github / github/codeql

False positive for IncompleteHostnameRegExp in Ruby

未关闭
#13,749 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
false-positive Ruby
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

**Description of the false positive**

There's a problem with the current implementation of `IncompleteHostnameRegExp` for Ruby. Specifically, it seems that the rule with report false positives for any `X.match(Y)` method call where `Y` is a `String` and `X` is any object with a `match` method.

The rule incorrectly "thinks" that `Y` is a regex being used for matching, likely because in Ruby's `String` class has a `match` method which takes a `String` parameter for defining the regex:

https://ruby-doc.org/3.2.2/String.html#method-i-match

In other words, the rule doesn't check that `X` is a known type for which the `match` method accepts a string argument which is used as a regex, and instead matches on any type for `X`.

**Code samples or links to source code**

Please see https://github.com/github/codeql/pull/13748 which includes a failing test which demonstrates the problem.

**URL to the alert on GitHub code scanning (optional)**

Can't share it since it's in a private repository 😬

贡献指南

打开贡献指南

调研方向

Read the IncompleteHostnameRegExp implementation and the failing Ruby test referenced in pull request #13748. Reproduce the X.match(Y) case described in the issue, then verify that the rule no longer reports a false positive for unsupported receiver types while preserving the intended detection.

由索引模型根据 Issue 内容生成。

评估

技术栈
ruby
领域
security
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
42/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。