Skip to content

Ruby: Exclude vendored library parameters from taint sources. #22282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aschackmull merged 2 commits into from
Aug 5, 2026
+8 −0
Merged

Ruby: Exclude vendored library parameters from taint sources. #22282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ab2d6f7
Ruby: Exclude vendored library parameters from taint sources.
aschackmull Aug 5, 2026
1430dfe
Ruby: Add change note.
aschackmull Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions ruby/ql/lib/change-notes/2026-08-05-vendored-lib-taint.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Removed library input to vendored gems from the set of taint sources. This should reduce false positives for `rb/polynomial-redos`, `rb/regex/badly-anchored-regexp`, `rb/unsafe-code-construction`, `rb/html-constructed-from-input`, and `rb/shell-command-constructed-from-input` whenever vendoring is used.
4 changes: 4 additions & 0 deletions ruby/ql/lib/codeql/ruby/frameworks/core/Gem.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,9 @@ module Gem {
result = this.getAPublicModule().getStmt(_).(SingletonClass)
}

/** Holds if this gem is vendored in this codebase. */
predicate isVendored() { File.super.getParentContainer+().getBaseName() = "vendor" }

/** Gets a parameter from an exported method, which is an input to this gem. */
DataFlow::ParameterNode getAnInputParameter() {
exists(MethodBase method |
Expand All @@ -107,6 +110,7 @@ module Gem {
DataFlow::ParameterNode getALibraryInput() {
exists(GemSpec spec |
exists(spec.getName()) and // we only consider `.gemspec` files that have a name
not spec.isVendored() and // if the gem is vendored its parameters are not external inputs
result = spec.getAnInputParameter()
)
}
Expand Down
Loading