Ruby: use in SensitiveDataHashing

github · Dec 16, 2024 · 646395b · 646395b
1 parent c417dc4
commit 646395b
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 7 deletions.
diff --git a/ruby/ql/lib/codeql/ruby/security/WeakSensitiveDataHashingQuery.qll b/ruby/ql/lib/codeql/ruby/security/WeakSensitiveDataHashingQuery.qll
@@ -68,9 +68,7 @@ module ComputationallyExpensiveHashFunction {
  * `computationallyExpensiveHashFunctionFlowPath`.
  */
 module WeakSensitiveDataHashingFlow =
-  DataFlow::MergePathGraph<NormalHashFunction::Flow::PathNode,
-    ComputationallyExpensiveHashFunction::Flow::PathNode, NormalHashFunction::Flow::PathGraph,
-    ComputationallyExpensiveHashFunction::Flow::PathGraph>;
+  DataFlow::MergeFlows<NormalHashFunction::Flow, ComputationallyExpensiveHashFunction::Flow>;
 
 /** Holds if data can flow from `source` to `sink` with `NormalHashFunction::Flow`. */
 predicate normalHashFunctionFlowPath(

diff --git a/ruby/ql/src/queries/security/cwe-327/WeakSensitiveDataHashing.ql b/ruby/ql/src/queries/security/cwe-327/WeakSensitiveDataHashing.ql
@@ -14,11 +14,9 @@
 
 import ruby
 import codeql.ruby.security.WeakSensitiveDataHashingQuery
-import WeakSensitiveDataHashingFlow::PathGraph
+import WeakSensitiveDataHashingFlow
 
-from
-  WeakSensitiveDataHashingFlow::PathNode source, WeakSensitiveDataHashingFlow::PathNode sink,
-  string ending, string algorithmName, string classification
+from PathNode source, PathNode sink, string ending, string algorithmName, string classification
 where
   normalHashFunctionFlowPath(source, sink) and
   algorithmName = sink.getNode().(NormalHashFunction::Sink).getAlgorithmName() and