Tom Hvitved
978a816f11
Ruby: Track types in data flow
2025-01-06 13:26:10 +01:00
Tom Hvitved
f287216060
Update expected test output
2024-09-24 14:21:38 +02:00
Anders Schack-Mulligen
012b861ffb
Ruby: Accept qltest .expected file changes.
2024-05-22 10:08:59 +02:00
Anders Schack-Mulligen
7cc8fd00aa
Ruby: Update expected output (uninteresting).
2024-04-12 09:20:35 +02:00
erik-krogh
c60cec36d4
add calls to .html_safe? as a shared XSS sanitizer
2024-03-22 17:46:39 +01:00
Joe Farebrother
0b7b7ea1b8
Add test cases and improve controller model
2024-03-01 09:57:24 +00:00
Tom Hvitved
914a605a87
Ruby: Rework hidden synthetic data-flow nodes
2024-02-27 15:33:58 +01:00
Harry Maclean
5af58d24e0
Ruby: Recognise raw Erb output as XSS sink
2024-02-12 13:28:44 +00:00
Anders Schack-Mulligen
35a3aa0a09
Ruby: Add empty provenance column to expected files.
2024-02-09 11:32:08 +01:00
Tom Hvitved
e258324960
Ruby: Allow for implicit array reads at all sinks during taint tracking
2023-09-14 09:40:05 +02:00
Alex Ford
593d9a48d4
Ruby: configsig rb/reflected-xss
2023-09-03 17:20:05 +01:00
Anders Schack-Mulligen
ae24d68b5d
C/C++/C#/Java/Python/Ruby/Swift: Adjust expected output.
2023-07-19 11:41:15 +02:00
Asger F
86b5f0adc7
Revert "Merge pull request #13620 from github/revert-13496-rb/tracking-on-demand"
...
This reverts commit 133de56ac228a8e48351
2023-07-07 09:42:34 +02:00
Asger F
5d1a437e9c
Revert "Ruby: overhaul API graphs"
2023-06-29 15:39:19 +02:00
Asger F
ce0073b30c
Ruby: update StoredXSS test results
...
These results were previously flagged for the wrong reason.
Calls to a user-define method were seen as ORM calls. The real source is inside the user-defined method, but we miss that due to lack of 'self' handling in ORM tracking.
2023-06-19 12:15:57 +02:00
Anders Schack-Mulligen
09d4fe21e8
Ruby: Update more expected output.
2023-04-26 13:37:07 +02:00
Anders Schack-Mulligen
90f84bb516
Ruby: Update expected output.
2023-04-26 13:08:16 +02:00
Tom Hvitved
b816c79248
Ruby: Include all assignments in data flow paths
2023-03-24 10:09:30 +01:00
Alex Ford
3dd9392f5e
Merge pull request #11869 from alexrford/rails/render_locals_shared
...
Ruby: Rails - generalize rails flow step for accessing render locals hash in view
2023-01-25 12:07:26 +00:00
Alex Ford
8fec4b804f
Ruby: StoredXSS test whitespace change
2023-01-20 13:40:19 +00:00
Alex Ford
fd8dd5e103
Ruby: update StoredXSS test output
2023-01-20 13:40:19 +00:00
Alex Ford
bea110b598
Ruby: remove blank line in test file
2023-01-20 13:40:19 +00:00
Alex Ford
b78ae1608e
Ruby: remove a fixed TODO
2023-01-20 13:40:19 +00:00
Alex Ford
e5fbc92856
Ruby: generalize rails flow step for accessing render locals hash in view
2023-01-20 13:40:19 +00:00
erik-krogh
8251ad5e99
add unsafe-html-construction query
2023-01-17 15:35:17 +01:00
erik-krogh
c13e8e4f48
Merge branch 'main' into formatTaint
2022-10-20 10:46:16 +02:00
erik-krogh
8a3e255e12
remove FPs in rb/stored-xss from spurious sources
2022-10-18 11:07:48 +02:00
erik-krogh
5a98f66bef
simplify the modeling of html_safe. Any call to html_safe is now considered an XSS sink
2022-10-18 10:43:22 +02:00
erik-krogh
d4919d04ba
add a taint-step for format-calls
2022-10-17 13:16:38 +02:00
Harry Maclean
0e6322d673
Ruby: Restrict XSS header sinks
...
Not all header writes are relevant to XSS. Restrict these to just
content-type and access-control-allow-origin.
2022-10-17 09:34:44 +13:00
Harry Maclean
8ae86cf443
Ruby: Consider header writes as XSS sinks
2022-10-17 08:17:37 +13:00
Harry Maclean
4686718630
Ruby: Add kind to Http::Server::RequestInputAccess
...
Like in JS, this describes whether the input came from the request URL,
body, parameters, headers or cookie. Only some of these are relevant for
UrlRedirect and ReflectedXSS queries.
2022-10-13 13:24:16 +13:00
Arthur Baars
09bc78eafc
Ruby: local dataflow step for || and &&
2022-10-04 12:58:49 +02:00
Harry Maclean
9f99a3ca1f
Ruby: Model sanitize ActionView helper
2022-09-26 20:56:11 +13:00
Harry Maclean
1d693d336f
Ruby: Model javascript_include_tag and friends
2022-09-26 20:56:09 +13:00
Harry Maclean
ed0c85e3af
Ruby: Model ActionView helper XSS sinks
2022-09-26 20:55:04 +13:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
erik-krogh
79a048968e
make the alert messages of taint-tracking queries more consistent
2022-09-07 12:22:50 +02:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
Arthur Baars
68aeb2ba85
Update test output
2022-05-20 16:30:58 +02:00
Tom Hvitved
400802c5ce
Ruby: Add flow summaries for Array/Enumerable methods
2021-12-22 15:56:20 +01:00
Tom Hvitved
5735bb698d
Ruby: Hide desugared nodes in data-flow paths
2021-12-08 09:00:16 +01:00
Harry Maclean
356828cd51
Update stored XSS fixture
...
The change to `self` modelling finds more true positives in this query.
2021-10-20 13:30:51 +01:00
Arthur Baars
976daddd36
Move files to ruby subfolder
2021-10-15 11:47:28 +02:00
