rename runsImmediately to runsArbitraryCode

Author: erik-krogh

ruby/ql/lib/codeql/ruby/Concepts.qll

@@ -702,8 +702,8 @@ class CodeExecution extends DataFlow::Node instanceof CodeExecution::Range {
   /** Gets the argument that specifies the code to be executed. */
   DataFlow::Node getCode() { result = super.getCode() }
 
-  /** Holds if this execution immediately runs the input as code, as opposed to loading some code using the input as a "path". */
-  predicate runsImmediately() { super.runsImmediately() }
+  /** Holds if this execution runs arbitary code, as opposed to some restricted subset. E.g. `Object.send` will only run any method on an object. */
+  predicate runsArbitraryCode() { super.runsArbitraryCode() }
 }
 
 /** Provides a class for modeling new dynamic code execution APIs. */
@@ -718,8 +718,8 @@ module CodeExecution {
     /** Gets the argument that specifies the code to be executed. */
     abstract DataFlow::Node getCode();
 
-    /** Holds if this execution immediately runs the input as code, as opposed to loading some code using the input as a "path". */
-    predicate runsImmediately() { any() }
+    /** Holds if this execution runs arbitary code, as opposed to some restricted subset. E.g. `Object.send` will only run any method on an object. */
+    predicate runsArbitraryCode() { any() }
   }
 }
 

ruby/ql/lib/codeql/ruby/frameworks/ActiveJob.qll

@@ -26,7 +26,7 @@ module ActiveJob {
 
       override DataFlow::Node getCode() { result = this.getArgument(0) }
 
-      override predicate runsImmediately() { none() }
+      override predicate runsArbitraryCode() { none() }
     }
   }
 }

ruby/ql/lib/codeql/ruby/frameworks/ActiveStorage.qll

@@ -222,6 +222,6 @@ module ActiveStorage {
 
     override DataFlow::Node getCode() { result = this.getArgument(0) }
 
-    override predicate runsImmediately() { none() }
+    override predicate runsArbitraryCode() { none() }
   }
 }

ruby/ql/lib/codeql/ruby/frameworks/ActiveSupport.qll

@@ -36,7 +36,7 @@ module ActiveSupport {
 
         override DataFlow::Node getCode() { result = this.getReceiver() }
 
-        override predicate runsImmediately() { none() }
+        override predicate runsArbitraryCode() { none() }
       }
 
       /**

ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll

@@ -167,7 +167,7 @@ module Kernel {
 
     override DataFlow::Node getCode() { result = this.getArgument(0) }
 
-    override predicate runsImmediately() { none() }
+    override predicate runsArbitraryCode() { none() }
   }
 
   private class TapSummary extends SimpleSummarizedCallable {

ruby/ql/lib/codeql/ruby/frameworks/core/Module.qll

@@ -43,6 +43,6 @@ module Module {
 
     override DataFlow::Node getCode() { result = this.getArgument(0) }
 
-    override predicate runsImmediately() { none() }
+    override predicate runsArbitraryCode() { none() }
   }
 }

ruby/ql/lib/codeql/ruby/security/CodeInjectionCustomizations.qll

@@ -69,7 +69,7 @@ module CodeInjection {
 
     /** Gets a flow state for which this is a sink. */
     override DataFlow::FlowState getAFlowState() {
-      if c.runsImmediately()
+      if c.runsArbitraryCode()
       then result = [FlowState::substring(), FlowState::full()] // If it runs immediately, then it's always vulnerable.
       else result = FlowState::full() // If it "just" loads something, then it's only vulnerable if the attacker controls the entire string.
     }