Ruby: Add additional sinks to the rb/kernel-open query

[p-]

Hi!

This PR adds following sinks to the rb/kernel-open query:

• IO.write
• IO.binread
• IO.binwrite
• IO.foreach
• IO.readlines
• URI.open

These sinks all belong to the same family as the already implemented Kernel.open and IO.read. (Command injection with a starting pipe (|).

In addition to that I added a sanitizer I encountered in the wild: File.join sanitizes an untrusted user input if the tainted data is not passed in as the first argument (command execution is only possible if the first sign character passed to those sinks is a pipe (|).

[github-actions]

QHelp previews:

[erik-krogh]

I had my doubt abouts URI.open, but yes that's also vulnerable 🤦

irb(main):001:0> require "open-uri"
=> true
irb(main):002:0> URI
=> URI
irb(main):003:0> URI.open "https://google.com"
=> #<File:/var/folders/qp/rmn5qy357vb70d2sgqv1tt_c0000gn/T/open-uri20221122-8505-omzyyf>
irb(main):004:0> URI.open "| touch pwned"
=> #<IO:fd 11>

LGTM 👍

[erik-krogh]

I'm sorry, I'm going to need changes.
Can you see the evaluation?

There are bunch of results in opal/opal where the alert is on a safe call to e.g. File.write, but according to the alert message the call is to IO.write, so you'll have to do something about that.
You can see in KernelOpenQuery.qll that I've already done that for IO.read.

I think that happens due to some aliasing 🤷, but I don't know precisely how.
(You can ask the more senior CodeQL Ruby devs on Slack about that).