erik-krogh
|
e01002368f
|
add query detecting validators that use badly anchored regular expressions on library/remote input
|
2023-01-30 16:34:20 +01:00 |
|
erik-krogh
|
f04a9cb523
|
Merge branch 'main' into rbRegConcept
|
2023-01-30 11:05:40 +01:00 |
|
Alex Ford
|
3dd9392f5e
|
Merge pull request #11869 from alexrford/rails/render_locals_shared
Ruby: Rails - generalize rails flow step for accessing render locals hash in view
|
2023-01-25 12:07:26 +00:00 |
|
erik-krogh
|
80d05c0425
|
also recognize protected methods as library-input sources
|
2023-01-24 20:55:25 +01:00 |
|
erik-krogh
|
a017b7500b
|
Merge branch 'main' into rbPoly
|
2023-01-24 20:51:36 +01:00 |
|
Erik Krogh Kristensen
|
240248b9cf
|
Merge pull request #11453 from erik-krogh/unsafeHtmlConstruction
RB: add unsafe-html-construction query
|
2023-01-23 16:40:25 +01:00 |
|
Erik Krogh Kristensen
|
5be97f3761
|
Merge pull request #11909 from erik-krogh/concatCode
Rb: recognize string concatenations as sinks for unsafe-code-construction
|
2023-01-23 16:22:46 +01:00 |
|
erik-krogh
|
7c6ee5f293
|
Merge branch 'main' into unsafeHtmlConstruction
|
2023-01-23 15:01:01 +01:00 |
|
Alex Ford
|
3b10a2de11
|
Merge branch 'main' into rails/render_locals_shared
|
2023-01-23 10:00:22 +00:00 |
|
Arthur Baars
|
99148244a4
|
Merge pull request #11856 from aibaars/update-grammars
Update grammars
|
2023-01-23 09:46:50 +01:00 |
|
Alex Ford
|
8fec4b804f
|
Ruby: StoredXSS test whitespace change
|
2023-01-20 13:40:19 +00:00 |
|
Alex Ford
|
fd8dd5e103
|
Ruby: update StoredXSS test output
|
2023-01-20 13:40:19 +00:00 |
|
Alex Ford
|
bea110b598
|
Ruby: remove blank line in test file
|
2023-01-20 13:40:19 +00:00 |
|
Alex Ford
|
b78ae1608e
|
Ruby: remove a fixed TODO
|
2023-01-20 13:40:19 +00:00 |
|
Alex Ford
|
e5fbc92856
|
Ruby: generalize rails flow step for accessing render locals hash in view
|
2023-01-20 13:40:19 +00:00 |
|
erik-krogh
|
25e65e0d9f
|
rewrite the regexp tracking DataFlow::Configuration to TypeTracking
|
2023-01-18 10:10:36 +01:00 |
|
erik-krogh
|
2fceee4e35
|
track regular expressions that gets compiled with Regexp.compile
|
2023-01-18 09:31:04 +01:00 |
|
erik-krogh
|
acf28ebd98
|
add a RegexExecution, and use it to track regular expressions to their uses in a nice way in rb/polynomial-redos
|
2023-01-18 09:31:04 +01:00 |
|
erik-krogh
|
6e33dd5df6
|
add failing test
|
2023-01-18 09:31:04 +01:00 |
|
erik-krogh
|
8251ad5e99
|
add unsafe-html-construction query
|
2023-01-17 15:35:17 +01:00 |
|
erik-krogh
|
a562568522
|
add string concat as a sink for command-construction
|
2023-01-17 14:48:09 +01:00 |
|
erik-krogh
|
8fc3b268e8
|
add string concat as a sink for code-construction
|
2023-01-17 14:48:06 +01:00 |
|
Erik Krogh Kristensen
|
59a8b21851
|
Merge pull request #10862 from erik-krogh/unsafeCodeConstruction
Rb: Add an `unsafe-code-construction` query
|
2023-01-16 13:22:58 +01:00 |
|
Arthur Baars
|
46063c7d04
|
Ruby: update expected output
|
2023-01-13 10:22:41 +01:00 |
|
Tony Torralba
|
c9d1cd97fb
|
Ruby: Remove omittable exists variables
|
2023-01-10 13:39:49 +01:00 |
|
erik-krogh
|
19d2b49562
|
drive-by: make Base64.decode64(..) into a flowsummary that is shared with all queries
|
2023-01-06 09:04:37 +01:00 |
|
erik-krogh
|
1a27441cfb
|
drive-by: delete code-execution sinks from unsafe-deserialization, we risked duplicate alerts
|
2023-01-06 09:04:36 +01:00 |
|
erik-krogh
|
0e6028a7f3
|
add stdin as source for unsafe-deserialization
|
2023-01-06 09:04:36 +01:00 |
|
erik-krogh
|
f98ff65b11
|
use eval() instead of send() in test
|
2023-01-05 20:04:04 +01:00 |
|
Arthur Baars
|
0f313231bc
|
AlertSuppression: add more tests
|
2022-12-19 16:43:11 +01:00 |
|
Arthur Baars
|
c176606be5
|
AlertSuppression: allow //lgtm comments to scope over the next line
|
2022-12-19 16:10:26 +01:00 |
|
Arthur Baars
|
016c7a8ca7
|
Merge pull request #11719 from aibaars/alert-suppression-shared
Shared AlertSuppression library
|
2022-12-19 16:04:44 +01:00 |
|
Arthur Baars
|
06736e3e91
|
Add .gitattributes for Windows test files
|
2022-12-19 12:39:01 +01:00 |
|
erik-krogh
|
db49cfb723
|
Merge branch 'main' into kernelLoad
|
2022-12-19 09:46:25 +01:00 |
|
Tom Hvitved
|
5d9c64ba6f
|
Ruby: Model flow through initialize constructors
|
2022-12-14 12:57:39 +01:00 |
|
erik-krogh
|
ccf520a5cd
|
Merge branch 'main' into unsafeCodeConstruction
|
2022-12-13 18:31:49 +01:00 |
|
Peter Stöckli
|
03fff2709b
|
Add suggestions to fix FileJoinSanitizer
|
2022-12-09 09:42:44 +01:00 |
|
Peter Stöckli
|
0d8c82009c
|
Merge branch 'main' into p--ruby-kernel-open-addition
|
2022-12-09 07:54:56 +01:00 |
|
erik-krogh
|
8f0c0f3c17
|
add support for super calls to Kernel
|
2022-12-06 14:25:51 +01:00 |
|
erik-krogh
|
66946ebf6a
|
add Kernel methods as sinks to path-injection
|
2022-12-06 14:09:15 +01:00 |
|
Harry Maclean
|
375403fb9d
|
Merge pull request #11114 from hmac/case-barrier-guard-3
Ruby: Add case string comparison barrier guard
|
2022-11-30 11:21:07 +13:00 |
|
erik-krogh
|
7dcb813ff3
|
remove two more claseses of FPs in rb/non-constant-kernel-open
|
2022-11-29 12:49:23 +01:00 |
|
Peter Stöckli
|
6b1865d2ca
|
Merge branch 'main' into p--ruby-kernel-open-addition
|
2022-11-29 10:19:36 +01:00 |
|
Peter Stöckli
|
5b6dd786c3
|
Add changes for NonConstantKernelOpenQuery
|
2022-11-29 10:00:57 +01:00 |
|
Peter Stöckli
|
d8752a0b12
|
Add additional sinks to the rb/kernel-open query
|
2022-11-29 10:00:56 +01:00 |
|
Nick Rolfe
|
8a94cabdbf
|
Merge pull request #11250 from github/nickrolfe/stack-trace-exposure
Ruby: add stack-trace exposure query
|
2022-11-28 10:45:59 +00:00 |
|
erik-krogh
|
378cc1aed2
|
add support for string-like-literals
|
2022-11-25 10:32:06 +01:00 |
|
erik-krogh
|
80c92dc3e6
|
add support for array pushes
|
2022-11-25 10:32:05 +01:00 |
|
erik-krogh
|
3461404bbb
|
add basic support for arrays
|
2022-11-25 10:31:35 +01:00 |
|
erik-krogh
|
2033dd2dcc
|
remove parameters named "code" as source
|
2022-11-25 10:25:31 +01:00 |
|