Ruby: patch-generated stubs

Author: d10c

ruby/ql/lib/codeql/ruby/security/WeakSensitiveDataHashingQuery.qll

@@ -28,8 +28,6 @@ module NormalHashFunction {
     predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
-
-    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   /** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on sensitive data" vulnerabilities. */
@@ -56,8 +54,6 @@ module ComputationallyExpensiveHashFunction {
     predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
-
-    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   /** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on passwords" vulnerabilities. */

ruby/ql/lib/codeql/ruby/security/regexp/MissingFullAnchorQuery.qll

@@ -17,6 +17,10 @@ private module MissingFullAnchorConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
   predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() {
+    any() // TODO: Make sure that the location overrides match the query's select clause: Column 7 selects sink.getCallNode (/Users/d10c/src/semmle-code/ql/ruby/ql/src/queries/security/cwe-020/MissingFullAnchor.ql@20:41:20:62), Column 9 selects sink.getRegex (/Users/d10c/src/semmle-code/ql/ruby/ql/src/queries/security/cwe-020/MissingFullAnchor.ql@20:76:20:94)
+  }
 }
 
 /**

ruby/ql/lib/codeql/ruby/security/regexp/PolynomialReDoSQuery.qll

@@ -18,6 +18,10 @@ private module PolynomialReDoSConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
   predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+  predicate observeDiffInformedIncrementalMode() {
+    any() // TODO: Make sure that the location overrides match the query's select clause: Column 1 selects sink.getHighlight (/Users/d10c/src/semmle-code/ql/ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.ql@27:8:27:30), Column 5 selects sink.getRegExp (/Users/d10c/src/semmle-code/ql/ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.ql@29:67:29:72)
+  }
 }
 
 /**

ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql

@@ -59,11 +59,16 @@ private module PermissivePermissionsConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
+  Location getASelectedSourceLocation(DataFlow::Node source) {
+    none() // TODO: Make sure that this source location matches the query's select clause: Column 5 does not select a source or sink originating from the flow call on line 78 (/Users/d10c/src/semmle-code/ql/ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql@81:84:81:86)
+  }
+
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     exists(FileSystemPermissionModification mod |
       sinkDef(sink, mod) and
       result = mod.getLocation()
     )
+    // TODO: Make sure that this sink location matches the query's select clause: Column 5 does not select a source or sink originating from the flow call on line 78 (/Users/d10c/src/semmle-code/ql/ruby/ql/src/queries/security/cwe-732/WeakFilePermissions.ql@81:84:81:86)
   }
 }