Nora Dimitrijević
e32982057c
Ruby: convert CommandInjection test to .qlref
2025-06-24 14:57:54 +02:00
Tom Hvitved
978a816f11
Ruby: Track types in data flow
2025-01-06 13:26:10 +01:00
Tom Hvitved
ed9008a064
Update expected test output
2024-09-18 13:51:02 +02:00
Anders Schack-Mulligen
5d51b5b97b
Ruby: Add support for pretty-printed provenace in tests. Convert one test.
2024-06-07 11:47:48 +02:00
Tom Hvitved
04de315e0e
Ruby: Deprecate models-as-data CSV interface
2024-04-12 13:40:14 +02:00
Anders Schack-Mulligen
7cc8fd00aa
Ruby: Update expected output (uninteresting).
2024-04-12 09:20:35 +02:00
Harry Maclean
8bed3fbed4
Ruby: Add basic model for Terrapin library
2024-02-26 11:32:41 +00:00
Anders Schack-Mulligen
35a3aa0a09
Ruby: Add empty provenance column to expected files.
2024-02-09 11:32:08 +01:00
Harry Maclean
5411123b8a
Ruby: Fix GraphQL test
2023-09-14 14:14:26 +01:00
Anders Schack-Mulligen
09d4fe21e8
Ruby: Update more expected output.
2023-04-26 13:37:07 +02:00
Anders Schack-Mulligen
90f84bb516
Ruby: Update expected output.
2023-04-26 13:08:16 +02:00
Peter Stöckli
2f268b309b
Ruby: improve non-constant-kernel-open, freeze called on constant
2023-04-18 11:24:01 +02:00
Peter Stöckli
0a6bb3f7ce
Ruby: improve non-constant-kernel-open, no FP's on open without arguments
2023-04-18 10:10:36 +02:00
Tom Hvitved
b816c79248
Ruby: Include all assignments in data flow paths
2023-03-24 10:09:30 +01:00
erik-krogh
36b33765a5
use allowImplicitRead instead of a taint-step from elements to the array
2023-02-28 16:09:52 +01:00
erik-krogh
962465f77a
add array-taint-steps to unsafe-shell-command-construction
2023-01-30 16:56:03 +01:00
erik-krogh
a562568522
add string concat as a sink for command-construction
2023-01-17 14:48:09 +01:00
Peter Stöckli
03fff2709b
Add suggestions to fix FileJoinSanitizer
2022-12-09 09:42:44 +01:00
Peter Stöckli
0d8c82009c
Merge branch 'main' into p--ruby-kernel-open-addition
2022-12-09 07:54:56 +01:00
Harry Maclean
375403fb9d
Merge pull request #11114 from hmac/case-barrier-guard-3
...
Ruby: Add case string comparison barrier guard
2022-11-30 11:21:07 +13:00
erik-krogh
7dcb813ff3
remove two more claseses of FPs in rb/non-constant-kernel-open
2022-11-29 12:49:23 +01:00
Peter Stöckli
5b6dd786c3
Add changes for NonConstantKernelOpenQuery
2022-11-29 10:00:57 +01:00
Peter Stöckli
d8752a0b12
Add additional sinks to the rb/kernel-open query
2022-11-29 10:00:56 +01:00
erik-krogh
88de299e12
add join(" ") calls as a sink for rb/shell-command-constructed-from-input
2022-11-09 21:46:25 +01:00
Harry Maclean
4bc9096446
Ruby: Add case string comparison barrier guard
...
This recognises barriers of the form
STRINGS = ["foo", "bar"]
case foo
when "some string literal"
foo
when *["other", "strings"]
foo
when *STRINGS
foo
end
where the reads of `foo` inside each `when` are guarded by the comparison
of `foo` with the string literals.
We don't yet recognise this construct:
case foo
when "foo", "bar"
foo
end
This is due to a limitation in the shared barrier guard logic.
2022-11-09 15:03:13 +13:00
erik-krogh
f3741ff1e4
changes based on review
2022-11-03 09:41:05 +01:00
erik-krogh
7797211118
Merge branch 'main' into unsafeRbCmd
2022-10-20 10:34:17 +02:00
erik-krogh
557dd10896
add a rb/unsafe-shell-command-construction query
2022-10-11 13:26:01 +02:00
erik-krogh
99b90789e5
add .shellescape as a sanitizer for rb/command-injection
2022-10-11 13:05:19 +02:00
erik-krogh
b16b3c0394
move cwe-078 tests into subfolders
2022-10-11 13:05:19 +02:00
erik-krogh
186205bd4b
add a test for explicit shell invocations using Kernel.open
2022-10-11 09:23:29 +02:00
erik-krogh
de3b15ebe9
add a query flagging uses of Kernel.open that are not with a constant string
2022-10-11 09:23:29 +02:00
erik-krogh
708f6b51f3
move cwe-078 tests into subfolders
2022-10-11 09:23:29 +02:00
erik-krogh
dedbe66619
update expected output
2022-10-04 14:16:07 +02:00
erik-krogh
bf74481f65
add a link to the source in the alert-message for rb/kernel-open
2022-10-04 13:41:50 +02:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
Tom Hvitved
a7b39ebeca
Ruby: Flow through hash-splat parameters
2022-05-25 12:37:22 +02:00
Jeff Gran
47697f59c1
Ruby: Add classes for detecting user input from graphql-ruby
2022-01-18 09:13:58 -07:00
Tom Hvitved
400802c5ce
Ruby: Add flow summaries for Array/Enumerable methods
2021-12-22 15:56:20 +01:00
Arthur Baars
976daddd36
Move files to ruby subfolder
2021-10-15 11:47:28 +02:00
