Ruby: Model sanitize ActionView helper

Author: hmac

ruby/ql/lib/codeql/ruby/frameworks/ActionView.qll

@@ -38,7 +38,7 @@ private class ActionViewHtmlSafeCall extends HtmlSafeCall {
  */
 abstract class HtmlEscapeCall extends MethodCall {
   // "h" is aliased to "html_escape" in ActiveSupport
-  HtmlEscapeCall() { this.getMethodName() = ["html_escape", "html_escape_once", "h"] }
+  HtmlEscapeCall() { this.getMethodName() = ["html_escape", "html_escape_once", "h", "sanitize"] }
 }
 
 /**

ruby/ql/test/query-tests/security/cwe-079/app/views/foo/bars/show.html.erb

@@ -75,3 +75,6 @@
 
 <%# BAD: javasript_include_tag called with remote input %>
 <%= javascript_include_tag params[:url] %>
+
+<%# GOOD: input is sanitized %>
+<%= sanitize(params[:comment]).html_safe %>