Ruby: Reduce alerts produced by MassAssignment.ql

github · Apr 3, 2024 · c2d771b · c2d771b
1 parent 3c96bf6
commit c2d771b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/ruby/ql/lib/codeql/ruby/security/MassAssignmentQuery.qll b/ruby/ql/lib/codeql/ruby/security/MassAssignmentQuery.qll
@@ -43,6 +43,11 @@ private module Config implements DataFlow::StateConfigSig {
     state instanceof FlowState::Permitted
   }
 
+  predicate isBarrierIn(DataFlow::Node node, FlowState state) {
+    node instanceof MassAssignment::Source and
+    state instanceof FlowState::Unpermitted
+  }
+
   predicate isBarrier(DataFlow::Node node) { node instanceof MassAssignment::Sanitizer }
 
   predicate isAdditionalFlowStep(