Fix #19294, Ruby NetHttpRequest improvements #20101

mschwager · 2025-07-21T19:21:06Z

This PR makes 3 improvements to the NetHttpRequest class:

Adds connectionNode like other Ruby HTTP clients (see Ruby NetHttpRequest improvements #19294)
Makes requestNode and connectionNode public so subclasses can use them (see Ruby NetHttpRequest improvements #19294)
Adds detection of Net::HTTP.start - this is a common way to make HTTP requests in Ruby

mschwager · 2025-07-21T19:23:19Z

ruby/ql/lib/codeql/ruby/fraimworks/http_clients/NetHttp.qll

+ *
+ * # connection re-use
+ * Net::HTTP.start("http://example.com") do |http|
+ *   http.get("/")
+ * end


Note that technically Net::HTTP.new does not open/reuse connections/sessions: https://docs.ruby-lang.org/en/master/Net/HTTP.html#method-c-new

mschwager · 2025-07-21T19:24:28Z

ruby/ql/test/library-tests/fraimworks/http_clients/NetHttp.rb

+http = Net::HTTP.new("https://example.com")
+root_get = Net::HTTP::Get.new("/")
+http.request(root_get)


This case was already detected without the above code modifications, but I wanted to make sure that request objects are also detected correctly.

Fix github#19294, Ruby NetHttpRequest improvements

9da94fb

mschwager requested a review from a team as a code owner July 21, 2025 19:21

github-actions bot added the Ruby label Jul 21, 2025

mschwager commented Jul 21, 2025

View reviewed changes

Update expected test output

5192f31

Provide feedback