Ruby: JSON flow summaries

[hmac]

Add flow summaries for ActiveSupport::JSON and various JSON methods. We consider JSON parsing and generation to be taint-preserving.

[alexrford]

There are a few instance methods for oj that look relevant for flow from the self arg to the return value, e.g. as_json, to_json etc: https://rubydoc.info/gems/oj/JSON/GenericObject Are these in scope for this PR - I recognize that there's probably a ton of potential methods to model that might not be used much in practice.

[alexrford]

Suggested change

	"json;;Member[JSON].Method[generate,fast_generate,dump,unparse,fast_unparse];Argument[0];ReturnValue;taint",
	"json;;Member[JSON].Method[generate,fast_generate,pretty_generate,dump,unparse,fast_unparse];Argument[0];ReturnValue;taint",

https://rubyapi.org/3.1/o/json#method-i-pretty_generate

[hmac]

👍 added

[hmac]

There are a few instance methods for oj that look relevant for flow from the self arg to the return value, e.g. as_json, to_json etc: https://rubydoc.info/gems/oj/JSON/GenericObject Are these in scope for this PR - I recognize that there's probably a ton of potential methods to model that might not be used much in practice.

That's a good question. As you say, there's a lot of potential methods we should model. My preference is to tackle the obvious low-hanging fruit here, and then tackle the various JSON gems in full later on, as part of general non-rails library modelling. What do you think?

[alexrford]

That's a good question. As you say, there's a lot of potential methods we should model. My preference is to tackle the obvious low-hanging fruit here, and then tackle the various JSON gems in full later on, as part of general non-rails library modelling. What do you think?

Sounds like a good approach.

[alexrford]

The tests need updating, but otherwise LGTM - I'll reapprove when the tests are fixed.