QHelp previews:

This seems like a good idea to me! You can simplify your query a lot, though. Firstly, there are many useful classes in codeql.ruby.frameworks.ActionController and codeql.ruby.frameworks.ActiveRecord that you can use.

To find calls to request.request_parameters etc we can first model request, which is a method call only available in an ActionController context.

/**
 * A call to `request` in an ActionController controller class.
 * This probably refers to the incoming HTTP request object.
 */
class ActionControllerRequest extends DataFlow::Node {
  ActionControllerRequest() {
    exists(DataFlow::CallNode c |
      c.asExpr().getExpr().getEnclosingModule() instanceof ActionControllerControllerClass and
      c.getMethodName() = "request"
    |
      c.flowsTo(this)
    )
  }
}

This doesn't include calls in ActionView classes unfortunately, but it's a start. ActionControllerControllerClass is defined in the ActionController library I mentioned above.

The reason we use flowsTo in this way is to catch cases like this:

class MyController < ApplicationController
  def create
    r = request
    User.create(r.request_parameters)
  end
end

Taking request.request_parameters as an example, we want to find any calls to request_parameters where the receiver is an ActionControllerRequest.

/**
 * A direct parameters reference that happens inside a controller class.
 */
class WeakParams extends DataFlow::CallNode {
  WeakParams() {
    this.getReceiver() instanceof ActionControllerRequest and
    this.getMethodName() =
      [
        "request_parameters"
      ]
  }
}

That gives us our source, now we need a sink. Luckily we already have modelling for ActiveRecord calls like User.create, User.update etc. These are all defined as instances of the PersistentWriteAccess concept (see codeql.ruby.Concepts). This concept represents any write to a persistent store such as a database. This is possibly too broad, and if we want to restrict the sources to just AR calls then we can do that (though the classes are currently private and would need to be made public). Assuming we're happy with using PersistentWriteAccess then our taint tracking config becomes:

class Configuration extends TaintTracking::Configuration {
  Configuration() { this = "WeakParamsConfiguration" }

  override predicate isSource(DataFlow::Node node) { node instanceof WeakParams }

  override predicate isSink(DataFlow::Node node) { node = any(PersistentWriteAccess a).getValue() }
}

In the above I haven't considered excluding uses inside "strong params" methods. This is for two reasons:

• The heuristic of "a strong params method is one that ends in _params" seems unreliable to me.
• As far as I know, the params object is safe from mass assignment attacks because you have to explicitly permit the keys you want to extract from it.

I'm also not sure where the expose_all and original_hash methods come from - I couldn't find them in the Rails docs.