Ruby: Fix StringSubstitutionCall charpred

Some missing parens meant this class targeted way more things than intended.
github · May 1, 2024 · f7fc2e0 · f7fc2e0
1 parent 397e641
commit f7fc2e0
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/String.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/String.qll
@@ -19,9 +19,11 @@ class StringSubstitutionCall extends DataFlow::CallNode {
   StringSubstitutionCall() {
     this.getMethodName() = ["sub", "sub!", "gsub", "gsub!"] and
     exists(this.getReceiver()) and
-    this.getNumberOfArguments() = 2
-    or
-    this.getNumberOfArguments() = 1 and exists(this.getBlock())
+    (
+      this.getNumberOfArguments() = 2
+      or
+      this.getNumberOfArguments() = 1 and exists(this.getBlock())
+    )
   }
 
   /**

diff --git a/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/tst.rb b/ruby/ql/test/query-tests/security/cwe-116/IncompleteSanitization/tst.rb
@@ -268,3 +268,8 @@ def bad_path_sanitizer(p1, p2)
   p1.sub! "/../", "" # NOT OK
   p2.sub  "/../", "" # NOT OK
 end
+
+def each_line_sanitizer(p1)
+  p1.each_line("\n") do |l| # OK - does no sanitization
+  end
+end