Ruby: Track flow into ActiveRecord scopes

[hmac]

Track flow into ActiveRecord scopes, e.g.

class User < ApplicationRecord
  scope :with_role, ->(role) { where("role = #{role}") } #(3)
end

class UsersController < ApplicationController
  def show
    role = params[:role] # (1)
    @users = User.with_role(role) # (2)
  end
end

We will track flow from role assigned in (1), through the call to with_role (2) which targets the lambda at (3). We do this by adding an additional call step.

Also add a few missing flow summaries for Hash.

[hvitved]

LGTM, a couple of questions.

[hvitved]

Couldn't this result in incorrect flow, such as sink({:a => taint}.keys[0])? It would probably be better to just have input = Argument[self] and output = ReturnValue.Element[?] and preservesValue = false.

[hmac]

Yes, admittedly it is a broad summary. I will change it

[hvitved]

Isn't keys an array of all the keys in h?

[hmac]

Yes sorry this should be sink(keys[some_index()]) I think

[hvitved]

But none of the keys are tainted, right? So perhaps instead of h[f()] = taint(55.1) you meant e.g. h[taint(55.1)] = nil?

[hmac]

Yes that it also true, but I believe we don't yet track taint in Hash keys anyway, so this is a bit of an approximation. Given the change to the summary you suggested, I've changed the test to just taint the whole hash:

h = taint(55.1)
keys = h.keys
sink(keys[f()])

This gives the specific behaviour I'm looking for in the context of modelling Rails params, because we taint the whole params object which is a Hash-like thing.