Merge pull request #13068 from hvitved/ruby/type-tracking-flow-through

Ruby: Include `self` parameters in type tracking flow-through logic

Author: hvitved

ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll

@@ -940,6 +940,12 @@ private class NewCall extends DataFlowCall {
 abstract class ReturningNode extends Node {
   /** Gets the kind of this return node. */
   abstract ReturnKind getKind();
+
+  pragma[nomagic]
+  predicate hasKind(ReturnKind kind, CfgScope scope) {
+    kind = this.getKind() and
+    scope = this.(NodeImpl).getCfgScope()
+  }
 }
 
 /** A data-flow node that represents a value returned by a callable. */
@@ -1060,10 +1066,8 @@ private module ReturnNodes {
     SynthReturnNode() { this = TSynthReturnNode(scope, kind) }
 
     /** Gets a syntactic return node that flows into this synthetic node. */
-    ReturningNode getAnInput() {
-      result.(NodeImpl).getCfgScope() = scope and
-      result.getKind() = kind
-    }
+    pragma[nomagic]
+    ReturningNode getAnInput() { result.hasKind(kind, scope) }
 
     override ReturnKind getKind() { result = kind }
 

ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll

@@ -80,10 +80,8 @@ predicate jumpStep = DataFlowPrivate::jumpStep/2;
 pragma[nomagic]
 private predicate flowThrough(DataFlowPublic::ParameterNode param) {
   exists(DataFlowPrivate::ReturningNode returnNode, DataFlowDispatch::ReturnKind rk |
-    DataFlowPrivate::LocalFlow::getParameterDefNode(param.getParameter())
-        .(TypeTrackingNode)
-        .flowsTo(returnNode) and
-    rk = returnNode.getKind()
+    param.flowsTo(returnNode) and
+    returnNode.hasKind(rk, param.(DataFlowPrivate::NodeImpl).getCfgScope())
   |
     rk instanceof DataFlowDispatch::NormalReturnKind
     or

ruby/ql/test/library-tests/modules/ancestors.expected

@@ -94,64 +94,64 @@ calls.rb:
 #  325| C1
 #-----| super -> Object
 
-#  331| C2
+#  335| C2
 #-----| super -> C1
 
-#  337| C3
+#  341| C3
 #-----| super -> C2
 
-#  377| SingletonOverride1
+#  385| SingletonOverride1
 #-----| super -> Object
 
-#  412| SingletonOverride2
+#  420| SingletonOverride2
 #-----| super -> SingletonOverride1
 
-#  433| ConditionalInstanceMethods
+#  441| ConditionalInstanceMethods
 #-----| super -> Object
 
-#  496| ExtendSingletonMethod
+#  504| ExtendSingletonMethod
 
-#  506| ExtendSingletonMethod2
+#  514| ExtendSingletonMethod2
 
-#  512| ExtendSingletonMethod3
+#  520| ExtendSingletonMethod3
 
-#  525| ProtectedMethodInModule
+#  533| ProtectedMethodInModule
 
-#  531| ProtectedMethods
+#  539| ProtectedMethods
 #-----| super -> Object
 #-----| include -> ProtectedMethodInModule
 
-#  550| ProtectedMethodsSub
+#  558| ProtectedMethodsSub
 #-----| super -> ProtectedMethods
 
-#  564| SingletonUpCall_Base
+#  572| SingletonUpCall_Base
 #-----| super -> Object
 
-#  568| SingletonUpCall_Sub
+#  576| SingletonUpCall_Sub
 #-----| super -> SingletonUpCall_Base
 
-#  576| SingletonUpCall_SubSub
+#  584| SingletonUpCall_SubSub
 #-----| super -> SingletonUpCall_Sub
 
-#  583| SingletonA
+#  591| SingletonA
 #-----| super -> Object
 
-#  596| SingletonB
+#  604| SingletonB
 #-----| super -> SingletonA
 
-#  605| SingletonC
+#  613| SingletonC
 #-----| super -> SingletonA
 
-#  618| Included
+#  626| Included
 
-#  626| IncludesIncluded
+#  634| IncludesIncluded
 #-----| super -> Object
 #-----| include -> Included
 
-#  633| CustomNew1
+#  641| CustomNew1
 #-----| super -> Object
 
-#  641| CustomNew2
+#  649| CustomNew2
 #-----| super -> Object
 
 hello.rb:

ruby/ql/test/library-tests/modules/callgraph.expected

@@ -326,6 +326,10 @@ class C1
     def instance
         puts "C1#instance"
     end
+
+    def return_self
+        self
+    end
 end
 
 class C2 < C1
@@ -360,10 +364,13 @@ def pattern_dispatch x
 
 c1 = C1.new
 c1.instance
+
 pattern_dispatch (C1.new)
 pattern_dispatch (C2.new)
 pattern_dispatch (C3.new)
 
+C3.new.return_self.instance
+
 def add_singleton x
     def x.instance
         puts "instance_on x"
@@ -373,6 +380,7 @@ def x.instance
 c3 = C1.new
 add_singleton c3
 c3.instance
+c3.return_self.instance
 
 class SingletonOverride1
     class << self
@@ -649,3 +657,11 @@ def instance
 end
 
 CustomNew2.new.instance
+
+def capture_parameter x
+    [0,1,2].each do
+        x
+    end
+end
+
+(capture_parameter C1.new).instance # NoMethodError