Ruby: Remove ReturnValue as access path for constructors

Author: koesie10

ruby/ql/src/utils/modeleditor/FrameworkModeAccessPaths.ql

@@ -10,6 +10,7 @@ private import ruby
 private import codeql.ruby.AST
 private import codeql.ruby.ApiGraphs
 private import queries.modeling.internal.Util as Util
+private import ModelEditor
 
 predicate simpleParameters(string type, string path, string value, DataFlow::Node node) {
   exists(DataFlow::MethodNode methodNode, DataFlow::ParameterNode paramNode |
@@ -58,7 +59,8 @@ predicate blockArguments(string type, string path, string value, DataFlow::Node
 predicate returnValue(string type, string path, string value, DataFlow::Node node) {
   exists(DataFlow::MethodNode methodNode, DataFlow::Node returnNode |
     methodNode.getLocation().getFile() instanceof Util::RelevantFile and
-    returnNode = methodNode.getAReturnNode()
+    returnNode = methodNode.getAReturnNode() and
+    not isConstructor(methodNode) // A constructor doesn't have a return value
   |
     Util::pathToMethod(methodNode, type, path) and
     value = "ReturnValue" and

ruby/ql/src/utils/modeleditor/ModelEditor.qll

@@ -32,6 +32,14 @@ string getNamespace(File file) {
   )
 }
 
+/**
+ * Holds if this method is a constructor for a module.
+ */
+predicate isConstructor(DataFlow::MethodNode method) {
+  method.getMethodName() = "initialize" and
+  exists(DataFlow::ModuleNode m | m.getOwnInstanceMethod(method.getMethodName()) = method)
+}
+
 abstract class Endpoint instanceof DataFlow::Node {
   string getNamespace() { result = getNamespace(super.getLocation().getFile()) }
 
@@ -153,10 +161,7 @@ class MethodEndpoint extends Endpoint instanceof DataFlow::MethodNode {
   /**
    * Holds if this method is a constructor for a module.
    */
-  private predicate isConstructor() {
-    super.getMethodName() = "initialize" and
-    exists(DataFlow::ModuleNode m | m.getOwnInstanceMethod(super.getMethodName()) = this)
-  }
+  private predicate isConstructor() { isConstructor(this) }
 }
 
 string methodClassification(Call method) {