Skip to content

Ruby: Data flow for hash-splat expressions in hash literals#9334

Merged
hvitved merged 1 commit into
github:mainfrom
hvitved:ruby/dataflow/hash-splat-literal
May 26, 2022
Merged

Ruby: Data flow for hash-splat expressions in hash literals#9334
hvitved merged 1 commit into
github:mainfrom
hvitved:ruby/dataflow/hash-splat-literal

Conversation

@hvitved
Copy link
Copy Markdown
Contributor

@hvitved hvitved commented May 25, 2022

Support for

hash1 = { :foo => taint }
hash = { :bar => no_taint, **hash1 }
sink(hash[:foo]} # bad
sink(hash[:bar]} # good

@github-actions github-actions Bot added the Ruby label May 25, 2022
@hvitved hvitved marked this pull request as ready for review May 25, 2022 18:39
@hvitved hvitved requested a review from a team as a code owner May 25, 2022 18:39
@hvitved hvitved added the no-change-note-required This PR does not need a change note label May 25, 2022
Copy link
Copy Markdown
Contributor

@hmac hmac left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

:e => 2,
:f => taint(45.4)
}
hash = { **hash1, :g => taint(45.5), **hash2, :h => 3 }
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should probably add some more tests to cover cases where some of the keys of hash1 and hash2 or the keyword arguments overlap. This can be done in a follow-up though.

@hvitved hvitved merged commit ae1f5bb into github:main May 26, 2022
@hvitved hvitved deleted the ruby/dataflow/hash-splat-literal branch May 26, 2022 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-change-note-required This PR does not need a change note Ruby

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants