Ruby: Allow dispatch to all library models.

github · Feb 22, 2024 · 15a07b2 · 15a07b2
1 parent 48c8eac
commit 15a07b2
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 0 deletions.
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplSpecific.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplSpecific.qll
@@ -31,4 +31,6 @@ module RubyDataFlow implements InputSig {
   predicate mayBenefitFromCallContext = Private::mayBenefitFromCallContext/1;
 
   predicate viableImplInCallContext = Private::viableImplInCallContext/2;
+
+  predicate ignoreFieldFlowBranchLimit(DataFlowCallable c) { exists(c.asLibraryCallable()) }
 }
diff --git a/shared/dataflow/codeql/dataflow/DataFlow.qll b/shared/dataflow/codeql/dataflow/DataFlow.qll
@@ -273,6 +273,9 @@ signature module InputSig {
   ) {
     any()
   }
+
+  /** Holds if `fieldFlowBranchLimit` should be ignored for flow going into/out of `c`. */
+  default predicate ignoreFieldFlowBranchLimit(DataFlowCallable c) { none() }
 }
 
 module Configs<InputSig Lang> {

diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
@@ -1197,6 +1197,8 @@ module MakeImpl<InputSig Lang> {
         j > 0 and
         if j <= Config::fieldFlowBranchLimit()
 
+        or ignoreFieldFlowBranchLimit(ret.getEnclosingCallable())
+
       // exists(int b, int j |
       //   b = branch(ret) and
       //   j = join(out) and
@@ -1294,6 +1296,7 @@ module MakeImpl<InputSig Lang> {
         b = branch(arg) and
         j = join(p) and
         if b.minimum(j) <= Config::fieldFlowBranchLimit()
+        or ignoreFieldFlowBranchLimit(p.getEnclosingCallable())
         then allowsFieldFlow = true
         else allowsFieldFlow = false
       )
-Original file line number
+Diff line change
@@ Expand Up / @@ -273,6 +273,9 @@ signature module InputSig { @@
       ) {
         any()
       }
+      /** Holds if `fieldFlowBranchLimit` should be ignored for flow going into/out of `c`. */
+      default predicate ignoreFieldFlowBranchLimit(DataFlowCallable c) { none() }
     }
     module Configs<InputSig Lang> {
@@ Expand Down @@