codeql icon indicating copy to clipboard operation
codeql copied to clipboard

Ruby NetHttpRequest improvements

Open mschwager opened this issue 7 months ago • 3 comments
trafficstars

Description of the issue

Hi all,

I'm building on the Ruby language's Http::Client::Request class, particularly NetHttpRequest. This is going well, except NetHttpRequest appears to be somewhat of an outlier compared to other client requests. There are two things: 1) its class fields are private instead of public, and 2) it only has a requestNode field and is lacking connectionNode.

For example:

https://github.com/github/codeql/blob/2dc88d87ae0c9e04f271992d0a6c8ad383d054dd/ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll#L21-L24

https://github.com/github/codeql/blob/2dc88d87ae0c9e04f271992d0a6c8ad383d054dd/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll#L25-L28

https://github.com/github/codeql/blob/2dc88d87ae0c9e04f271992d0a6c8ad383d054dd/ruby/ql/lib/codeql/ruby/frameworks/http_clients/RestClient.qll#L19-L21

https://github.com/github/codeql/blob/2dc88d87ae0c9e04f271992d0a6c8ad383d054dd/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Httparty.qll#L26-L27

https://github.com/github/codeql/blob/2dc88d87ae0c9e04f271992d0a6c8ad383d054dd/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll#L26-L29

So my question is, are NetHttpRequest class fields private for a reason, and if not would it be reasonable to make them public? And if so, would it also be reasonable to add a connectionNode field similar to FaradayHttpRequest, RestClientHttpRequest, and ExconHttpRequest?

I'm happy to open a PR with the changes myself - I just wanted to open an issue to track it first and check that there's not a reason for this discrepancy.

mschwager avatar Apr 11 '25 18:04 mschwager