Ruby: Add implicit writes for synthesized parameters

Author: hvitved

ruby/ql/lib/codeql/ruby/ast/Parameter.qll

@@ -57,7 +57,11 @@ class NamedParameter extends Parameter, TNamedParameter {
   final VariableAccess getAnAccess() { result = this.getVariable().getAnAccess() }
 
   /** Gets the access that defines the underlying local variable. */
-  final VariableAccess getDefiningAccess() { result = this.getVariable().getDefiningAccess() }
+  final VariableAccess getDefiningAccess() {
+    result = this.getVariable().getDefiningAccess()
+    or
+    result = this.(SimpleParameterSynthImpl).getDefininingAccess()
+  }
 
   override AstNode getAChild(string pred) {
     result = super.getAChild(pred)

ruby/ql/lib/codeql/ruby/ast/Variable.qll

@@ -5,6 +5,7 @@ private import codeql.Locations
 private import internal.AST
 private import internal.TreeSitter
 private import internal.Variable
+private import internal.Parameter
 
 /** A variable declared in a scope. */
 class Variable instanceof VariableImpl {
@@ -110,7 +111,11 @@ class VariableAccess extends Expr instanceof VariableAccessImpl {
    * the access to `elements` in the parameter list is an implicit assignment,
    * as is the first access to `e`.
    */
-  predicate isImplicitWrite() { implicitWriteAccess(toGenerated(this)) }
+  predicate isImplicitWrite() {
+    implicitWriteAccess(toGenerated(this))
+    or
+    this = any(SimpleParameterSynthImpl p).getDefininingAccess()
+  }
 
   final override string toString() { result = VariableAccessImpl.super.toString() }
 }

ruby/ql/lib/codeql/ruby/ast/internal/Parameter.qll

@@ -25,7 +25,7 @@ abstract class SimpleParameterImpl extends AstNode, TSimpleParameter {
   abstract string getNameImpl();
 }
 
-private class SimpleParameterRealImpl extends SimpleParameterImpl, TSimpleParameterReal {
+class SimpleParameterRealImpl extends SimpleParameterImpl, TSimpleParameterReal {
   private Ruby::Identifier g;
 
   SimpleParameterRealImpl() { this = TSimpleParameterReal(g) }
@@ -35,9 +35,11 @@ private class SimpleParameterRealImpl extends SimpleParameterImpl, TSimpleParame
   override string getNameImpl() { result = g.getValue() }
 }
 
-private class SimpleParameterSynthImpl extends SimpleParameterImpl, TSimpleParameterSynth {
+class SimpleParameterSynthImpl extends SimpleParameterImpl, TSimpleParameterSynth {
   SimpleParameterSynthImpl() { this = TSimpleParameterSynth(_, _) }
 
+  LocalVariableAccessSynth getDefininingAccess() { synthChild(this, 0, result) }
+
   override LocalVariable getVariableImpl() { result = TLocalVariableSynth(this, _) }
 
   override string getNameImpl() { result = this.getVariableImpl().getName() }