Erik Krogh Kristensen
7fb3d81d2f
add further normalization of char classses
2022-06-23 14:36:25 +02:00
thiggy1342
c5bf1b8aab
update test expectation
2022-06-20 17:27:33 +00:00
thiggy1342
7932d3e4ab
Update ruby/ql/test/query-tests/security/decompression-api/DecompressionApi.expected
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 11:05:56 -04:00
thiggy1342
b4c893d857
Update ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 09:50:12 -04:00
Harry Maclean
7dfab371f6
Ruby: Model redirect_back and redirect_back_or_to
...
These are ActionController methods that redirect to the HTTP Referer,
falling back to the given location if there is no Referer.
2022-06-20 13:36:02 +12:00
thiggy1342
7c2b19baad
tweaks and add Zip::File.open_buffer to query
2022-06-17 02:43:54 +00:00
thiggy1342
01cb408393
Merge branch 'main' into experimental-decompression-api
2022-06-16 17:23:55 -04:00
thiggy1342
b078430faf
add Zip::File.new query to tests
2022-06-16 00:51:50 +00:00
thiggy1342
0281dbd532
remove Zip::Entry.extract from query
2022-06-16 00:04:31 +00:00
thiggy1342
0fce620536
Merge branch 'main' into experimental-decompression-api
2022-06-14 21:54:08 -04:00
thiggy1342
df226ee610
remove standalone archive api query
2022-06-15 01:39:47 +00:00
thiggy1342
0832e299f2
move archive api path traversal tests to cwe-022
2022-06-15 01:39:47 +00:00
thiggy1342
af6fbd439c
Merge branch 'main' into experimental-archive-api
2022-06-14 20:09:02 -04:00
Alex Ford
8d195e3188
Merge pull request #9157 from alexrford/crypto-op-block-mode
...
Ruby/Python: Add a `BlockMode` concept for `CryptographicOperations`
2022-06-13 21:32:36 +02:00
thiggy1342
c7e67eb2e2
expand test coverage for sanitizers
2022-06-10 21:30:41 +00:00
thiggy1342
62291124ff
remove constraint for Zip::File.open
2022-06-06 21:20:44 +00:00
thiggy1342
3c62271dba
fix casing of Api
2022-06-06 21:18:08 +00:00
thiggy1342
074583eab8
add archive api file open query and test
2022-06-06 21:09:57 +00:00
thiggy1342
c5db11ee2e
use select placeholder correctly
2022-06-06 14:01:02 +00:00
thiggy1342
6cb0717a07
Fix test syntax for sanitizer tests
2022-06-04 16:33:18 +00:00
thiggy1342
c5dc8779d1
Increased query robustness and test coverage
2022-06-03 18:05:56 +00:00
thiggy1342
09f082081f
Simple tests passing
2022-05-28 23:29:58 +00:00
thiggy1342
39baadbdd2
test ql packs must be in the security directory
2022-05-28 23:19:32 +00:00
Tom Hvitved
a7b39ebeca
Ruby: Flow through hash-splat parameters
2022-05-25 12:37:22 +02:00
Tom Hvitved
faf24a4f18
Ruby: Data-flow through hashes
2022-05-24 14:27:55 +02:00
Arthur Baars
68aeb2ba85
Update test output
2022-05-20 16:30:58 +02:00
Alex Ford
4752c45fe5
ruby: update rb/weak-cryptographic-algorithm to specify the block mode if appropriate
2022-05-13 16:32:30 +01:00
Harry Maclean
ba1d43dd42
Merge pull request #8658 from hmac/hmac/insecure-download
...
Ruby: Add InsecureDownload query
2022-04-28 11:07:35 +12:00
Harry Maclean
6998608257
Ruby: Document missing test result
2022-04-27 12:47:09 +12:00
Harry Maclean
bb3fb0325b
Ruby: Add InsecureDownload query
...
This query finds cases where a potentially unsafe file is downloaded
over an unsecured connection.
2022-04-27 12:47:09 +12:00
Harry Maclean
2feb4a48be
Ruby: Add hasMisleadingAnchorPrecedence to MissingRegExpAnchor
2022-04-27 10:12:33 +12:00
Harry Maclean
e3c3c00c68
Ruby: Add MissingRegExpAnchor query
2022-04-27 10:12:33 +12:00
Nick Rolfe
9b6e610e24
Merge remote-tracking branch 'origin/main' into nickrolfe/incomplete_sanitization
2022-04-20 12:05:22 +01:00
Harry Maclean
c3f1fba985
Merge pull request #8598 from hmac/hmac/insecure-dep-resolution
...
Ruby: Add rb/insecure-dependency query
2022-04-14 02:09:44 +02:00
Nick Rolfe
fdca896614
Ruby: improve handling of [g]sub!
...
rb/incomplete-sanitization has a few cases where we find flow from one
one string substitution call to another, e.g.
a.sub(...).sub(...)
But this didn't find typical chained uses of the destructive variants,
e.g.
a.sub!(...)
a.sub!(...)
We now handle those cases by tracking flow from the post-update node for
the receiver of the first call.
2022-04-13 17:19:25 +01:00
Nick Rolfe
bbb8177176
Ruby: add rc/incomplete-sanitization query
2022-04-13 16:48:43 +01:00
Harry Maclean
8f3578c92a
Ruby: Include query results in test
2022-04-05 10:20:02 +12:00
Harry Maclean
3d96c5e6db
Ruby: Add test case for rb/insecure-dependency
...
This tests that we recognise kwargs in hashrocket style:
gem "foo", "1.2.3", :git => "..."
as well as the modern style:
gem "foo", "1.2.3", git: "..."
2022-04-01 15:30:07 +13:00
Alex Ford
882f78c6f9
Merge remote-tracking branch 'origin/main' into ruby/weak-cryptographic-algorithm
2022-03-31 17:17:46 +01:00
Arthur Baars
15c54f6100
Merge pull request #8354 from aibaars/incomplete-url-string-sanitization
...
Incomplete url string sanitization
2022-03-31 10:59:51 +02:00
Harry Maclean
37cedda63a
Ruby: Add InsecureDependencyResolution query
...
This query looks for places in a Gemfile where URLs with insecure
protocols (HTTP or FTP) are specified.
2022-03-30 13:39:15 +13:00
Arthur Baars
74aea81fe3
Ruby: refactor regex libraries
2022-03-24 11:37:02 +01:00
Arthur Baars
65f8f56095
Merge branch 'main' into incomplete-url-string-sanitization
2022-03-24 11:27:30 +01:00
Arthur Baars
06a99c3987
Ruby: fix location of setter-call argument
2022-03-23 12:55:52 +01:00
Harry Maclean
ff1d96c922
Ruby: Add rb/http-to-file-access query
2022-03-22 11:09:08 +13:00
Harry Maclean
6c18e1d7ac
Merge pull request #8272 from hmac/hmac/tainted-format-string
2022-03-22 08:37:47 +13:00
Alex Ford
c891c53835
Merge pull request #8395 from alexrford/ruby/clear-text-storage
...
Ruby: add `rb/clear-text-storage-sensitive-data` query
2022-03-21 10:05:39 +00:00
Harry Maclean
5a6da827d0
Ruby: Avoid FP in TaintedFormatString query
...
Kernel#printf supports two call signatures:
printf(String, *args)
printf(IO, String, *args)
We want to identify the String argument, which is the format string.
Previously we would return the 0th and 1st arguments, which gives some
FPs when the 1st arg is not a format string.
We now try to rule out the trivial case by checking if arg 0 has a
string value, and then assuming it is the format string. Otherwise we
fall back to returning both arguments.
This still has some false positive potential, but less than previously.
2022-03-21 12:51:47 +13:00
Harry Maclean
4249e30824
Ruby: Test tainted interpolated format arg
2022-03-21 12:51:18 +13:00
Harry Maclean
f6215d4c7e
Ruby: Add rb/tainted-format-string query
2022-03-21 12:51:18 +13:00
