Ruby: configsig rb/http-to-file-access

alexrford · alexrford · commit e77ba1589663 · 2023-08-31T16:30:22.000+01:00
diff --git a/ruby/ql/lib/codeql/ruby/security/HttpToFileAccessQuery.qll b/ruby/ql/lib/codeql/ruby/security/HttpToFileAccessQuery.qll
@@ -2,16 +2,18 @@
  * Provides a taint tracking configuration for reasoning about writing user-controlled data to files.
  *
  * Note, for performance reasons: only import this file if
- * `HttpToFileAccess::Configuration` is needed, otherwise
+ * `HttpToFileAccessFlow` is needed, otherwise
  * `HttpToFileAccessCustomizations` should be imported instead.
  */
 
 private import HttpToFileAccessCustomizations::HttpToFileAccess
 
 /**
  * A taint tracking configuration for writing user-controlled data to files.
+ *
+ * DEPRECATED: Use `HttpToFileAccessFlow` instead
  */
-class Configuration extends TaintTracking::Configuration {
+deprecated class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "HttpToFileAccess" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -23,3 +25,16 @@ class Configuration extends TaintTracking::Configuration {
     node instanceof Sanitizer
   }
 }
+
+private module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+  predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+}
+
+/**
+ * Taint-tracking for writing user-controlled data to files.
+ */
+module HttpToFileAccessFlow = TaintTracking::Global<Config>;
diff --git a/ruby/ql/src/queries/security/cwe-912/HttpToFileAccess.ql b/ruby/ql/src/queries/security/cwe-912/HttpToFileAccess.ql
@@ -12,11 +12,10 @@
  */
 
 import codeql.ruby.AST
-import codeql.ruby.DataFlow
-import codeql.ruby.DataFlow::DataFlow::PathGraph
 import codeql.ruby.security.HttpToFileAccessQuery
+import HttpToFileAccessFlow::PathGraph
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
-where cfg.hasFlowPath(source, sink)
+from HttpToFileAccessFlow::PathNode source, HttpToFileAccessFlow::PathNode sink
+where HttpToFileAccessFlow::flowPath(source, sink)
 select sink.getNode(), source, sink, "Write to file system depends on $@.", source.getNode(),
   "untrusted data"
