Arthur Baars
22b0697371
Update ruby/ql/lib/codeql/ruby/security/performance/ParseRegExp.qll
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2022-03-03 17:13:19 +01:00
Tom Hvitved
9d6d479fba
Add missing QL doc
2022-03-03 14:17:41 +01:00
Tom Hvitved
b23ab8089a
Ruby: Clear call contexts after jump steps in type tracking
2022-03-03 12:29:47 +01:00
Harry Maclean
4a43731b83
Ruby: Use SimpleSummarizedCallable
...
This simplifies some String flow summaries.
2022-03-03 10:49:44 +13:00
Arthur Baars
692fc4cb02
Update ruby/ql/lib/change-notes/2022-02-28-regex-string-literals.md
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-03-02 21:13:23 +01:00
Harry Maclean
37dac186a8
Ruby: String.try_convert isn't value-preserving
...
`String.try_convert` can convert arbitrary objects to strings, which
obviously isn't value-preserving.
2022-03-02 13:31:59 +13:00
Arthur Baars
169f65526e
Merge pull request #8292 from aibaars/api-graphs-private
...
Ruby: ApiGraphs: use private imports
2022-03-02 00:35:46 +01:00
Asger Feldthaus
df379809df
Ruby: support CSV rows of form ;any;Method[foo]
2022-03-01 14:08:21 +01:00
Asger Feldthaus
bf83400bd2
Ruby: port API::EntryPoint from JS
2022-03-01 14:08:21 +01:00
Asger Feldthaus
e10e3b9466
Ruby: convert ActiveStorage::Filename model to MaD
2022-03-01 14:08:21 +01:00
Asger Feldthaus
70c083fa64
Ruby: convert Regexp.escape model to MaD
2022-03-01 14:08:21 +01:00
Asger Feldthaus
388949f12e
Ruby: support WithBlock and WithoutBlock
2022-03-01 14:08:20 +01:00
Asger Feldthaus
a33e89279d
Ruby: instantiate ApiGraphModels library in Ruby
2022-03-01 14:08:20 +01:00
Arthur Baars
61fa3ba314
Add change note
2022-03-01 13:30:56 +01:00
Arthur Baars
a51f17e0ed
Ruby: introduce RegExpPatternSource
2022-03-01 13:30:51 +01:00
Arthur Baars
1240c11c4b
Ruby: parse some string literals as regex
...
In addition to regex literals, also parse normal string literals
as regular expressions if they somehow "flow" into a method call
that is known to interpret string values as regular expressions.
2022-03-01 13:26:51 +01:00
Tamás Vajk
94cb5c2be4
Merge pull request #8296 from github/post-release-prep/codeql-cli-2.8.2
...
Post-release preparation for codeql-cli-2.8.2
2022-03-01 11:57:36 +01:00
github-actions[bot]
980f822983
Post-release preparation for codeql-cli-2.8.2
2022-03-01 09:24:30 +00:00
Arthur Baars
7e6ef7ac74
Ruby: ApiGraphs: use private imports
2022-03-01 10:24:19 +01:00
Arthur Baars
5ce6b847d1
Merge pull request #8166 from aibaars/regex-char-sequence-1
...
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-28 17:47:53 +01:00
Alex Ford
6ddacce27a
Ruby: Add OrmWriteAccess concept changenote
2022-02-28 01:18:39 +00:00
Alex Ford
63ef9a75c9
Ruby: model OrmWriteAccesses for ActiveRecord
2022-02-28 01:18:39 +00:00
Alex Ford
8c6c680a28
Ruby: Add OrmWriteAccess concept
2022-02-28 01:11:40 +00:00
Arthur Baars
0c23f5815f
Add change note
2022-02-25 18:43:43 +01:00
Arthur Baars
5044f89105
Ruby/Python re-introduce normalCharacterSequence
2022-02-25 18:43:43 +01:00
Arthur Baars
9d9abaf1f9
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-02-25 12:27:20 +01:00
github-actions[bot]
20fe22c8c8
Release preparation for version 2.8.2
2022-02-24 14:57:08 +00:00
Harry Maclean
fc351fbd64
Ruby: Remove value-flow for name-matched summaries
...
String summaries that are identified by name only should not specify
value-preserving flow as this can cause spurious flow in cases where
they are applied to different but identically-named methods.
2022-02-24 16:15:15 +13:00
Harry Maclean
07369916b0
Ruby: Remove bad flow to/from block arguments
...
In these cases there is no block argument to the method call.
2022-02-24 14:44:59 +13:00
Asger Feldthaus
f1bfb31403
Shared: fix typo in a comment
2022-02-23 14:13:41 +01:00
Asger Feldthaus
bb9348d77f
Ruby: reject ArrayElement[-n] instead of interpreting it as ArrayElement[?]
2022-02-23 14:13:41 +01:00
Asger Feldthaus
a11c6f0f8e
Ruby: use AccessPathSyntax library
2022-02-23 14:13:40 +01:00
Asger Feldthaus
5cab737ef1
Shared: sync AccessPathSyntax.qll
2022-02-23 14:13:40 +01:00
Arthur Baars
69ed121ecb
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-22 16:15:33 +01:00
Harry Maclean
340288e0d4
Ruby: Update summary access paths for dot syntax
2022-02-22 16:41:16 +13:00
Harry Maclean
d180a55b3a
Ruby: Fix value/taint flow in String summaries
2022-02-22 16:41:16 +13:00
Harry Maclean
f07ae35b87
Ruby: Fix bug with String flow summaries
...
Split summaries for methods with optional block parmaters into separate
classes. Also model the `exclusive` argument to `String#upto`.
2022-02-22 16:41:16 +13:00
Harry Maclean
379de5581d
Ruby: Disable summaries that clash with Array
...
Some String methods are named identically to Array methods, and this
leads to overlapping flow summaries. These adversely affect the original
Array flow summaries.
2022-02-22 16:41:15 +13:00
Harry Maclean
fef46e1ee4
Ruby: Add flow summaries for String methods
2022-02-22 16:41:15 +13:00
Asger F
02c4966109
Merge pull request #7878 from asgerf/dot-separated-access-paths
...
Shared: Switch to dot-separated access paths in summary specs
2022-02-21 13:29:09 +01:00
Alex Ford
9196b64d6e
Merge pull request #8138 from github/ruby/file-write
...
Ruby: Implement `FileSystemWriteAccess` concept
2022-02-21 10:13:27 +00:00
Alex Ford
746290d903
Merge pull request #7713 from github/ruby/clear-text-logging
...
Ruby: Add `rb/clear-text-logging-sensitive-data` query
2022-02-21 10:12:33 +00:00
Asger Feldthaus
7848fcec80
Shared: sync AccessPathSyntax.qll
2022-02-21 08:21:53 +01:00
Asger Feldthaus
55ac5cb012
Shared: auto format
2022-02-21 08:21:53 +01:00
Asger Feldthaus
4985fbb526
Shared: update getSummaryCsv and related test output
2022-02-21 08:21:53 +01:00
Asger Feldthaus
dcc523a2b7
Shared: auto format
2022-02-21 08:21:53 +01:00
Asger Feldthaus
7fcbdbeada
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
2022-02-21 08:21:52 +01:00
Asger Feldthaus
2907d53e17
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
2022-02-21 08:21:52 +01:00
Asger Feldthaus
57bf0b1432
Ruby: remove support for legacy syntax
2022-02-21 08:21:51 +01:00
Asger Feldthaus
e3605eed44
Ruby: update CSV rows to dot-separated syntax
2022-02-21 08:21:50 +01:00
