Nick Rolfe
511fb97273
Ruby: remove redundant import
2022-11-10 14:30:06 +00:00
Nick Rolfe
0337ccb93a
Ruby: add change notes for Arel.sql / SqlConstruction changes
2022-11-10 14:11:14 +00:00
Nick Rolfe
5a15558355
Ruby: treat an Arel.sql call as a SqlConstruction
2022-11-10 14:11:14 +00:00
Tom Hvitved
e18442069b
Ruby: Fix SSA entry definitions for self in top-level
2022-11-10 15:08:17 +01:00
Erik Krogh Kristensen
5d2ab8adfb
Merge pull request #11191 from erik-krogh/arrJoin
...
RB: add join(" ") calls as a sink for rb/shell-command-constructed-from-input
2022-11-10 14:20:42 +01:00
Nick Rolfe
c9d34947b7
Ruby: add SqlConstruction concept
2022-11-10 12:17:56 +00:00
Michael Nebel
9c6875ec0f
Merge pull request #10777 from michaelnebel/csharp/generatedataextensions
...
C#: Generate data extension files
2022-11-10 13:08:31 +01:00
Nick Rolfe
4a98ef064e
Ruby: use the 'customizations' pattern for the SQL injection query
2022-11-10 11:51:47 +00:00
Nick Rolfe
2b5e2ed282
Ruby: factor out some code into a helper predicate
2022-11-10 11:41:52 +00:00
Harry Maclean
a8b0d298ff
Ruby: More string comparison guards
...
Recognise if statements with conditionals made up or logical `and` or
`or` clauses as barrier guards.
2022-11-10 16:38:09 +13:00
erik-krogh
88de299e12
add join(" ") calls as a sink for rb/shell-command-constructed-from-input
2022-11-09 21:46:25 +01:00
Nick Rolfe
c8c53cb424
Merge remote-tracking branch 'origin/main' into nickrolfe/active_support_flow_summaries
2022-11-09 17:02:05 +00:00
Nick Rolfe
cfde7e9edc
Ruby: more accurate modeling of which ActionCable channel methods become endpoints
2022-11-09 16:14:11 +00:00
Nick Rolfe
611ed93e39
Ruby: add is{Public,Protected,Private} to DataFlow::MethodNode
2022-11-09 15:18:16 +00:00
Nick Rolfe
199b3f4d71
Ruby: add change note for ActionCable channel remote flow sources
2022-11-09 14:18:44 +00:00
Nick Rolfe
db20e7d143
Ruby: add ActionCable channel RPC params as remote-flow sources
2022-11-09 14:16:04 +00:00
Asger F
859dc7beb7
Merge pull request #11024 from asgerf/rb/data-flow-layer-capture2
...
Ruby: expand DataFlow API
2022-11-09 15:06:03 +01:00
Anders Schack-Mulligen
b3b7711149
Dataflow: Sync.
2022-11-09 14:23:15 +01:00
Nick Rolfe
97e939ae2b
Ruby: refine summaries for Hash#reverse_merge etc.
...
- revert the changes to the taint summaries specific to ActionController
params
- make the general flow summaries value-preserving and use
WithElement[any]
2022-11-09 11:56:07 +00:00
erik-krogh
c8b7eccc6f
sync files
2022-11-09 11:31:13 +01:00
Asger F
f4b2af730d
Update ruby/ql/lib/codeql/ruby/dataflow/internal/TaintTrackingPrivate.qll
...
Co-authored-by: Tom Hvitved <hvitved@github.com >
2022-11-09 09:28:07 +01:00
Harry Maclean
f1b63c4df3
Ruby: Fix in clause barrier guard
2022-11-09 16:10:17 +13:00
Harry Maclean
0ab88c2e29
Ruby: Handle simple in clauses in barrier guard
2022-11-09 16:01:33 +13:00
Harry Maclean
25ceeaf241
Ruby: Fix SplatExprCfgNode
2022-11-09 15:03:15 +13:00
Harry Maclean
4bc9096446
Ruby: Add case string comparison barrier guard
...
This recognises barriers of the form
STRINGS = ["foo", "bar"]
case foo
when "some string literal"
foo
when *["other", "strings"]
foo
when *STRINGS
foo
end
where the reads of `foo` inside each `when` are guarded by the comparison
of `foo` with the string literals.
We don't yet recognise this construct:
case foo
when "foo", "bar"
foo
end
This is due to a limitation in the shared barrier guard logic.
2022-11-09 15:03:13 +13:00
Nick Rolfe
865d0ca64a
Ruby: add changenote for ActiveSupport Hash extension summaries
2022-11-08 15:52:21 +00:00
Nick Rolfe
04575674db
Ruby: generalise summaries for ActiveSupport Hash extensions
2022-11-08 15:48:20 +00:00
Asger F
271de66f01
Ruby: rename getConst -> getConstant
2022-11-08 16:41:04 +01:00
Asger F
a60f510c85
Ruby: handle knownOrUnkown in default taint step
2022-11-08 16:11:55 +01:00
Tom Hvitved
f0554fcdee
Merge pull request #11155 from hvitved/ruby/avoid-stage-recomputation
...
Ruby: Avoid stage recomputation
2022-11-08 13:46:53 +01:00
Tom Hvitved
edde3defed
Merge pull request #11153 from hvitved/ruby/basic-block-at-conditions
...
Ruby: Split basic blocks around constant conditionals
2022-11-08 13:35:52 +01:00
Rasmus Wriedt Larsen
4895daba85
DataFlow: Add read/store stepIsLocal consistency checks
2022-11-08 13:32:49 +01:00
Tom Hvitved
37a69b4569
Ruby: Avoid stage recomputation
2022-11-08 10:51:30 +01:00
Erik Krogh Kristensen
c82410fd16
Merge pull request #10680 from erik-krogh/unsafeRbCmd
...
RB: add an unsafe-shell-command-construction query
2022-11-08 09:22:33 +01:00
Tom Hvitved
7ba0682297
Ruby: Split basic blocks around constant conditionals
2022-11-08 09:07:23 +01:00
Harry Maclean
03aa8df8e2
Ruby: Cosmetic change
2022-11-08 10:24:21 +13:00
Harry Maclean
d392cdaab6
Merge pull request #11022 from hmac/try-code-injection
...
Ruby: try/try! as code execution
2022-11-08 09:42:52 +13:00
erik-krogh
7a8e7150f0
add change-note
2022-11-07 14:36:55 +01:00
erik-krogh
40e4359173
port the Ruby regex/redos queries to use the shared pack
2022-11-07 14:34:18 +01:00
erik-krogh
3432e814c5
add a Ruby implementation of RegexTreeViewSig
2022-11-07 14:33:46 +01:00
erik-krogh
af922702c7
move existing regex-tree into a module
2022-11-07 14:33:46 +01:00
erik-krogh
dddf550593
add codeql/regex as a dependency
2022-11-07 14:33:45 +01:00
Asger F
a213e9e55d
Merge pull request #1 from hvitved/rb/data-flow-layer-capture2
...
Ruby: Make sure to always generate SSA definitions for namespace self-variables
2022-11-07 14:12:48 +01:00
Erik Krogh Kristensen
d67235b3c1
Merge pull request #11071 from erik-krogh/fixCanon
...
ReDoS: fix canonicalization in NfaUtils
2022-11-07 14:10:50 +01:00
Asger F
f991991474
Ruby: fix incomplete renaming of getCanonicalEnclosing/Nested module
2022-11-07 14:04:10 +01:00
Tom Hvitved
2737255705
Ruby: Make sure to always generate SSA definitions for namespace self-variables
2022-11-07 14:02:09 +01:00
Asger F
334d5b1b17
Ruby: fix stale qldoc
2022-11-07 11:23:40 +01:00
Asger F
27e1a8bd7a
Ruby: cache predicates related to getConst
2022-11-07 11:18:29 +01:00
Anders Schack-Mulligen
99ca28ea9b
Merge pull request #10886 from aschackmull/dataflow/joinorders
...
Dataflow: Fix a couple of join-orders.
2022-11-07 11:05:29 +01:00
Asger F
d4b018f242
Ruby: typo: found up -> looked up
2022-11-07 09:58:00 +01:00
