Ruby: Add support for Grape Framework

[felickz]

This pull request adds modeling support for the Grape Ruby API framework to the CodeQL library. It introduces a new Grape.qll library that models Grape API classes, endpoints, and sources of user input such as parameters, headers, cookies, and route parameters.

Taint Source	Description	Example Usage
params	Request parameters	params[:user_id], params['name']
headers	HTTP headers + DSL blocks	headers[:Authorization], headers do...end
cookies	HTTP cookies + DSL blocks	cookies[:session_id], cookies do...end
route_param	URL path parameters	route_param(:user_id)
request	HTTP request object	request.body.read

The changes are validated with new framework and vulnerability tests and expected outputs, and Grape is now imported in the main Ruby frameworks library.

[1/1 comp 1m6s eval 21.3s] PASSED ruby\ql\test\library-tests\frameworks\grape\Grape.ql
Cleaning out existing ruby\ql\test\library-tests\frameworks\grape\grape.testproj.
Completed in 1m35s (extract 5.1s comp 1m6s eval 22.1s).
All 1 tests passed.
...

[1/1 comp 2.7s eval 26s] PASSED ruby\ql\test\query-tests\security\cwe-089\SqlInjection.qlref
Completed in 46.3s (extract 6.5s comp 2.7s eval 26.8s).
All 1 tests passed.

Vulnerable tests verified: https://github.com/vulna-felickz/ruby-grape-sqli/blob/main/app/api/potato_api.rb

[Copilot]

Pull Request Overview

This pull request introduces comprehensive CodeQL modeling support for the Ruby Grape API framework. The implementation identifies Grape API classes, their endpoints, and various sources of user input including parameters, headers, cookies, route parameters, and request objects.

Key changes:

• New Grape.qll library with classes to model Grape API structure and taint sources
• Framework integration by importing Grape in the main Ruby frameworks library
• Comprehensive test coverage with vulnerability detection validation

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
ruby/ql/lib/codeql/ruby/frameworks/Grape.qll	Core Grape framework modeling with API class detection and taint source definitions
ruby/ql/lib/codeql/ruby/Frameworks.qll	Integration of Grape framework into main Ruby frameworks library
ruby/ql/test/library-tests/frameworks/grape/Grape.ql	Query predicates for testing Grape framework modeling
ruby/ql/test/library-tests/frameworks/grape/app.rb	Test application demonstrating various Grape API patterns
ruby/ql/test/library-tests/frameworks/grape/Grape.expected	Expected test results for Grape framework modeling
ruby/ql/test/query-tests/security/cwe-089/ArelInjection.rb	Additional vulnerability test cases using Grape taint sources
ruby/ql/test/query-tests/security/cwe-089/SqlInjection.expected	Updated expected results including Grape-based SQL injection detection
ruby/ql/lib/change-notes/2025-09-15-grape-framework-support.md	Release notes documenting the new Grape framework support

[hvitved]

Thanks a lot for the contribution.

[hvitved]

not this = any(GrapeApiClass parent).getAnImmediateDescendent()

[hvitved]

getADescendentModule is not transitive here, so the line below should be redundant.

[hvitved]

Suggested change

	// Params calls within endpoint blocks
	exists(GrapeApiClass api |
	this.getMethodName() = "params" and
	this.getParent+() = api.getADeclaration()
	)
	or
	// Params calls within helper methods (defined in helpers blocks)
	exists(GrapeApiClass api, DataFlow::CallNode helpersCall |
	helpersCall = api.getAModuleLevelCall("helpers") and
	this.getMethodName() = "params" and
	this.getParent+() = helpersCall.getBlock().asExpr().getExpr()
	)
	exists(API::Node n | this = n.getAMethodCall("params").asExpr().getExpr() |
	// Params calls within endpoint blocks
	n = grapeApiInstance()
	or
	// Params calls within helper methods (defined in helpers blocks)
	n = any(GrapeApiClass c).getHelperSelf().track()
	)

where you add this predicate to the GrapeApiClass class:

  /**
   * Gets the `self` parameter belonging to a method defined within a
   * `helpers` block in this API class.
   * 
   * These methods become available in endpoint contexts through Grape's DSL.
   */
  DataFlow::SelfParameterNode getHelperSelf() {
    exists(DataFlow::CallNode helpersCall |
      helpersCall = this.getAModuleLevelCall("helpers") and
      result.getSelfVariable().getDeclaringScope().getOuterScope+() =
        helpersCall.getBlock().asExpr().getExpr()
    )
  }

[hvitved]

Suggested change

	exists(GrapeApiClass api |
	this.getParent+() = api.getADeclaration() and
	this.getMethodName() = "headers" and
	exists(this.getBlock())
	)
	this = grapeApiInstance().getAMethodCall("headers").asExpr().getExpr() and
	exists(this.getBlock())

[hvitved]

Suggested change

	exists(GrapeApiClass api |
	this.getParent+() = api.getADeclaration() and
	this.getMethodName() = "cookies" and
	exists(this.getBlock())
	)
	this = grapeApiInstance().getAMethodCall("cookies").asExpr().getExpr() and
	exists(this.getBlock())

[hvitved]

Same

[hvitved]

Suggested change

	GrapeHelperMethod() {
	exists(DataFlow::CallNode helpersCall |
	helpersCall = apiClass.getAModuleLevelCall("helpers") and
	this.getParent+() = helpersCall.getBlock().asExpr().getExpr()
	)
	}
	GrapeHelperMethod() { this = apiClass.getHelperSelf().getSelfVariable().getDeclaringScope() }