[ruby] Constant propagation ignores side-effects on string object

[IagoAbal]

Describe the bug
Constant propagation incorrectly flags a variable as constant after it has been modified by a method call.

To Reproduce
https://semgrep.dev/s/4y19/

Expected behavior
No false positives.

What is the priority of the bug to you?

• P0: blocking your adoption of Semgrep or workflow
• P1: important to fix or quite annoying
• P2: regular bug that should get fixed

Environment
If not using semgrep.dev: are you running off docker, an official binary, a local build?

[IagoAbal]

Some amount of false positives of this kind are expected since we only do intra-procedural analysis, and if we assume that anything can alter the value of a variable then we would also miss many true positives. But in this particular case I think the intention to modify the variable is clear and we should handle it.

[IagoAbal]

Actually this is mainly due to AST-to-IL not recognizing a call to the concat method as the Concat operation.

[stale]

This issue is being marked stale because there hasn't been any activity in 30 days. Please leave a comment if you think this issue is still relevant and should be prioritized, otherwise it will be automatically closed in 7 days (you can always reopen it later).

[emjin]

@mmcqd Might be a good issue for you