Ruby: simplify Twirp model

Author: asgerf

ruby/ql/lib/codeql/ruby/frameworks/Twirp.qll

@@ -16,7 +16,7 @@ module Twirp {
   /**
    * A Twirp service instantiation
    */
-  class ServiceInstantiation extends DataFlow::CallNode {
+  deprecated class ServiceInstantiation extends DataFlow::CallNode {
     ServiceInstantiation() {
       this = API::getTopLevelMember("Twirp").getMember("Service").getAnInstantiation()
     }
@@ -37,23 +37,33 @@ module Twirp {
   /**
    * A Twirp client
    */
-  class ClientInstantiation extends DataFlow::CallNode {
+  deprecated class ClientInstantiation extends DataFlow::CallNode {
     ClientInstantiation() {
       this = API::getTopLevelMember("Twirp").getMember("Client").getAnInstantiation()
     }
   }
 
   /** The URL of a Twirp service, considered as a sink. */
   class ServiceUrlAsSsrfSink extends ServerSideRequestForgery::Sink {
-    ServiceUrlAsSsrfSink() { exists(ClientInstantiation c | c.getArgument(0) = this) }
+    ServiceUrlAsSsrfSink() {
+      this =
+        API::getTopLevelMember("Twirp").getMember("Client").getMethod("new").getArgument(0).asSink()
+    }
   }
 
   /** A parameter that will receive parts of the url when handling an incoming request. */
   class UnmarshaledParameter extends Http::Server::RequestInputAccess::Range,
     DataFlow::ParameterNode
   {
     UnmarshaledParameter() {
-      this = any(ServiceInstantiation i).getAHandlerMethodNode().getParameter(0)
+      this =
+        API::getTopLevelMember("Twirp")
+            .getMember("Service")
+            .getMethod("new")
+            .getArgument(0)
+            .getMethod(_)
+            .getParameter(0)
+            .asSource()
     }
 
     override string getSourceType() { result = "Twirp Unmarhaled Parameter" }

ruby/ql/test/library-tests/frameworks/Twirp/Twirp.ql

@@ -5,4 +5,4 @@ query predicate sourceTest(Twirp::UnmarshaledParameter source) { any() }
 
 query predicate ssrfSinkTest(Twirp::ServiceUrlAsSsrfSink sink) { any() }
 
-query predicate serviceInstantiationTest(Twirp::ServiceInstantiation si) { any() }
+deprecated query predicate serviceInstantiationTest(Twirp::ServiceInstantiation si) { any() }