From eb7cd3d221919d99fd8443c7b99d7eb160b2d1a5 Mon Sep 17 00:00:00 2001 From: Jonas Jensen Date: Wed, 30 Apr 2025 08:54:57 +0200 Subject: [PATCH] Ruby: disable diff-informed mode on regex queries These queries were failing in `codeql test run --check-diff-informed` because they can select locations inside the regex. Until that can be fixed, diff-informed mode is disabled for these queries. --- .../ruby/security/regexp/MissingFullAnchorQuery.qll | 10 ---------- .../ruby/security/regexp/PolynomialReDoSQuery.qll | 10 ---------- 2 files changed, 20 deletions(-) diff --git a/ruby/ql/lib/codeql/ruby/security/regexp/MissingFullAnchorQuery.qll b/ruby/ql/lib/codeql/ruby/security/regexp/MissingFullAnchorQuery.qll index d511c6f3fbf8..febfa0712d9b 100644 --- a/ruby/ql/lib/codeql/ruby/security/regexp/MissingFullAnchorQuery.qll +++ b/ruby/ql/lib/codeql/ruby/security/regexp/MissingFullAnchorQuery.qll @@ -17,16 +17,6 @@ private module MissingFullAnchorConfig implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sink instanceof Sink } predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer } - - predicate observeDiffInformedIncrementalMode() { any() } - - Location getASelectedSinkLocation(DataFlow::Node sink) { - result = sink.(Sink).getLocation() - or - result = sink.(Sink).getCallNode().getLocation() - or - result = sink.(Sink).getRegex().getLocation() - } } /** diff --git a/ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll b/ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll index 562b5dad37bf..98a42fcf5e7c 100644 --- a/ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll +++ b/ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll @@ -18,16 +18,6 @@ private module PolynomialReDoSConfig implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sink instanceof Sink } predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer } - - predicate observeDiffInformedIncrementalMode() { any() } - - Location getASelectedSinkLocation(DataFlow::Node sink) { - result = sink.(Sink).getLocation() - or - result = sink.(Sink).getHighlight().getLocation() - or - result = sink.(Sink).getRegExp().getLocation() - } } /**