Skip to content

Ruby: Generalize ArrayElementContent to ElementContent#7914

Merged
hvitved merged 3 commits into
github:mainfrom
hvitved:ruby/generalize-element-content
Apr 28, 2022
Merged

Ruby: Generalize ArrayElementContent to ElementContent#7914
hvitved merged 3 commits into
github:mainfrom
hvitved:ruby/generalize-element-content

Conversation

@hvitved

@hvitved hvitved commented Feb 9, 2022

Copy link
Copy Markdown
Contributor

The first commit generalizes ArrayElementContent to ElementContent, by generalising from integer indices TKnownArrayElementContent(int i) to arbitrary constant values TKnownElementContent(ConstantValue cv). This means that we will be able to precisely track e.g. stores into hashes with a known symbol key (but actually reading them back out will be done in a follow-up PR).

The second commit changes the Element token to Element[any], to be consistent with Argument tokens.

DCA reported one missing result for rb/request-forgery on diaspora, which turned out to be a false positive result that is now filtered away because of the added precision.

@github-actions github-actions Bot added the Ruby label Feb 9, 2022
@hvitved hvitved force-pushed the ruby/generalize-element-content branch 3 times, most recently from 735a84f to dc8ec62 Compare April 4, 2022 13:49
@hvitved hvitved force-pushed the ruby/generalize-element-content branch from dc8ec62 to c24b795 Compare April 4, 2022 17:50
@hvitved hvitved force-pushed the ruby/generalize-element-content branch from c24b795 to 83b541c Compare April 6, 2022 17:11
@hvitved hvitved force-pushed the ruby/generalize-element-content branch from 83b541c to e6d1ec0 Compare April 20, 2022 13:07
@github-actions github-actions Bot added the JS label Apr 20, 2022
@hvitved hvitved force-pushed the ruby/generalize-element-content branch 3 times, most recently from 48af30c to 34eaded Compare April 25, 2022 10:28
@hvitved hvitved marked this pull request as ready for review April 26, 2022 11:13
@hvitved hvitved requested a review from a team as a code owner April 26, 2022 11:13
@hvitved hvitved force-pushed the ruby/generalize-element-content branch from 34eaded to 790d977 Compare April 27, 2022 09:53

@nickrolfe nickrolfe left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good – just a couple of minor issues.

Note I didn't review the changes to Array.qll and array-flow.expected in detail, but I sampled a few of them randomly, and they looked fine.

Comment thread ruby/ql/lib/codeql/ruby/ast/Constant.qll
Comment thread ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll Outdated

@nickrolfe nickrolfe left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great!

@hvitved hvitved merged commit 8d2bf22 into github:main Apr 28, 2022
@hvitved hvitved deleted the ruby/generalize-element-content branch April 28, 2022 12:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-change-note-required This PR does not need a change note Ruby

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants