From ab2d6f762ecf26de1b556eb5d836f51a4c2063bc Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Wed, 5 Aug 2026 10:44:30 +0200 Subject: [PATCH 1/2] Ruby: Exclude vendored library parameters from taint sources. --- ruby/ql/lib/codeql/ruby/frameworks/core/Gem.qll | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/Gem.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/Gem.qll index f0e5725eef0d..5a7c65f3d88f 100644 --- a/ruby/ql/lib/codeql/ruby/frameworks/core/Gem.qll +++ b/ruby/ql/lib/codeql/ruby/frameworks/core/Gem.qll @@ -90,6 +90,9 @@ module Gem { result = this.getAPublicModule().getStmt(_).(SingletonClass) } + /** Holds if this gem is vendored in this codebase. */ + predicate isVendored() { File.super.getParentContainer+().getBaseName() = "vendor" } + /** Gets a parameter from an exported method, which is an input to this gem. */ DataFlow::ParameterNode getAnInputParameter() { exists(MethodBase method | @@ -107,6 +110,7 @@ module Gem { DataFlow::ParameterNode getALibraryInput() { exists(GemSpec spec | exists(spec.getName()) and // we only consider `.gemspec` files that have a name + not spec.isVendored() and // if the gem is vendored its parameters are not external inputs result = spec.getAnInputParameter() ) } From 1430dfe4b91ca386063049bd292040a784d3b357 Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Wed, 5 Aug 2026 10:58:26 +0200 Subject: [PATCH 2/2] Ruby: Add change note. --- ruby/ql/lib/change-notes/2026-08-05-vendored-lib-taint.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ruby/ql/lib/change-notes/2026-08-05-vendored-lib-taint.md diff --git a/ruby/ql/lib/change-notes/2026-08-05-vendored-lib-taint.md b/ruby/ql/lib/change-notes/2026-08-05-vendored-lib-taint.md new file mode 100644 index 000000000000..e5eab2447c30 --- /dev/null +++ b/ruby/ql/lib/change-notes/2026-08-05-vendored-lib-taint.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Removed library input to vendored gems from the set of taint sources. This should reduce false positives for `rb/polynomial-redos`, `rb/regex/badly-anchored-regexp`, `rb/unsafe-code-construction`, `rb/html-constructed-from-input`, and `rb/shell-command-constructed-from-input` whenever vendoring is used.