Ruby: Add Unsafe HMAC Comparison Query.

[boveus]

Hi CodeQL Team,

This adds an experimental query to detect potential Timing Attacks against usages of Ruby HMACs. This rule is partially inspired by the Python one.

The False positive rate seems fairly low on this query, but I did notice a large string of false positives in the Ruby repository after I ran this query against the top 1000 repositories in GitHub. Because I am unsure of why there are so many FP results in that repo, I figured it would be best to have this be an experimental query.

[alexrford]

Just some style/formatting comments, I haven't reviewed the results much yet but I'll do that next week.

[alexrford]

We're moving away from extending DataFlow::Configuration and instead towards implementing the DataFlow::ConfigSig module. This would look something like:

private module UnsafeHmacComparison {
  private module Config implements DataFlow::ConfigSig {
    predicate isSource(DataFlow::Node source) {
      source instanceof OpenSslHmacHexdigest or
      source instanceof OpenSslnewHmac or
      source instanceof OpenSslHmacbase64digest or
      source instanceof OpenSslHmacdigest or
      source instanceof OpenSslHmactos
    }

    // Holds if a given sink is an Equality Operation (== or !=)
    predicate isSink(DataFlow::Node sink) {
      exists(EqualityOperation eqOp |
        eqOp.getLeftOperand() = sink.asExpr().getExpr()
        or
        eqOp.getRightOperand() = sink.asExpr().getExpr()
      )
    }
  }

  import DataFlow::Global<Config>
}

and then

from UnsafeHmacComparison::PathNode source, UnsafeHmacComparison::PathNode sink
where UnsafeHmacComparison::flowPath(source, sink)

in the query itself.

There aren't that many Ruby examples yet, but rb/xpath-injection uses this format.

[boveus]

Thanks - will this pattern end up being deprecated at some point? We currently use this in one of our internal query packs.

[boveus]

@alexrford - I am getting a compilation error with this query. Could you give me a hand getting it resolved? Thanks.