nickrolfe · Nov 10, 2026 · Nov 10, 2026
@@ -0,0 +1,32 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "summaryModel"
+      },
+      "data": [
+        ["ActiveStorage::Filename!", "Method[new]", "Argument[0]", "ReturnValue", "taint"],
+        ["ActiveStorage::Filename", "Method[sanitized]", "Argument[self]", "ReturnValue", "taint"]
+      ]
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "typeModel"
+      },
+      "data": [
+        // ActiveStorage::Blob.compose(blobs : [Blob]) : Blob
+        ["ActiveStorage::Blob", "ActiveStorage::Blob!", "Method[compose].ReturnValue"],
+        // ActiveStorage::Blob.create_and_upload! : Blob
+        ["ActiveStorage::Blob", "ActiveStorage::Blob!", "Method[create_and_upload!].ReturnValue"],
+        // ActiveStorage::Blob.create_before_direct_upload! : Blob
+        ["ActiveStorage::Blob", "ActiveStorage::Blob!", "Method[create_before_direct_upload!].ReturnValue"],
+        // ActiveStorage::Blob.find_signed(!) : Blob
+        ["ActiveStorage::Blob", "ActiveStorage::Blob!", "Method[find_signed,find_signed!].ReturnValue"]
+      ]
+    }
+  ]
+}
+// gives error: Invalid name 'Element' in access path
+// - ['ActiveStorage::Blob', 'ActiveStorage::Blob!', 'Method[compose].Argument[0].Element[any]']
@@ -0,0 +1,39 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "summaryModel"
+      },
+      "data": [
+        // `ActiveSupport::SafeBuffer` wraps a string, providing HTML-safe methods
+        // for concatenation.
+        // It is possible to insert tainted data into `SafeBuffer` that won't get
+        // sanitized, and this taint is then propagated via most of the methods.
+        //
+        // TODO: SafeBuffer also reponds to all String methods.
+        // Can we model this without repeating all the existing summaries we have
+        // for String?
+        // SafeBuffer.new(x) does not sanitize x
+        ["ActionView::SafeBuffer!", "Method[new]", "Argument[0]", "ReturnValue", "taint"],
+        // These methods preserve taint in self
+        ["ActionView::SafeBuffer", "Method[concat,insert,prepend,to_s,to_param]", "Argument[self]", "ReturnValue", "taint"],
+        // SafeBuffer#safe_concat(x) does not sanitize x
+        ["ActionView::SafeBuffer", "Method[safe_concat]", "Argument[0]", "Argument[self]", "taint"],
+        ["ActionView::SafeBuffer", "Method[safe_concat]", "Argument[0]", "ReturnValue", "taint"],
+        ["ActiveSupport::JSON!", "Method[decode,load]", "Argument[0]", "ReturnValue", "taint"],
+        ["ActiveSupport::JSON!", "Method[encode,dump]", "Argument[0]", "ReturnValue", "taint"],
+        ["Pathname", "Method[existence]", "Argument[self]", "ReturnValue", "taint"]
+      ]
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "typeModel"
+      },
+      "data": [
+        ["Pathname", "Pathname", "Method[existence].ReturnValue"]
+      ]
+    }
+  ]
+}
@@ -0,0 +1,17 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "summaryModel"
+      },
+      "data": [
+        // Not all of these methods are strictly defined in the `json` gem.
+        // The `JSON` namespace is heavily overloaded by other JSON parsing gems such as `oj`, `json_pure`, `multi_json` etc.
+        // This summary covers common methods we've seen called on `JSON` in the wild.
+        ["JSON!", "Method[generate,fast_generate,pretty_generate,dump,unparse,fast_unparse]", "Argument[0]", "ReturnValue", "taint"],
+        ["JSON!", "Method[parse,parse!,load,restore]", "Argument[0]", "ReturnValue", "taint"]
+      ]
+    }
+  ]
+}
@@ -0,0 +1,22 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "summaryModel"
+      },
+      "data": [
+        ["Mysql2::Client!", "Method[escape]", "Argument[0]", "ReturnValue", "taint"]
+      ]
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "barrierModel"
+      },
+      "data": [
+        ["Mysql2::Client!", "Method[escape].ReturnValue", "sql-injection"]
+      ]
+    }
+  ]
+}
@@ -0,0 +1,22 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "summaryModel"
+      },
+      "data": [
+        ["SQLite3::Database!", "Method[quote]", "Argument[0]", "ReturnValue", "taint"]
+      ]
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "barrierModel"
+      },
+      "data": [
+        ["SQLite3::Database!", "Method[quote].ReturnValue", "sql-injection"]
+      ]
+    }
+  ]
+}
@@ -0,0 +1,17 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "typeModel"
+      },
+      "data": [
+        ["Mime::Type", "Mime!", "Method[fetch].ReturnValue"],
+        ["Mime::Type", "Mime::Type!", "Method[lookup].ReturnValue"],
+        ["Mime::Type", "Mime::Type!", "Method[lookup_by_extension].ReturnValue"],
+        ["Mime::Type", "Mime::Type!", "Method[register].ReturnValue"],
+        ["Mime::Type", "Mime::Type!", "Method[register_alias].ReturnValue"]
+      ]
+    }
+  ]
+}
@@ -0,0 +1,13 @@
+{
+  "extensions": [
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "summaryModel"
+      },
+      "data": [
+        ["Regexp!", "Method[escape,quote]", "Argument[0]", "ReturnValue", "taint"]
+      ]
+    }
+  ]
+}
@@ -0,0 +1,62 @@
+{
+  "extensions": [
+    // Make sure that the extensible model predicates have at least one definition
+    // to avoid errors about undefined extensionals.
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "sourceModel"
+      },
+      "data": []
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "sinkModel"
+      },
+      "data": []
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "summaryModel"
+      },
+      "data": []
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "barrierModel"
+      },
+      "data": []
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "barrierGuardModel"
+      },
+      "data": []
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "neutralModel"
+      },
+      "data": []
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "typeModel"
+      },
+      "data": []
+    },
+    {
+      "addsTo": {
+        "pack": "codeql/ruby-all",
+        "extensible": "typeVariableModel"
+      },
+      "data": []
+    }
+  ]
+}