Ruby: add RequestInputAccess#getKind predicate

alexrford · alexrford · commit 71670a4f75ad · 2022-10-05T13:38:31.000+01:00
diff --git a/ruby/ql/lib/codeql/ruby/Concepts.qll b/ruby/ql/lib/codeql/ruby/Concepts.qll
@@ -314,6 +314,14 @@ module Http {
        * This is typically the name of the method that gives rise to this input.
        */
       string getSourceType() { result = super.getSourceType() }
+
+      /**
+       * Gets the kind of the accessed input,
+       * Can be one of "parameter", "header", "body", "url", "cookie".
+       *
+       * Note that this predicate is functional.
+       */
+      string getKind() { result = super.getKind() }
     }
 
     /** Provides a class for modeling new HTTP request inputs. */
@@ -331,6 +339,14 @@ module Http {
          * This is typically the name of the method that gives rise to this input.
          */
         abstract string getSourceType();
+
+        /**
+         * Gets the kind of the accessed input,
+         * Can be one of "parameter", "header", "body", "url", "cookie".
+         *
+         * Note that this predicate is functional.
+         */
+        abstract string getKind();
       }
     }
 
@@ -411,6 +427,8 @@ module Http {
       RoutedParameter() { this.getParameter() = handler.getARoutedParameter() }
 
       override string getSourceType() { result = handler.getFramework() + " RoutedParameter" }
+
+      override string getKind() { result = "url" }
     }
 
     /**
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
@@ -141,6 +141,8 @@ class ParamsSource extends Http::Server::RequestInputAccess::Range {
   ParamsSource() { this.asExpr().getExpr() instanceof Rails::ParamsCall }
 
   override string getSourceType() { result = "ActionController::Metal#params" }
+
+  override string getKind() { result = "parameter" }
 }
 
 /**
@@ -151,6 +153,8 @@ class CookiesSource extends Http::Server::RequestInputAccess::Range {
   CookiesSource() { this.asExpr().getExpr() instanceof Rails::CookiesCall }
 
   override string getSourceType() { result = "ActionController::Metal#cookies" }
+
+  override string getKind() { result = "cookie" }
 }
 
 /** A call to `cookies` from within a controller. */
diff --git a/ruby/ql/lib/codeql/ruby/security/SensitiveGetQueryCustomizations.qll b/ruby/ql/lib/codeql/ruby/security/SensitiveGetQueryCustomizations.qll
@@ -33,7 +33,7 @@ module SensitiveGetQuery {
     RequestInputAccessSource() {
       handler = this.asExpr().getExpr().getEnclosingMethod() and
       handler.getAnHttpMethod() = "get" and
-      this.getSourceType().matches(["%params%", "%parameters%"])
+      this.getKind() = "parameter"
     }
 
     override Http::Server::RequestHandler getHandler() { result = handler }

Original file line number	Diff line number	Diff line change
`@@ -141,6 +141,8 @@ class ParamsSource extends Http::Server::RequestInputAccess::Range {`
`141`	`141`	`ParamsSource() { this.asExpr().getExpr() instanceof Rails::ParamsCall }`
`142`	`142`
`143`	`143`	`override string getSourceType() { result = "ActionController::Metal#params" }`
	`144`	`+`
	`145`	`+ override string getKind() { result = "parameter" }`
`144`	`146`	`}`
`145`	`147`
`146`	`148`	`/**`
`@@ -151,6 +153,8 @@ class CookiesSource extends Http::Server::RequestInputAccess::Range {`
`151`	`153`	`CookiesSource() { this.asExpr().getExpr() instanceof Rails::CookiesCall }`
`152`	`154`
`153`	`155`	`override string getSourceType() { result = "ActionController::Metal#cookies" }`
	`156`	`+`
	`157`	`+ override string getKind() { result = "cookie" }`
`154`	`158`	`}`
`155`	`159`
`156`	`160`	/** A call to `cookies` from within a controller. */
Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ module SensitiveGetQuery {`
`33`	`33`	`RequestInputAccessSource() {`
`34`	`34`	`handler = this.asExpr().getExpr().getEnclosingMethod() and`
`35`	`35`	`handler.getAnHttpMethod() = "get" and`
`36`		`- this.getSourceType().matches(["%params%", "%parameters%"])`
	`36`	`+ this.getKind() = "parameter"`
`37`	`37`	`}`
`38`	`38`
`39`	`39`	`override Http::Server::RequestHandler getHandler() { result = handler }`