Anders Schack-Mulligen
7cc8fd00aa
Ruby: Update expected output (uninteresting).
2024-04-12 09:20:35 +02:00
amammad
32f5667bb6
revert YAML.qll and yaml sinks to previous PR, make a separate experimental query only for yaml
2024-02-26 12:12:03 +00:00
amammad
c582ea626d
update expected test file
2024-02-26 12:10:04 +00:00
amammad
9c5c8c8362
fix test file
2024-02-26 12:05:35 +00:00
amammad
464e2e4291
fix qldoc and test files
2024-02-26 12:04:52 +00:00
amammad
1410574f76
make seperate steps for YAML.parse* and use getAsuccessor*() to reach final to_ruby method call, All parts have Rewritten with API graphs exclusively
2024-02-26 11:59:35 +00:00
Anders Schack-Mulligen
35a3aa0a09
Ruby: Add empty provenance column to expected files.
2024-02-09 11:32:08 +01:00
Peter Stöckli
09cf76a880
Ruby: additional unsafe deserialization sinks for ox, oj
2023-10-19 14:04:48 +02:00
Harry Maclean
b8c3cba4ff
Ruby: Consolidate unsafe deserialization queries
...
Merge the experimental YAMLUnsafeDeserialization and
PlistUnsafeDeserialization queries into the generate
UnsafeDeserialization query in the default suite.
These queries look for some specific sinks that we now find in the
general query.
Also apply some small code and comment refactors.
2023-05-27 01:20:04 +00:00
Anders Schack-Mulligen
09d4fe21e8
Ruby: Update more expected output.
2023-04-26 13:37:07 +02:00
Tom Hvitved
b816c79248
Ruby: Include all assignments in data flow paths
2023-03-24 10:09:30 +01:00
erik-krogh
19d2b49562
drive-by: make Base64.decode64(..) into a flowsummary that is shared with all queries
2023-01-06 09:04:37 +01:00
erik-krogh
1a27441cfb
drive-by: delete code-execution sinks from unsafe-deserialization, we risked duplicate alerts
2023-01-06 09:04:36 +01:00
erik-krogh
0e6028a7f3
add stdin as source for unsafe-deserialization
2023-01-06 09:04:36 +01:00
Alex Ford
3d08a2954d
Ruby: add rb/unsafe-deserialization sinks for const_get args
2022-10-11 15:45:51 +01:00
Alex Ford
a3f096a6bc
Ruby: rb/unsafe-deserialization test realignment
2022-10-11 15:44:00 +01:00
Alex Ford
b018706afd
Ruby: update rb/unsafe-deserialization tests
2022-09-26 11:28:24 +01:00
Alex Ford
364bc883ba
Ruby: add YAML.load_file as an unsafe deserialization sink
2022-09-23 15:54:15 +01:00
Nick Rolfe
2edbc16829
Ruby: add Hash.from_trusted_xml as an unsafe deserialization sink
2022-09-21 13:01:21 +01:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
erik-krogh
79a048968e
make the alert messages of taint-tracking queries more consistent
2022-09-07 12:22:50 +02:00
Tom Hvitved
400802c5ce
Ruby: Add flow summaries for Array/Enumerable methods
2021-12-22 15:56:20 +01:00
Arthur Baars
976daddd36
Move files to ruby subfolder
2021-10-15 11:47:28 +02:00
