Koen Vlaswinkel
87eb1ab103
Ruby: Include ReturnValue and exclude self for constructors
2024-02-08 13:40:10 +01:00
Harry Maclean
f792b58421
Ruby: Recognise more ActiveRecord connections
2024-02-05 16:45:59 +00:00
Koen Vlaswinkel
49dbad96f9
Switch from details string to DataFlow::Node
2024-02-05 16:33:01 +01:00
Koen Vlaswinkel
f83d2a7d55
Ruby: Avoid using toString where possible
2024-02-02 14:18:21 +01:00
Koen Vlaswinkel
8853acb4dd
Ruby: Add query for access paths in model editor
2024-02-01 16:20:00 +01:00
Tom Hvitved
8972133d4b
Merge pull request #15498 from hvitved/ruby/ctx-sensitivity-test
...
Ruby: Add another dataflow test
2024-02-01 12:46:53 +01:00
Tom Hvitved
792f302bd4
Ruby: Add another dataflow test
2024-02-01 10:52:06 +01:00
Koen Vlaswinkel
ce4d8d6b51
Merge pull request #15490 from github/koesie10/ruby-model-constructor-on-new
...
Ruby: Model constructors in endpoint query on new instead of initialize
2024-02-01 09:31:49 +01:00
Harry Maclean
06334eee2e
Merge pull request #14554 from maikypedia/maikypedia/insecure-randomness
...
Ruby: Add Insecure Randomness Query
2024-01-31 17:16:32 +00:00
Koen Vlaswinkel
c1aaf5a574
Ruby: Model constructors in endpoint query on new
2024-01-31 13:54:48 +01:00
Harry Maclean
4cfdf8b7a3
Ruby: Add test case for view without ERB template
2024-01-30 20:30:59 +01:00
Tom Hvitved
d2d017dd64
Ruby: Model flow through ViewComponent render methods
2024-01-30 20:30:58 +01:00
Tom Hvitved
817a2b71a8
Add more tests
2024-01-30 20:30:58 +01:00
Harry Maclean
5b3a2b35b7
Update expected file
2024-01-30 20:30:58 +01:00
Harry Maclean
75a37486c9
Add WIP query for erb flow
2024-01-30 20:30:58 +01:00
Harry Maclean
bf3b86b402
Add test for erb flow
2024-01-30 20:30:58 +01:00
Tom Hvitved
2d95ac9d5f
Merge pull request #15468 from hvitved/ruby/ctx-sensitivity-rework
2024-01-30 20:27:43 +01:00
Arthur Baars
4591560692
Merge pull request #14544 from p-/p--oj-ox-unsafe-deser
...
Ruby: additional unsafe deserialization sinks for ox and one for oj
2024-01-30 19:28:32 +01:00
Sid Shankar
f557110d9b
Merge pull request #15465 from sidshank/sidshank/rename-file-name-for-extracted-files-diagnostic
...
JS/TS/Python/Ruby: Renames diagnostic query files and tests
2024-01-30 10:19:00 -05:00
Peter Stöckli
1947dee46a
Merge branch 'main' into p--oj-ox-unsafe-deser
2024-01-30 15:33:39 +01:00
Harry Maclean
f230e618a3
Ruby: Update tests
2024-01-30 09:43:56 +00:00
Tom Hvitved
503d2f7b95
Ruby: Rework mayBenefitFromCallContext
2024-01-30 09:57:29 +01:00
Sid Shankar
b1d7a635f5
Renames diagnostic query files and tests
...
This commit renames the files relating to the diagnostic query that produces information on the number of files extracted. The files have been renamed from "SuccessfullExtractedFiles.*" to "ExtractedFiles.*". All related tests and test files have been renamed too.
The `@tags` and `@id` attributes of the queries have been left untouched, consistent with the `@tags` and `@id` for similar queries in other languages.
2024-01-29 20:19:20 +00:00
Sid Shankar
59098be8c4
Merge branch 'main' into change/adjust-extracted-files-diagnostics
2024-01-16 21:51:41 -05:00
Tom Hvitved
295198744b
Ruby: Handle captured yield calls
2024-01-10 14:25:15 +01:00
Tom Hvitved
55be4c39ef
Ruby: Add data flow call sensitivity test
2024-01-10 14:25:12 +01:00
Tom Hvitved
c9cf2a899c
Merge pull request #15260 from hvitved/dataflow/may-benefit-from-cctx-simplify
...
Data flow: Remove column from `mayBenefitFromCallContext`
2024-01-10 11:43:15 +01:00
Tom Hvitved
f90201eb56
Data flow: Remove column from mayBenefitFromCallContext
2024-01-09 11:34:43 +01:00
Sid Shankar
b26fef816a
Rb: Report any extracted file as successfully extracted
2024-01-08 22:21:30 +00:00
Arthur Baars
20022b6f3a
Add test case
2024-01-05 14:39:30 +01:00
Harry Maclean
c96be39474
Merge pull request #15048 from hmac/hmac-model-editor-ruby-modules
...
Ruby: Model editor improvements
2024-01-03 12:53:43 +00:00
Tom Hvitved
25a676ac6a
Ruby: Model simple pattern matching as value steps instead of taint steps
2023-12-14 20:18:24 +01:00
Tom Hvitved
c8b4a215bc
Merge pull request #14573 from hvitved/flow-summary-impl-param
...
Move `FlowSummaryImpl.qll` to `dataflow` pack
2023-12-14 12:24:15 +01:00
Tom Hvitved
28a2d05cf8
InlineFlowTest: Allow for custom getArgString
2023-12-13 13:58:44 +01:00
Tom Hvitved
0e81577269
Ruby: Use FlowSummaryImpl from dataflow pack
2023-12-10 11:25:43 +01:00
Harry Maclean
ece196cb25
Ruby: Update model editor tests
2023-12-08 14:52:51 +00:00
Harry Maclean
1dc0a063b0
Merge pull request #14679 from hmac/hmac-model-editor-ruby
...
Ruby: Experimental model editor support
2023-12-08 11:03:38 +00:00
Tom Hvitved
dde83b6415
Merge pull request #14709 from hvitved/ruby/shared-type-tracking
...
Ruby: Adopt shared type tracking library
2023-12-05 20:12:06 +01:00
Harry Maclean
d630773575
Merge pull request #14627 from alexrford/rb/update_all_sink
...
Ruby: refine `ActiveRecord` `update_all` as an SQL sink
2023-12-04 13:02:14 +00:00
Harry Maclean
bd575db254
Ruby: Add test for FrameworkModeEndpoints query
2023-11-27 14:18:18 +00:00
Tom Hvitved
9eaebfcf60
Merge pull request #14859 from hvitved/ruby/missing-flow-tests
...
Ruby: Add tests illustrating missing flow
2023-11-24 14:57:15 +01:00
Tom Hvitved
8ccce5891d
Ruby: Add tests illustrating missing flow
2023-11-24 14:28:04 +01:00
Harry Maclean
288fbfd2ec
Ruby: Add test for missing block flow
2023-11-22 09:59:55 +00:00
Tom Hvitved
6ce8e0510f
Ruby: Adopt shared type tracking library
2023-11-20 16:03:24 +01:00
Tom Hvitved
b2f1022e5c
Ruby: Prune irrelevant data flow nodes and edges
2023-11-16 13:52:07 +01:00
Tom Hvitved
75f42f4614
Merge pull request #14783 from hvitved/ruby/hash-array-literal
...
Ruby: Include more nodes in `{Hash,Array}LiteralCfgNode`
2023-11-16 13:51:35 +01:00
Tom Hvitved
2c23dacca1
Ruby: Add more hash/array literal tests
2023-11-16 12:58:53 +01:00
Tom Hvitved
475d8da342
Ruby: Include more nodes in {Hash,Array}LiteralCfgNode
2023-11-14 13:50:46 +01:00
Tom Hvitved
f1b67ade9b
Ruby: Include name of variable in UninitializedDefinition.toString
2023-11-14 11:33:59 +01:00
Rasmus Wriedt Larsen
43d9d2ceb7
Merge pull request #14603 from github/max-schaefer/broken-crypto-algorithm-link
...
JavaScript/Python/Ruby: Improve alert message for `*/weak-cryptographic-algorithm`.
2023-11-08 14:29:24 +01:00
