Tom Hvitved
978a816f11
Ruby: Track types in data flow
2025-01-06 13:26:10 +01:00
Joe Farebrother
07f03be8cc
Add unit tests
2024-06-12 15:11:35 +01:00
Anders Schack-Mulligen
7cc8fd00aa
Ruby: Update expected output (uninteresting).
2024-04-12 09:20:35 +02:00
Tom Hvitved
914a605a87
Ruby: Rework hidden synthetic data-flow nodes
2024-02-27 15:33:58 +01:00
Anders Schack-Mulligen
35a3aa0a09
Ruby: Add empty provenance column to expected files.
2024-02-09 11:32:08 +01:00
Anders Schack-Mulligen
09d4fe21e8
Ruby: Update more expected output.
2023-04-26 13:37:07 +02:00
Anders Schack-Mulligen
90f84bb516
Ruby: Update expected output.
2023-04-26 13:08:16 +02:00
Tom Hvitved
b816c79248
Ruby: Include all assignments in data flow paths
2023-03-24 10:09:30 +01:00
Tom Hvitved
9d3863eccc
Ruby: Rely on built-in hash-flow in clear text storage query
2023-03-16 14:55:06 +01:00
Tom Hvitved
ae10e6e08f
Ruby: Add a test that shows FP/FN for clear text logging query
2023-03-16 14:38:45 +01:00
erik-krogh
a0725fba71
fix some more style-guide violations in the alert-messages
2022-10-07 12:01:03 +02:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
erik-krogh
79a048968e
make the alert messages of taint-tracking queries more consistent
2022-09-07 12:22:50 +02:00
Alex Ford
0f0a51e2e0
Ruby: update test output
2022-03-10 18:27:06 +00:00
Alex Ford
43fb759dfa
Ruby: add a few more rb/clear-text-storage-sensitive-data test cases
2022-03-10 17:52:50 +00:00
Alex Ford
37c0702cdd
Ruby: update test output
2022-03-10 17:50:29 +00:00
Alex Ford
0f3cf47ca9
Ruby/JS/Py: Add "random" to the notSensitiveRegexp() heuristic
2022-03-10 17:38:52 +00:00
Alex Ford
8be1be388e
Ruby: update CleartextStorage test output for source locations
2022-03-10 17:38:52 +00:00
Alex Ford
ef29a372a4
Ruby: Cleartext storage tests
2022-03-10 17:38:52 +00:00
Harry Maclean
07c70adde5
Ruby: Update CleartextLogging fixture
...
The flow summary for `String#sub` leads to two new results in this test.
They are duplicates of existing results, because the query is quite
liberal in what it considers a source.
```ruby
password = "abc"
password_masked = password.sub(/./, "x")
Logger.new(STDOUT).info password_masked
```
In the example above, the query considers lines 1 and 2 to both be
sources, with a sink at line 3. Previously there was no flow from line 1
to line 3 because of the missing flow summary for `String#sub`, and
therefore there was just one result. Now we have the flow summary, there
are two results.
Line 2 is considered a source because it is an assignment to a variable
that contains the term "password". I'm not sure how to adjust the query
to avoid these duplicates, so I'm leaving them in for now.
2022-02-22 16:58:41 +13:00
Alex Ford
7c1bd9a533
Ruby: add a test case for cleartext logging that uses NonCleartextPasswordFlow
2022-02-10 15:50:56 +00:00
Alex Ford
59ab384825
Ruby: rb/clear-text-logging-sensitive-data - match on CFG nodes rather than AST nodes
2022-02-10 15:50:56 +00:00
Alex Ford
7ed447842f
Ruby: cleartext logging test output
2022-01-28 17:24:56 +00:00
Alex Ford
91ccd307e8
Ruby: Implement rb/clear-text-logging-sensitive-data
2022-01-28 17:24:56 +00:00
