Rb: add some more flow through splat parameters - #11398
Conversation
hvitved
left a comment
There was a problem hiding this comment.
I am not convinced that this adds the type of flow that we want; I think it would be better to add support a la how we do it for hash splats.
|
|
||
| args = taint(26) | ||
| def splatstuff(*x) | ||
| sink x # $ hasValueFlow=26 |
There was a problem hiding this comment.
I don't think we want flow in this case; we only want flow to x[n].
There was a problem hiding this comment.
I've made it similar to how we handle hash-splat, except I still restrict it to the first argument/parameter.
It still gives me the flow I want in the second-order-command-injection PR.
c95432e to
0c2ff98
Compare
hvitved
left a comment
There was a problem hiding this comment.
LGTM, good to have some initial support at least for splat parameters. Will you do a final DCA run?
New evaluation looks about the same as the old evaluation. Edit: I'm merging. |
This was something I needed in my second-order-command-injection WIP branch.
Precise flow through splat parameters is hard in the general case.
But if we special-case to the situration where both the argument and the parameter are in the first position, then it's easy.
Evaluation looks OK.
The easiest way to see the impact is to look at the new call-edges. Those new edges mostly appear from the receiver being tracked more precisely.
E.g. here where
argsis a splat parameter that is tracked more precisely with this change.This is my first venture into the inner workings of the dataflow library, so I hope I got it right.