Erik Krogh Kristensen
d3c3f2dc90
Merge pull request #12628 from erik-krogh/betterReDoS
...
ReDoS: better super-linear algorithm
2023-03-27 15:26:49 +02:00
Alex Ford
181e5d588d
Merge remote-tracking branch 'origin/rc/3.9' into main
2023-03-27 12:16:03 +01:00
Alex Ford
24aa16c919
Ruby: update rb/sensitive-get-query test output
2023-03-27 09:44:55 +01:00
Tom Hvitved
b816c79248
Ruby: Include all assignments in data flow paths
2023-03-24 10:09:30 +01:00
erik-krogh
b071d3557e
JS/PY/RB: add a worst-case test, that now performs OK
2023-03-22 10:13:18 +01:00
Erik Krogh Kristensen
af98ceb3c3
Merge pull request #11478 from erik-krogh/more-shell-taint
...
Rb: more taint-steps for shell-command-construction
2023-03-20 08:41:22 +01:00
Tom Hvitved
9d3863eccc
Ruby: Rely on built-in hash-flow in clear text storage query
2023-03-16 14:55:06 +01:00
Tom Hvitved
ae10e6e08f
Ruby: Add a test that shows FP/FN for clear text logging query
2023-03-16 14:38:45 +01:00
erik-krogh
2133d1a5ab
Merge branch 'main' into more-shell-taint
2023-03-15 10:54:30 +01:00
erik-krogh
25a6d496d9
Merge branch 'main' into HEAD
2023-03-13 17:33:06 +01:00
Harry Maclean
fe995dd99b
Ruby: ActiveRecord::Connection.execute SQL sink
2023-03-13 09:03:54 +13:00
Harry Maclean
025cd34dab
Ruby: Taint flow through ActionController params
...
We were not recognising "require" as returning a Parameters instance.
2023-03-13 08:52:41 +13:00
Harry Maclean
2d95b6a049
Ruby: Add count_by_sql as SQL sink
2023-03-13 08:40:32 +13:00
Harry Maclean
c97dccf0de
Ruby: Add reorder as a SQL sink
...
In recent versions of Rails this method doesn't seem to be vulnerable,
but it may be in previous versions. There's a slight FP risk here, but
I think it is small.
2023-03-13 08:38:17 +13:00
erik-krogh
31336b09c4
add summary for the Array method on Kernel
2023-03-01 12:53:13 +01:00
erik-krogh
36b33765a5
use allowImplicitRead instead of a taint-step from elements to the array
2023-02-28 16:09:52 +01:00
erik-krogh
b0797a2559
Merge branch 'main' into more-shell-taint
2023-02-27 18:27:09 +01:00
Harry Maclean
ae3d91b546
Ruby: First draft of rails callback flow
2023-02-21 19:26:36 +13:00
Tom Hvitved
e9bce9f8cd
Ruby: Update test expectations
2023-02-17 13:22:28 +01:00
erik-krogh
d2bd70dc33
Merge branch 'main' into more-shell-taint
2023-02-15 11:35:58 +01:00
Erik Krogh Kristensen
2f404df17c
Merge pull request #10782 from erik-krogh/rbPoly
...
Ruby: add library input as a source for `rb/polynomial-redos`
2023-02-13 12:26:07 +01:00
erik-krogh
634087b417
Merge branch 'main' into rbPoly
2023-02-13 10:46:00 +01:00
erik-krogh
c2e8206090
add more array taint steps that taint the entire array
2023-01-30 21:14:27 +01:00
erik-krogh
962465f77a
add array-taint-steps to unsafe-shell-command-construction
2023-01-30 16:56:03 +01:00
erik-krogh
e01002368f
add query detecting validators that use badly anchored regular expressions on library/remote input
2023-01-30 16:34:20 +01:00
erik-krogh
f04a9cb523
Merge branch 'main' into rbRegConcept
2023-01-30 11:05:40 +01:00
Alex Ford
3dd9392f5e
Merge pull request #11869 from alexrford/rails/render_locals_shared
...
Ruby: Rails - generalize rails flow step for accessing render locals hash in view
2023-01-25 12:07:26 +00:00
erik-krogh
80d05c0425
also recognize protected methods as library-input sources
2023-01-24 20:55:25 +01:00
erik-krogh
a017b7500b
Merge branch 'main' into rbPoly
2023-01-24 20:51:36 +01:00
Erik Krogh Kristensen
240248b9cf
Merge pull request #11453 from erik-krogh/unsafeHtmlConstruction
...
RB: add unsafe-html-construction query
2023-01-23 16:40:25 +01:00
Alex Ford
8fec4b804f
Ruby: StoredXSS test whitespace change
2023-01-20 13:40:19 +00:00
Alex Ford
fd8dd5e103
Ruby: update StoredXSS test output
2023-01-20 13:40:19 +00:00
Alex Ford
bea110b598
Ruby: remove blank line in test file
2023-01-20 13:40:19 +00:00
Alex Ford
b78ae1608e
Ruby: remove a fixed TODO
2023-01-20 13:40:19 +00:00
Alex Ford
e5fbc92856
Ruby: generalize rails flow step for accessing render locals hash in view
2023-01-20 13:40:19 +00:00
erik-krogh
25e65e0d9f
rewrite the regexp tracking DataFlow::Configuration to TypeTracking
2023-01-18 10:10:36 +01:00
erik-krogh
2fceee4e35
track regular expressions that gets compiled with Regexp.compile
2023-01-18 09:31:04 +01:00
erik-krogh
acf28ebd98
add a RegexExecution, and use it to track regular expressions to their uses in a nice way in rb/polynomial-redos
2023-01-18 09:31:04 +01:00
erik-krogh
6e33dd5df6
add failing test
2023-01-18 09:31:04 +01:00
erik-krogh
8251ad5e99
add unsafe-html-construction query
2023-01-17 15:35:17 +01:00
erik-krogh
a562568522
add string concat as a sink for command-construction
2023-01-17 14:48:09 +01:00
erik-krogh
8fc3b268e8
add string concat as a sink for code-construction
2023-01-17 14:48:06 +01:00
Erik Krogh Kristensen
59a8b21851
Merge pull request #10862 from erik-krogh/unsafeCodeConstruction
...
Rb: Add an `unsafe-code-construction` query
2023-01-16 13:22:58 +01:00
Tony Torralba
c9d1cd97fb
Ruby: Remove omittable exists variables
2023-01-10 13:39:49 +01:00
erik-krogh
19d2b49562
drive-by: make Base64.decode64(..) into a flowsummary that is shared with all queries
2023-01-06 09:04:37 +01:00
erik-krogh
1a27441cfb
drive-by: delete code-execution sinks from unsafe-deserialization, we risked duplicate alerts
2023-01-06 09:04:36 +01:00
erik-krogh
0e6028a7f3
add stdin as source for unsafe-deserialization
2023-01-06 09:04:36 +01:00
erik-krogh
f98ff65b11
use eval() instead of send() in test
2023-01-05 20:04:04 +01:00
erik-krogh
db49cfb723
Merge branch 'main' into kernelLoad
2022-12-19 09:46:25 +01:00
erik-krogh
ccf520a5cd
Merge branch 'main' into unsafeCodeConstruction
2022-12-13 18:31:49 +01:00
