmle.label | [post] h [element] : |
1876+
| semantics.rb:507:5:507:5 | [post] h [element] : | semmle.label | [post] h [element] : |
1877+
| semantics.rb:507:12:507:22 | call to source : | semmle.label | call to source : |
1878+
| semantics.rb:507:12:507:22 | call to source : | semmle.label | call to source : |
1879+
| semantics.rb:509:10:509:10 | h [element :foo] : | semmle.label | h [element :foo] : |
1880+
| semantics.rb:509:10:509:10 | h [element :foo] : | semmle.label | h [element :foo] : |
1881+
| semantics.rb:509:10:509:10 | h [element] : | semmle.label | h [element] : |
1882+
| semantics.rb:509:10:509:10 | h [element] : | semmle.label | h [element] : |
1883+
| semantics.rb:509:10:509:16 | ...[...] | semmle.label | ...[...] |
1884+
| semantics.rb:509:10:509:16 | ...[...] | semmle.label | ...[...] |
1885+
| semantics.rb:510:10:510:10 | h [element :bar] : | semmle.label | h [element :bar] : |
1886+
| semantics.rb:510:10:510:10 | h [element :bar] : | semmle.label | h [element :bar] : |
1887+
| semantics.rb:510:10:510:10 | h [element] : | semmle.label | h [element] : |
1888+
| semantics.rb:510:10:510:10 | h [element] : | semmle.label | h [element] : |
1889+
| semantics.rb:510:10:510:16 | ...[...] | semmle.label | ...[...] |
1890+
| semantics.rb:510:10:510:16 | ...[...] | semmle.label | ...[...] |
1891+
| semantics.rb:512:9:512:9 | h [element :bar] : | semmle.label | h [element :bar] : |
1892+
| semantics.rb:512:9:512:9 | h [element :bar] : | semmle.label | h [element :bar] : |
1893+
| semantics.rb:512:9:512:15 | call to s54 [element :bar] : | semmle.label | call to s54 [element :bar] : |
1894+
| semantics.rb:512:9:512:15 | call to s54 [element :bar] : | semmle.label | call to s54 [element :bar] : |
1895+
| semantics.rb:515:10:515:10 | x [element :bar] : | semmle.label | x [element :bar] : |
1896+
| semantics.rb:515:10:515:10 | x [element :bar] : | semmle.label | x [element :bar] : |
1897+
| semantics.rb:515:10:515:16 | ...[...] | semmle.label | ...[...] |
1898+
| semantics.rb:515:10:515:16 | ...[...] | semmle.label | ...[...] |
18231899
subpaths

‎ruby/ql/test/library-tests/dataflow/flow-summaries/semantics.ql‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -569,6 +569,19 @@ private class S53 extends Summary {
569569
S53() { this = "s53" }
570570

571571
override predicate propagates(string input, string output) {
572-
input = "Argument[self].WithoutElement[:foo]" and output = "ReturnValue"
572+
input = "Argument[self].WithoutElement[:foo]" and
573+
output = "ReturnValue"
574+
}
575+
}
576+
577+
/**
578+
* `WithoutElement` 11
579+
*/
580+
private class S54 extends Summary {
581+
S54() { this = "s54" }
582+
583+
override predicate propagates(string input, string output) {
584+
input = "Argument[self].WithoutElement[:foo].WithElement[any]" and
585+
output = "ReturnValue"
573586
}
574587
}

‎ruby/ql/test/library-tests/dataflow/flow-summaries/semantics.rb‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -497,4 +497,22 @@ def m53(i, h)
497497

498498
sink x[:foo]
499499
sink x[:bar] # $ hasValueFlow=b
500+
501+
sink(source("d").s53()) # $ hasValueFlow=d
502+
end
503+
504+
def m54(i, h)
505+
h[:foo] = source("a")
506+
h[:bar] = source("b")
507+
h[i] = source("c")
508+
509+
sink h[:foo] # $ hasValueFlow=a hasValueFlow=c
510+
sink h[:bar] # $ hasValueFlow=b hasValueFlow=c
511+
512+
x = h.s54()
513+
514+
sink x[:foo]
515+
sink x[:bar] # $ hasValueFlow=b
516+
517+
sink(source("d").s54())
500518
end

0 commit comments

Comments
 (0)