Arthur Baars
|
6fd836d3a9
|
Ruby: improve wording of error messages
|
2023-02-20 14:32:02 +01:00 |
|
Tom Hvitved
|
e9bce9f8cd
|
Ruby: Update test expectations
|
2023-02-17 13:22:28 +01:00 |
|
gregxsunday
|
d1aaa9ad86
|
Add ZipSlip/TarSlip query for ruby
|
2023-02-16 11:24:15 +00:00 |
|
erik-krogh
|
d2bd70dc33
|
Merge branch 'main' into more-shell-taint
|
2023-02-15 11:35:58 +01:00 |
|
Arthur Baars
|
457a2bb2a2
|
Merge pull request #12093 from aibaars/oneline-match
Ruby: add support for one-line pattern matches
|
2023-02-13 12:38:28 +01:00 |
|
Erik Krogh Kristensen
|
2f404df17c
|
Merge pull request #10782 from erik-krogh/rbPoly
Ruby: add library input as a source for `rb/polynomial-redos`
|
2023-02-13 12:26:07 +01:00 |
|
erik-krogh
|
634087b417
|
Merge branch 'main' into rbPoly
|
2023-02-13 10:46:00 +01:00 |
|
Arthur Baars
|
3c15fd266d
|
Ruby: add one-line pattern match test
|
2023-02-06 10:17:19 +01:00 |
|
erik-krogh
|
c2e8206090
|
add more array taint steps that taint the entire array
|
2023-01-30 21:14:27 +01:00 |
|
erik-krogh
|
962465f77a
|
add array-taint-steps to unsafe-shell-command-construction
|
2023-01-30 16:56:03 +01:00 |
|
erik-krogh
|
e01002368f
|
add query detecting validators that use badly anchored regular expressions on library/remote input
|
2023-01-30 16:34:20 +01:00 |
|
erik-krogh
|
f04a9cb523
|
Merge branch 'main' into rbRegConcept
|
2023-01-30 11:05:40 +01:00 |
|
Alex Ford
|
3dd9392f5e
|
Merge pull request #11869 from alexrford/rails/render_locals_shared
Ruby: Rails - generalize rails flow step for accessing render locals hash in view
|
2023-01-25 12:07:26 +00:00 |
|
erik-krogh
|
80d05c0425
|
also recognize protected methods as library-input sources
|
2023-01-24 20:55:25 +01:00 |
|
erik-krogh
|
a017b7500b
|
Merge branch 'main' into rbPoly
|
2023-01-24 20:51:36 +01:00 |
|
Erik Krogh Kristensen
|
240248b9cf
|
Merge pull request #11453 from erik-krogh/unsafeHtmlConstruction
RB: add unsafe-html-construction query
|
2023-01-23 16:40:25 +01:00 |
|
Erik Krogh Kristensen
|
5be97f3761
|
Merge pull request #11909 from erik-krogh/concatCode
Rb: recognize string concatenations as sinks for unsafe-code-construction
|
2023-01-23 16:22:46 +01:00 |
|
erik-krogh
|
7c6ee5f293
|
Merge branch 'main' into unsafeHtmlConstruction
|
2023-01-23 15:01:01 +01:00 |
|
Alex Ford
|
3b10a2de11
|
Merge branch 'main' into rails/render_locals_shared
|
2023-01-23 10:00:22 +00:00 |
|
Arthur Baars
|
99148244a4
|
Merge pull request #11856 from aibaars/update-grammars
Update grammars
|
2023-01-23 09:46:50 +01:00 |
|
Alex Ford
|
8fec4b804f
|
Ruby: StoredXSS test whitespace change
|
2023-01-20 13:40:19 +00:00 |
|
Alex Ford
|
fd8dd5e103
|
Ruby: update StoredXSS test output
|
2023-01-20 13:40:19 +00:00 |
|
Alex Ford
|
bea110b598
|
Ruby: remove blank line in test file
|
2023-01-20 13:40:19 +00:00 |
|
Alex Ford
|
b78ae1608e
|
Ruby: remove a fixed TODO
|
2023-01-20 13:40:19 +00:00 |
|
Alex Ford
|
e5fbc92856
|
Ruby: generalize rails flow step for accessing render locals hash in view
|
2023-01-20 13:40:19 +00:00 |
|
erik-krogh
|
25e65e0d9f
|
rewrite the regexp tracking DataFlow::Configuration to TypeTracking
|
2023-01-18 10:10:36 +01:00 |
|
erik-krogh
|
2fceee4e35
|
track regular expressions that gets compiled with Regexp.compile
|
2023-01-18 09:31:04 +01:00 |
|
erik-krogh
|
acf28ebd98
|
add a RegexExecution, and use it to track regular expressions to their uses in a nice way in rb/polynomial-redos
|
2023-01-18 09:31:04 +01:00 |
|
erik-krogh
|
6e33dd5df6
|
add failing test
|
2023-01-18 09:31:04 +01:00 |
|
erik-krogh
|
8251ad5e99
|
add unsafe-html-construction query
|
2023-01-17 15:35:17 +01:00 |
|
erik-krogh
|
a562568522
|
add string concat as a sink for command-construction
|
2023-01-17 14:48:09 +01:00 |
|
erik-krogh
|
8fc3b268e8
|
add string concat as a sink for code-construction
|
2023-01-17 14:48:06 +01:00 |
|
Erik Krogh Kristensen
|
59a8b21851
|
Merge pull request #10862 from erik-krogh/unsafeCodeConstruction
Rb: Add an `unsafe-code-construction` query
|
2023-01-16 13:22:58 +01:00 |
|
Arthur Baars
|
46063c7d04
|
Ruby: update expected output
|
2023-01-13 10:22:41 +01:00 |
|
Tony Torralba
|
c9d1cd97fb
|
Ruby: Remove omittable exists variables
|
2023-01-10 13:39:49 +01:00 |
|
erik-krogh
|
19d2b49562
|
drive-by: make Base64.decode64(..) into a flowsummary that is shared with all queries
|
2023-01-06 09:04:37 +01:00 |
|
erik-krogh
|
1a27441cfb
|
drive-by: delete code-execution sinks from unsafe-deserialization, we risked duplicate alerts
|
2023-01-06 09:04:36 +01:00 |
|
erik-krogh
|
0e6028a7f3
|
add stdin as source for unsafe-deserialization
|
2023-01-06 09:04:36 +01:00 |
|
erik-krogh
|
f98ff65b11
|
use eval() instead of send() in test
|
2023-01-05 20:04:04 +01:00 |
|
Arthur Baars
|
0f313231bc
|
AlertSuppression: add more tests
|
2022-12-19 16:43:11 +01:00 |
|
Arthur Baars
|
c176606be5
|
AlertSuppression: allow //lgtm comments to scope over the next line
|
2022-12-19 16:10:26 +01:00 |
|
Arthur Baars
|
016c7a8ca7
|
Merge pull request #11719 from aibaars/alert-suppression-shared
Shared AlertSuppression library
|
2022-12-19 16:04:44 +01:00 |
|
Arthur Baars
|
06736e3e91
|
Add .gitattributes for Windows test files
|
2022-12-19 12:39:01 +01:00 |
|
erik-krogh
|
db49cfb723
|
Merge branch 'main' into kernelLoad
|
2022-12-19 09:46:25 +01:00 |
|
Tom Hvitved
|
5d9c64ba6f
|
Ruby: Model flow through initialize constructors
|
2022-12-14 12:57:39 +01:00 |
|
erik-krogh
|
ccf520a5cd
|
Merge branch 'main' into unsafeCodeConstruction
|
2022-12-13 18:31:49 +01:00 |
|
Peter Stöckli
|
03fff2709b
|
Add suggestions to fix FileJoinSanitizer
|
2022-12-09 09:42:44 +01:00 |
|
Peter Stöckli
|
0d8c82009c
|
Merge branch 'main' into p--ruby-kernel-open-addition
|
2022-12-09 07:54:56 +01:00 |
|
erik-krogh
|
8f0c0f3c17
|
add support for super calls to Kernel
|
2022-12-06 14:25:51 +01:00 |
|
erik-krogh
|
66946ebf6a
|
add Kernel methods as sinks to path-injection
|
2022-12-06 14:09:15 +01:00 |
|