erik-krogh
d77b31672d
add failing test for safe-ish uses of Object.send
2022-10-19 11:27:08 +02:00
erik-krogh
cb33d5aeff
add test for .send(..) in code-injection
2022-10-19 11:25:30 +02:00
erik-krogh
e29bf8ced2
Merge branch 'main' into html_safe
2022-10-18 19:49:37 +02:00
Tom Hvitved
61b9065135
Ruby: Fix syntax error in a test
2022-10-18 16:49:32 +02:00
erik-krogh
8a3e255e12
remove FPs in rb/stored-xss from spurious sources
2022-10-18 11:07:48 +02:00
erik-krogh
e47e20c5e7
remove use of HtmlSafeCall from tests
2022-10-18 10:43:24 +02:00
erik-krogh
5a98f66bef
simplify the modeling of html_safe. Any call to html_safe is now considered an XSS sink
2022-10-18 10:43:22 +02:00
erik-krogh
bb4bc55c6a
update expected output
2022-10-17 15:52:21 +02:00
erik-krogh
f09e3bd3ac
add String#% as a printf like call
2022-10-17 13:51:43 +02:00
Arthur Baars
f7ff2cdc0d
Merge branch 'main' into actiondispatch-response
2022-10-17 13:22:17 +02:00
erik-krogh
d4919d04ba
add a taint-step for format-calls
2022-10-17 13:16:38 +02:00
Erik Krogh Kristensen
122d188f1d
Merge pull request #10832 from erik-krogh/passRb
...
RB: add model for the `Digest` and `OpenSSL::Digest` modules
2022-10-17 10:02:33 +02:00
Harry Maclean
aa6c433529
Ruby: Update test fixture
...
This change is due to a8fdda65fb
2022-10-17 09:44:32 +13:00
Harry Maclean
0e6322d673
Ruby: Restrict XSS header sinks
...
Not all header writes are relevant to XSS. Restrict these to just
content-type and access-control-allow-origin.
2022-10-17 09:34:44 +13:00
Harry Maclean
8ae86cf443
Ruby: Consider header writes as XSS sinks
2022-10-17 08:17:37 +13:00
Harry Maclean
73ca595b56
Ruby: Model ActionDispatch::Response
2022-10-17 08:17:37 +13:00
Arthur Baars
ae0c9b76e0
Merge pull request #10843 from aibaars/fix-self
...
Ruby: fix self variables in blocks
2022-10-15 00:48:14 +02:00
Alex Ford
2c5129e720
Merge pull request #10369 from alexrford/rb/sensitive-get-query
...
Ruby: add `rb/sensitive-get-query` query
2022-10-14 22:34:47 +01:00
Arthur Baars
a8fdda65fb
Ruby: fix self variables in blocks
2022-10-14 16:02:39 +02:00
Asger F
8cb4f230d8
Merge branch 'main' into rb/fix-spurious-singleton-calls
2022-10-14 15:52:38 +02:00
Asger F
1bd3d29409
Ruby: workaround issue with 'def self.method' in a block
2022-10-14 15:07:33 +02:00
Asger F
17a246b321
Ruby: more uninteresting test updates
2022-10-14 13:59:52 +02:00
erik-krogh
7c76645157
add model for the core OpenSSL::Digest module
2022-10-14 13:25:34 +02:00
erik-krogh
e2476949b9
add model for the core Digest module
2022-10-14 12:49:37 +02:00
Asger F
8228730634
Ruby: fix regression for methods in singleton classes
2022-10-14 11:57:35 +02:00
Alex Ford
3baad89e57
Merge remote-tracking branch 'origin/main' into rb/sensitive-get-query
2022-10-14 10:50:09 +01:00
Asger F
30f7380f74
Ruby: Add regression test for lost calls
2022-10-14 11:49:55 +02:00
Harry Maclean
7d23170fb2
Merge pull request #10602 from hmac/hmac/actiondispatch-request
...
Ruby: Model ActionDispatch::Request
2022-10-14 22:17:20 +13:00
Asger F
a06cc30f05
Ruby: fix some more spurious call edges
2022-10-14 10:11:22 +02:00
Asger F
b1dadc224c
Ruby: uninteresting test output update
2022-10-14 10:10:39 +02:00
Asger F
ae71828fc4
Ruby: add more tests for singleton up/down calls
2022-10-14 10:09:59 +02:00
Asger F
789f591de4
Ruby: add another spurious call edge test
2022-10-14 10:09:57 +02:00
Asger F
1476efbe2c
Ruby: restrict to a use of 'self' in singleton methods
2022-10-14 10:09:11 +02:00
Asger F
329ab9156a
Ruby: add test showing spurious call
2022-10-14 10:07:34 +02:00
Erik Krogh Kristensen
332bc35ff1
Merge pull request #10708 from erik-krogh/kernelSink
...
RB: add a query flagging uses of `Kernel.open()` that are not with a constant string
2022-10-14 09:13:26 +02:00
Harry Maclean
e6dc27a7b5
Add content_mime_type, fix env/filtered_env
2022-10-14 19:49:22 +13:00
Alex Ford
cda7d84633
Ruby: update rb/sensitive-get-query tests
2022-10-13 22:41:34 +01:00
Arthur Baars
a327802e43
Merge pull request #10801 from jsoref/spelling-ruby
...
Spelling ruby
2022-10-13 21:05:56 +02:00
Josh Soref
8078f91b28
spelling: mapping
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 10:56:41 -04:00
Alex Ford
594812640e
Merge pull request #10746 from alexrford/ruby/activejob-deserialize
...
Ruby: Add `ActiveJob::Serializers.deserialize` as a code execution sink
2022-10-13 15:36:45 +01:00
Erik Krogh Kristensen
3a1a94b8af
Merge pull request #10798 from erik-krogh/matchCaseReg
...
Rb: add case-when expressions as a sink to rb/polynomial-redos
2022-10-13 13:55:42 +02:00
Alex Ford
a65850e922
Merge pull request #10784 from alexrford/ruby/pathname-existence
...
Ruby: model `Pathname#existence` extension from `ActiveSupport`
2022-10-13 11:38:22 +01:00
erik-krogh
3a3a5aa17c
add case-in as a sink for polynomial-redos
2022-10-13 12:36:07 +02:00
Harry Maclean
a3c14f7f46
Update test
2022-10-13 13:57:28 +13:00
Harry Maclean
4686718630
Ruby: Add kind to Http::Server::RequestInputAccess
...
Like in JS, this describes whether the input came from the request URL,
body, parameters, headers or cookie. Only some of these are relevant for
UrlRedirect and ReflectedXSS queries.
2022-10-13 13:24:16 +13:00
Harry Maclean
ad464abde2
Ruby: Model more params accesses
2022-10-13 13:24:16 +13:00
erik-krogh
66b3fe3425
add case-when expressions as a sink to rb/polynomial-redos
2022-10-12 19:57:01 +02:00
Alex Ford
0536d4b540
Merge branch 'main' into ruby/activejob-deserialize
2022-10-12 15:04:12 +01:00
Asger F
83464d48a9
Merge pull request #10773 from asgerf/rb/bugfix-singleton-class-resolution
...
Ruby: bugfix in type-tracking singleton class resolution
2022-10-12 13:45:16 +02:00
Nick Rolfe
39107047bf
Merge pull request #10735 from github/nickrolfe/actionmailer
...
Ruby: add `ActionMailer#params` as a `RemoteFlowSource`
2022-10-12 10:21:11 +01:00
