File.join gets confused with collection join #616
Description
In the case of ruby there is a confusion between the Class method File.join and collection object method x.join. In particular the following failed:
def test(user_input)
# ruleid: test-file-join
sink(File.join("base", user_input))
endwith rule:
rules:
- id: test-file-join
message: taint
languages: [ruby]
severity: ERROR
mode: taint
pattern-sources:
- patterns:
- pattern: File.$Z(...)
- metavariable-regex:
metavariable: $Z
regex: ^join$
pattern-sinks:
- pattern: sink($EXPR)