Anders Schack-Mulligen
c4ae18649e
Ruby: Accept qltest .expected file changes (interesting).
2024-05-22 10:08:59 +02:00
Rasmus Wriedt Larsen
2451a6d3f6
Accept .expected changes
2024-05-21 14:47:42 +02:00
Tom Hvitved
bf2ae9890f
Tree-sitter: Bump to 0.22.6
2024-05-21 11:14:06 +02:00
am0o0
dcadda23cd
update expected file
2024-05-16 15:15:27 +02:00
Alex Ford
78dc6502f5
Merge branch 'main' into amammad-ruby-bombs
2024-05-16 13:53:31 +01:00
Harry Maclean
ef88f3ed09
Merge pull request #16377 from hmac/hmac-sanitization-fp
...
Ruby: Fix StringSubstitutionCall charpred
2024-05-02 13:31:01 +01:00
Harry Maclean
c00d0d302d
Ruby: fix wording in rb/request-without-cert-validation
2024-05-01 17:25:58 +01:00
Harry Maclean
f7fc2e0b00
Ruby: Fix StringSubstitutionCall charpred
...
Some missing parens meant this class targeted way more things than
intended.
2024-05-01 16:14:58 +01:00
Harry Maclean
51bc8e917e
Ruby: Reduce FPs for rb/incomplete-hostname-regexp
...
Arguments in calls to `match[?]` should only be considered regular
expression interpretations if the `match` refers to the standard library
method, not a method in source code.
2024-04-29 11:19:34 +01:00
Alex Ford
98a6d0fa26
Ruby: add another SQLi AR conditions test case
2024-04-24 14:46:53 +01:00
Alex Ford
6b0e7961fa
Ruby: prepare test case whitespace
2024-04-24 14:39:06 +01:00
Alex Ford
91bca4a2c3
Ruby: limit ActiveRecord conditions sink to first array element
2024-04-12 15:32:16 +01:00
Alex Ford
2950890180
Ruby: add more ActiveRecord conditions arg test cases
2024-04-12 15:31:28 +01:00
Alex Ford
f98479dca3
Ruby: prepare test case whitespace
2024-04-12 15:30:42 +01:00
Tom Hvitved
04de315e0e
Ruby: Deprecate models-as-data CSV interface
2024-04-12 13:40:14 +02:00
Joe Farebrother
5cebcadc56
Merge pull request #15987 from joefarebrother/ruby-mass-reassignment
...
Ruby: Add query for insecure mass assignment
2024-04-12 10:18:41 +01:00
Anders Schack-Mulligen
2c43d0c5a4
Ruby: Update expected output (interesting).
2024-04-12 09:20:38 +02:00
Anders Schack-Mulligen
7cc8fd00aa
Ruby: Update expected output (uninteresting).
2024-04-12 09:20:35 +02:00
Erik Krogh Kristensen
c00e2075a4
Merge pull request #16111 from erik-krogh/rb-url
...
RB: Improve QHelp for `rb/url-redirect`, and fix an FP.
2024-04-11 13:03:35 +02:00
Joe Farebrother
0a3d73d902
Add flow steps and sanitizers for permit calls
2024-04-10 21:47:07 +01:00
Tom Hvitved
5f8eb7b138
Merge pull request #16110 from hvitved/dataflow/param-flow-no-expects-content
...
Data flow: Block flow at `expectsContents` nodes in `parameterValueFlow`
2024-04-09 11:26:24 +02:00
erik-krogh
642a134035
add tests for the fixes in the qhelp, and fix an FP that appeared
2024-04-08 12:00:27 +02:00
Tom Hvitved
ce3b359813
Ruby: Fix CFG for nodes that may raise
2024-04-04 13:27:29 +02:00
Tom Hvitved
6d2d9654b5
Ruby: Add CFG test
2024-04-04 13:27:29 +02:00
Tom Hvitved
2d4cf55c87
Merge pull request #15985 from hvitved/ruby/phi-barrier-guards
...
Ruby: Extend barrier guards to handle phi inputs
2024-04-03 15:22:39 +02:00
Tom Hvitved
7871fb8ce6
Data flow: Block flow at expectsContents nodes in parameterValueFlow
2024-04-03 15:19:34 +02:00
Tom Hvitved
137594cf36
Ruby: Add regression test
2024-04-03 15:19:34 +02:00
Harry Maclean
409f46ef7b
Merge pull request #14308 from hmac/hmac-rb-csrf-not-enabled
...
Ruby: Add a query for CSRF protection not enabled
2024-04-02 11:30:36 +01:00
erik-krogh
c60cec36d4
add calls to .html_safe? as a shared XSS sanitizer
2024-03-22 17:46:39 +01:00
Joe Farebrother
b74145349b
Add test cases
2024-03-22 14:07:11 +00:00
Joe Farebrother
507a6102a2
Reorganise into Custimizations file + add some more sinks on ActiveRecord methods
2024-03-22 14:07:04 +00:00
Joe Farebrother
89838981b7
Add test cases
2024-03-22 14:04:52 +00:00
Tom Hvitved
90779f4413
Ruby: Extend barrier guards to handle phi inputs
2024-03-20 10:02:20 +01:00
Tom Hvitved
0f0acc0428
Ruby: Add barrier guard flow tests
2024-03-20 09:25:20 +01:00
Harry Maclean
219cd4e415
Merge pull request #14426 from hmac/hmac-ar-scopes
...
Ruby: Track flow into ActiveRecord scopes
2024-03-19 14:19:14 +00:00
Harry Maclean
7e479e3c8e
Ruby: Fix Hash#keys flow summary
2024-03-19 13:47:45 +00:00
Harry Maclean
32b80f8cb1
Ruby: Add tests for hash flow
2024-03-19 08:38:14 +00:00
Tom Hvitved
fc55567d90
Merge pull request #15853 from hvitved/dataflow/get-location
...
Data flow: Replace `hasLocationInfo` with `getLocation`
2024-03-18 20:21:46 +01:00
Tom Hvitved
8899d66132
Merge pull request #15734 from hvitved/dataflow/hidden-subpath
...
Data flow: Account for hidden `subpath` wrappers
2024-03-18 20:17:16 +01:00
Harry Maclean
80ae017aa1
Ruby: Track flow into ActiveRecord scopes
2024-03-18 15:01:37 +00:00
Joe Farebrother
4177c38ed4
Merge pull request #15907 from joefarebrother/ruby-uploaded-file
...
Ruby: Model ActiveDispatch::Http::UploadedFile
2024-03-18 14:02:33 +00:00
Tom Hvitved
e53357d376
Update expected test output
2024-03-18 14:49:32 +01:00
Tom Hvitved
a13391bda1
Merge pull request #15802 from hvitved/dataflow/variable-capture-overlapping-paths
...
Variable capture: Avoid overlapping and false-positive data flow paths
2024-03-18 10:45:55 +01:00
Tom Hvitved
e7b00a7b42
Ruby: Add post-update argument nodes for string constants
2024-03-15 10:47:39 +01:00
Joe Farebrother
f464f1b94e
Accept test output + fix qldoc typo
2024-03-14 22:25:37 +00:00
Joe Farebrother
b4ed77343b
Add change note + fix qldoc
2024-03-14 22:25:36 +00:00
Joe Farebrother
3e61be1b6a
Add test cases
2024-03-14 22:25:36 +00:00
Harry Maclean
dd5eb982ec
Merge pull request #15524 from hmac/hmac-process-spawn
...
Ruby: Add some more command injection sinks
2024-03-13 09:53:10 +00:00
Tom Hvitved
4291290277
Ruby: Implement new data flow interface
2024-03-11 20:56:38 +01:00
Joe Farebrother
dbd33d1cf0
Model Argument[1] of ActiveRecord from
2024-03-08 14:04:01 +00:00
