Harry Maclean
2d95b6a049
Ruby: Add count_by_sql as SQL sink
2023-03-13 08:40:32 +13:00
Harry Maclean
c97dccf0de
Ruby: Add reorder as a SQL sink
...
In recent versions of Rails this method doesn't seem to be vulnerable,
but it may be in previous versions. There's a slight FP risk here, but
I think it is small.
2023-03-13 08:38:17 +13:00
Arthur Baars
858aa9ae63
Ruby: add some links to diagnostic messages
2023-03-07 17:55:13 +01:00
Arthur Baars
d2ab40c184
Merge pull request #12208 from gregxsunday/main
...
Add ZipSlip and TarSlip query to ruby
2023-03-06 10:40:06 +01:00
Arthur Baars
9e5ef9cf9d
Merge pull request #12216 from aibaars/diagnostics-2
...
Ruby: improve diagnostic messages
2023-03-02 10:30:58 +01:00
Arthur Baars
2c611d3fef
Address review comments
2023-03-01 13:30:02 +01:00
erik-krogh
31336b09c4
add summary for the Array method on Kernel
2023-03-01 12:53:13 +01:00
erik-krogh
36b33765a5
use allowImplicitRead instead of a taint-step from elements to the array
2023-02-28 16:09:52 +01:00
Arthur Baars
6c57823232
Merge branch 'main' into diagnostics-2
2023-02-27 19:00:03 +01:00
erik-krogh
b0797a2559
Merge branch 'main' into more-shell-taint
2023-02-27 18:27:09 +01:00
Maikypedia
ff50513441
Add initial query for Ruby SSTI
2023-02-25 15:33:23 +01:00
Grzegorz Niedziela
48007d14d5
move tests to experimental as well and fix .qlref reference
2023-02-24 10:38:21 +00:00
gregxsunday
5a85fa12c7
add block test cases and update tests
2023-02-23 12:09:22 +00:00
Grzegorz Niedziela
4ab6a7bdfd
Merge branch 'github:main' into main
2023-02-23 10:50:15 +00:00
Harry Maclean
ba4d0a81d5
Ruby: Simplify filter dataflow
...
This introduces some false flow (the `ThreeController` and
`FourController` examples in `filter_flow.rb`) but is simpler and
in line with how we model flow for normal method calls.
2023-02-21 19:28:53 +13:00
Harry Maclean
0a02b45ad7
Ruby: More filter flow steps
...
Add a jump step from the last self post-update node in a method to the self parameter of the
next method.
2023-02-21 19:28:26 +13:00
Harry Maclean
fae5320c3a
Ruby: Add filter flow tests
2023-02-21 19:27:53 +13:00
Harry Maclean
ae3d91b546
Ruby: First draft of rails callback flow
2023-02-21 19:26:36 +13:00
Arthur Baars
6fd836d3a9
Ruby: improve wording of error messages
2023-02-20 14:32:02 +01:00
Alex Ford
774030a8db
Merge pull request #12083 from pwntester/ruby_twirp_support
...
[Ruby] Add support for Twirp framework
2023-02-20 13:16:52 +00:00
Tom Hvitved
658cc33bb8
Merge pull request #12212 from hvitved/util/inline-expect-test-use-end-line
...
Util: Use end line instead of start line for actual results
2023-02-20 11:41:02 +01:00
Harry Maclean
4e07fd3eb1
Ruby: Model ApplicationController.renderer
2023-02-19 13:37:27 +13:00
Tom Hvitved
e9bce9f8cd
Ruby: Update test expectations
2023-02-17 13:22:28 +01:00
gregxsunday
d1aaa9ad86
Add ZipSlip/TarSlip query for ruby
2023-02-16 11:24:15 +00:00
Alex Ford
74782bf6a2
Merge branch 'main' into ruby_twirp_support
2023-02-15 17:15:08 +00:00
Alex Ford
801ed1ce7c
Ruby: add Twirp.expected
2023-02-15 17:05:33 +00:00
Rasmus Wriedt Larsen
c72dbc49fc
Merge pull request #12165 from RasmusWL/crypto-updates
...
Python/Ruby/JS Crypto: Add a few algorithms + block modes
2023-02-15 14:35:40 +01:00
erik-krogh
17f7ba2a8f
rewrite the taint-step for join() to a flowsummary
2023-02-15 12:34:59 +01:00
erik-krogh
d2bd70dc33
Merge branch 'main' into more-shell-taint
2023-02-15 11:35:58 +01:00
Harry Maclean
fb14920281
Merge pull request #12056 from hmac/test-refactor
2023-02-15 17:34:25 +13:00
Alvaro Muñoz
4644a88b89
address code review comments
2023-02-14 14:27:17 +01:00
Rasmus Wriedt Larsen
39e50f745d
Ruby: Fix .expected for CryptoAlgorithms
2023-02-13 14:21:12 +01:00
Anders Schack-Mulligen
e877b161d8
Merge pull request #12124 from hvitved/dataflow/stage1-dispatch
...
Data flow: Call context virtual dispatch pruning in stage 1
2023-02-13 13:13:43 +01:00
Arthur Baars
457a2bb2a2
Merge pull request #12093 from aibaars/oneline-match
...
Ruby: add support for one-line pattern matches
2023-02-13 12:38:28 +01:00
Erik Krogh Kristensen
2f404df17c
Merge pull request #10782 from erik-krogh/rbPoly
...
Ruby: add library input as a source for `rb/polynomial-redos`
2023-02-13 12:26:07 +01:00
Erik Krogh Kristensen
26d5fb2412
Merge pull request #11824 from erik-krogh/secondMissAnchor
...
RB: add query detecting validators that use badly anchored regular expressions on library/remote input
2023-02-13 11:26:05 +01:00
erik-krogh
634087b417
Merge branch 'main' into rbPoly
2023-02-13 10:46:00 +01:00
Tom Hvitved
0b8173e2e7
Ruby: Add another data flow test
2023-02-13 09:50:50 +01:00
Harry Maclean
43ce26e4d0
Ruby: re-add Eval.rb
2023-02-07 09:37:26 +13:00
Arthur Baars
f391948b53
Ruby: update expected output
2023-02-06 10:17:19 +01:00
Arthur Baars
3c15fd266d
Ruby: add one-line pattern match test
2023-02-06 10:17:19 +01:00
Harry Maclean
02b09ca9f7
Ruby: Remove unused test files
2023-02-04 14:42:59 +13:00
Harry Maclean
cfb3bc9dce
Ruby: Remove unused test file
2023-02-04 14:30:56 +13:00
Harry Maclean
0711326619
Ruby: Move PosixSpawn tests to their own directory
2023-02-04 14:30:23 +13:00
Harry Maclean
dbbef0534b
Ruby: Move Core tests into core directory
2023-02-04 14:28:25 +13:00
Harry Maclean
b5d98d9011
Ruby: Move GraphQL test to their own directory
2023-02-04 14:25:38 +13:00
Harry Maclean
6c816d5602
Ruby: Move ActionDispatch tests to own directory
2023-02-04 14:19:08 +13:00
Harry Maclean
58d7af4018
Ruby: Move ActionView tests into their own dir
...
This ensures that changes to unrelated test files don't affect these
tests.
2023-02-04 14:19:08 +13:00
Alvaro Muñoz
dd31be43e0
Support for Twirp framework
2023-02-03 09:35:22 +01:00
Harry Maclean
da45d3aa7f
Ruby: Fix string comparison barrier guard
...
`strNode` was not properly restricted for some cases.
2023-02-01 14:40:53 +13:00
