Model the OpenURI http client

Author: hmac

ql/lib/codeql/ruby/frameworks/HTTPClients.qll

@@ -8,3 +8,4 @@ private import codeql.ruby.frameworks.http_clients.Faraday
 private import codeql.ruby.frameworks.http_clients.RestClient
 private import codeql.ruby.frameworks.http_clients.HTTParty
 private import codeql.ruby.frameworks.http_clients.HTTPClient
+private import codeql.ruby.frameworks.http_clients.OpenURI

ql/lib/codeql/ruby/frameworks/http_clients/OpenURI.qll

@@ -0,0 +1,39 @@
+private import ruby
+private import codeql.ruby.Concepts
+private import codeql.ruby.ApiGraphs
+private import codeql.ruby.frameworks.StandardLibrary
+
+/**
+ * A call that makes an HTTP request using `OpenURI`.
+ * ```ruby
+ * Kernel.open("http://example.com").read
+ * URI.open("http://example.com").readlines
+ * URI.parse("http://example.com").open.read
+ * ```
+ */
+class OpenURIRequest extends HTTP::Client::Request::Range {
+  DataFlow::Node request;
+  DataFlow::CallNode responseBody;
+
+  OpenURIRequest() {
+    exists(API::Node requestNode | request = requestNode.getAnImmediateUse() |
+      requestNode =
+        [API::getTopLevelMember("URI"), API::getTopLevelMember("URI").getReturn("parse")]
+            .getReturn("open") and
+      responseBody = requestNode.getAMethodCall(["read", "readlines"]) and
+      this = request.asExpr().getExpr()
+    )
+    or
+    // Kernel.open("http://example.com").read
+    // open("http://example.com").read
+    this instanceof KernelMethodCall and
+    this.getMethodName() = "open" and
+    request.asExpr().getExpr() = this and
+    responseBody.asExpr().getExpr().(MethodCall).getMethodName() in ["read", "readlines"] and
+    request.(DataFlow::LocalSourceNode).flowsTo(responseBody.getReceiver())
+  }
+
+  override DataFlow::Node getResponseBody() { result = responseBody }
+
+  override string getFramework() { result = "OpenURI" }
+}

ql/test/library-tests/frameworks/http_clients/OpenURI.expected

@@ -0,0 +1,4 @@
+| OpenURI.rb:3:9:3:41 | call to open | OpenURI.rb:4:1:4:10 | call to read |
+| OpenURI.rb:6:9:6:34 | call to open | OpenURI.rb:7:1:7:15 | call to readlines |
+| OpenURI.rb:9:9:9:38 | call to open | OpenURI.rb:10:1:10:10 | call to read |
+| OpenURI.rb:12:9:12:45 | call to open | OpenURI.rb:13:1:13:10 | call to read |

ql/test/library-tests/frameworks/http_clients/OpenURI.ql

@@ -0,0 +1,4 @@
+import codeql.ruby.frameworks.http_clients.OpenURI
+import codeql.ruby.DataFlow
+
+query DataFlow::Node openURIRequests(OpenURIRequest e) { result = e.getResponseBody() }

ql/test/library-tests/frameworks/http_clients/OpenURI.rb

@@ -0,0 +1,13 @@
+require "open-uri"
+
+resp1 = Kernel.open("http://example.com")
+resp1.read
+
+resp2 = open("http://example.com")
+resp2.readlines
+
+resp3 = URI.open("http://example.com")
+resp3.read
+
+resp4 = URI.parse("https://example.com").open
+resp4.read