hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-19 14:04:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add change note and update severity

Browse Source
This commit is contained in:
Joe Farebrother
2024-03-22 14:04:15 +00:00
parent b74145349b
commit 01f712476b
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ruby/ql/src/change-notes/2024-03-22-mass-assignment.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: newQuery
---
* Added a new query, `ruby/insecure-mass-assignment`, for finding instances of mass assignment operations accepting arbitrary parameters from remote user input.

2
ruby/ql/src/queries/security/cwe-915/MassAssignment.ql
View File

@@ -3,7 +3,7 @@
* @description Using mass assignment with user-controlled attributes allows unintended parameters to be set.
* @kind path-problem
* @problem.severity error
* @security-severity 7.5
* @security-severity 9.8
* @precision high
* @id ruby/insecure-mass-assignment
* @tags security