Ruby/WeakFilePermissions

d10c · d10c · commit a7f7d1f09818 · 2025-10-14T14:24:40.000+02:00
diff --git a/ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql b/ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql
@@ -60,8 +60,9 @@ private module PermissivePermissionsConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(FileSystemPermissionModification mod |
-      sinkDef(sink, mod) and
+    exists(FileSystemPermissionModification mod | sinkDef(sink, mod) |
+      result = sink.getLocation()
+      or
       result = mod.getLocation()
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -60,8 +60,9 @@ private module PermissivePermissionsConfig implements DataFlow::ConfigSig {`
`60`	`60`	`predicate observeDiffInformedIncrementalMode() { any() }`
`61`	`61`
`62`	`62`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
`63`		`- exists(FileSystemPermissionModification mod \|`
`64`		`- sinkDef(sink, mod) and`
	`63`	`+ exists(FileSystemPermissionModification mod \| sinkDef(sink, mod) \|`
	`64`	`+ result = sink.getLocation()`
	`65`	`+ or`
`65`	`66`	`result = mod.getLocation()`
`66`	`67`	`)`
`67`	`68`	`}`