Ruby: Add support for Grape Framework by felickz · Pull Request #20427 · github/codeql · GitHub

This pull request adds modeling support for the Grape Ruby API framework to the CodeQL library. It introduces a new Grape.qll library that models Grape API classes, endpoints, and sources of user input such as parameters, headers, cookies, and route parameters.

Taint Source	Description	Example Usage
params	Request parameters	params[:user_id], params['name']
headers	HTTP headers + DSL blocks	headers[:Authorization], headers do...end
cookies	HTTP cookies + DSL blocks	cookies[:session_id], cookies do...end
route_param	URL path parameters	route_param(:user_id)
request	HTTP request object	request.body.read

The changes are validated with new framework and vulnerability tests and expected outputs, and Grape is now imported in the main Ruby frameworks library.

[1/1 comp 1m6s eval 21.3s] PASSED ruby\ql\test\library-tests\frameworks\grape\Grape.ql
Cleaning out existing ruby\ql\test\library-tests\frameworks\grape\grape.testproj.
Completed in 1m35s (extract 5.1s comp 1m6s eval 22.1s).
All 1 tests passed.
...

[1/1 comp 2.7s eval 26s] PASSED ruby\ql\test\query-tests\security\cwe-089\SqlInjection.qlref
Completed in 46.3s (extract 6.5s comp 2.7s eval 26.8s).
All 1 tests passed.

Vulnerable tests verified: https://github.com/vulna-felickz/ruby-grape-sqli/blob/main/app/api/potato_api.rb

… method support

…rape API

Pull Request Overview

This pull request introduces comprehensive CodeQL modeling support for the Ruby Grape API framework. The implementation identifies Grape API classes, their endpoints, and various sources of user input including parameters, headers, cookies, route parameters, and request objects.

Key changes:

New Grape.qll library with classes to model Grape API structure and taint sources
Framework integration by importing Grape in the main Ruby frameworks library
Comprehensive test coverage with vulnerability detection validation

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
ruby/ql/lib/codeql/ruby/frameworks/Grape.qll	Core Grape framework modeling with API class detection and taint source definitions
ruby/ql/lib/codeql/ruby/Frameworks.qll	Integration of Grape framework into main Ruby frameworks library
ruby/ql/test/library-tests/frameworks/grape/Grape.ql	Query predicates for testing Grape framework modeling
ruby/ql/test/library-tests/frameworks/grape/app.rb	Test application demonstrating various Grape API patterns
ruby/ql/test/library-tests/frameworks/grape/Grape.expected	Expected test results for Grape framework modeling
ruby/ql/test/query-tests/security/cwe-089/ArelInjection.rb	Additional vulnerability test cases using Grape taint sources
ruby/ql/test/query-tests/security/cwe-089/SqlInjection.expected	Updated expected results including Grape-based SQL injection detection
ruby/ql/lib/change-notes/2025-09-15-grape-framework-support.md	Release notes documenting the new Grape framework support

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

… ruby-framework-grape

- added unit tests for flow using inline format - removed grape from Arel tests (temporary)

Thanks a lot for the contribution.

…o a simplified GrapeHelperMethodTarget extends AdditionalCallTarget

- should not impact extracted application code

…ity; add getHelperSelf method to retrieve self parameter in helpers block.

…method call checks

…erse dataflow instead of AST - add tests to check for nested helpers

…ce calls for headers, request, route_param, and cookies

Thanks a lot for the contribution.

Same, appreciate the extreme review detail and code contributions to guide me in the right direction! All changes have been applied and tests to add/update coverage have been confirmed. Please re-review when you get a moment @hvitved

LGTM, but we need to commit ruby/ql/test/library-tests/frameworks/grape/CONSISTENCY/VariablesConsistency.expected as well. It can be generated via

codeql test run ruby/ql/test/library-tests/frameworks/grape --consistency-queries ruby/ql/consistency-queries --learn

I have also started a final DCA run.

… ruby-framework-grape

LGTM, but we need to commit ruby/ql/test/library-tests/frameworks/grape/CONSISTENCY/VariablesConsistency.expected as well. It can be generated via
codeql test run ruby/ql/test/library-tests/frameworks/grape --consistency-queries ruby/ql/consistency-queries --learn
I have also started a final DCA run.

Looks good now!

felickz added 4 commits September 12, 2025 19:22

Add initial support for Ruby Grape

d295acc

Refactor Grape framework code for improved readability and consistency

738ab6f

Enhance Grape framework with additional data flow modeling and helper…

3252bd3

… method support

Add support for route parameters(+ blocks), headers, and cookies in G…

5cfa6e8

…rape API

github-actions Bot added the Ruby label Sep 13, 2025

github-advanced-security AI found potential problems Sep 13, 2025

View reviewed changes

felickz added 2 commits September 15, 2025 22:02

Apply naming standards + changenote

a8d4d6b

Merge branch 'main' into ruby-framework-grape

6cea939

github-actions Bot added the documentation label Sep 16, 2025

felickz marked this pull request as ready for review September 16, 2025 02:02

felickz requested a review from a team as a code owner September 16, 2025 02:02

Copilot AI review requested due to automatic review settings September 16, 2025 02:02

Copilot AI reviewed Sep 16, 2025

View reviewed changes

Comment thread ruby/ql/lib/codeql/ruby/frameworks/Grape.qll Outdated

Update ruby/ql/lib/codeql/ruby/frameworks/Grape.qll

19cb187

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

github-advanced-security AI found potential problems Sep 16, 2025

View reviewed changes

Comment thread ruby/ql/lib/codeql/ruby/frameworks/Grape.qll Fixed

felickz added 5 commits September 15, 2025 22:11

Fix naming standards

fc98cd8

Merge branch 'ruby-framework-grape' of github.com:felickz/codeql into…

0d0ce32

… ruby-framework-grape

codeql query format

ffd32ef

Grape - detect params calls inside helper methods

c5e3be2

- added unit tests for flow using inline format - removed grape from Arel tests (temporary)

Merge branch 'main' into ruby-framework-grape

141b470

hvitved requested changes Sep 19, 2025

View reviewed changes

felickz added 8 commits September 19, 2025 18:28

Convert from GrapeHelperMethodTaintStep extends AdditionalTaintStep t…

89e9ee4

…o a simplified GrapeHelperMethodTarget extends AdditionalCallTarget

Refactor Grape framework to be encapsulated properly in Module

f4bbbc3

Refactor RootApi class to use getAnImmediateDescendent for clarity

50bf9ae

Remove redundant exclusion of base Grape::API module from GrapeApiClass

1bf6101

- should not impact extracted application code

Refactor RootApi and GrapeApiClass constructors for improved readabil…

b837c56

…ity; add getHelperSelf method to retrieve self parameter in helpers block.

Refactor GrapeHeadersBlockCall and GrapeCookiesBlockCall to simplify …

ecd0ce6

…method call checks

Refactor GrapeHelperMethod constructor to reuse getHelperSelf to trav…

0665c39

…erse dataflow instead of AST - add tests to check for nested helpers

Refactor Grape method call classes to simplify handling of API instan…

6e56c54

…ce calls for headers, request, route_param, and cookies

felickz requested a review from hvitved September 22, 2025 23:23

felickz added 2 commits September 22, 2025 19:25

codeql query format

89fd969

Merge branch 'main' into ruby-framework-grape

7a9a259

hvitved requested changes Sep 23, 2025

View reviewed changes

felickz added 2 commits September 23, 2025 10:40

Add expected output for VariablesConsistency test case

37e0c30

Merge branch 'ruby-framework-grape' of github.com:felickz/codeql into…

46d330c

… ruby-framework-grape

hvitved approved these changes Sep 23, 2025

View reviewed changes

hvitved merged commit 1a4cfba into github:main Sep 25, 2025
25 checks passed

felickz mentioned this pull request Sep 16, 2026

Ruby: model Grape request sub-accessors as remote flow sources #22586

Open

Ruby: Add support for Grape Framework by felickz · Pull Request #20427 · github/codeql · GitHub

Ruby: Add support for Grape Framework - #20427

Ruby: Add support for Grape Framework#20427hvitved merged 24 commits intogithub:maingithub/codeql:mainfrom forks-felickz:ruby-framework-grapeforks-felickz/codeql:ruby-framework-grapeCopy head branch name to clipboard

Conversation

felickz commented Sep 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

felickz commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

felickz commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Ruby: Add support for Grape Framework#20427
hvitved merged 24 commits into
github:mainfrom
forks-felickz:ruby-framework-grape

felickz commented Sep 13, 2025 •
edited
Loading

felickz commented Sep 22, 2025 •
edited
Loading

felickz commented Sep 23, 2025 •
edited
Loading