Ruby: configsig rb/xxe

Author: alexrford

ruby/ql/src/queries/security/cwe-611/Xxe.ql

@@ -13,12 +13,10 @@
  *       external/cwe/cwe-827
  */
 
-import codeql.ruby.AST
 import codeql.ruby.dataflow.RemoteFlowSources
 import codeql.ruby.TaintTracking
 import codeql.ruby.Concepts
 import codeql.ruby.DataFlow
-import DataFlow::PathGraph
 
 class UnsafeXxeSink extends DataFlow::ExprNode {
   UnsafeXxeSink() {
@@ -29,16 +27,18 @@ class UnsafeXxeSink extends DataFlow::ExprNode {
   }
 }
 
-class XxeConfig extends TaintTracking::Configuration {
-  XxeConfig() { this = "XXE.ql::XxeConfig" }
+private module XxeConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
 
-  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeXxeSink }
+  predicate isSink(DataFlow::Node sink) { sink instanceof UnsafeXxeSink }
 }
 
-from DataFlow::PathNode source, DataFlow::PathNode sink, XxeConfig conf
-where conf.hasFlowPath(source, sink)
+private module XxeFlow = TaintTracking::Global<XxeConfig>;
+
+private import XxeFlow::PathGraph
+
+from XxeFlow::PathNode source, XxeFlow::PathNode sink
+where XxeFlow::flowPath(source, sink)
 select sink.getNode(), source, sink,
   "XML parsing depends on a $@ without guarding against external entity expansion.",
   source.getNode(), "user-provided value"