ShellEscape aint always escaping shells

Hey,

Does not this line mean if a user has defined a dummy function called shellescape() would be considered as a valid sanitizer ?

https://github.com/github/codeql/blob/e02affd327603e89519b67ceffc7e60948831cc1/ruby/ql/lib/codeql/ruby/security/CommandInjectionCustomizations.qll#L53

Thank you

Start with ruby/ql/lib/codeql/ruby/security/CommandInjectionCustomizations.qll around line 53 and inspect how shellescape() is recognized. Verify whether an arbitrary user-defined function can satisfy the sanitizer check, then determine the intended behavior and how it should be covered. Done means the query no longer treats an unrelated dummy function as valid sanitization.

Vom Indexierungsmodell aus dem Issue-Text verfasst.