Harry Maclean
|
dd5eb982ec
|
Merge pull request #15524 from hmac/hmac-process-spawn
Ruby: Add some more command injection sinks
|
2024-03-13 09:53:10 +00:00 |
|
Tom Hvitved
|
4291290277
|
Ruby: Implement new data flow interface
|
2024-03-11 20:56:38 +01:00 |
|
Joe Farebrother
|
dbd33d1cf0
|
Model Argument[1] of ActiveRecord from
|
2024-03-08 14:04:01 +00:00 |
|
Tom Hvitved
|
24e35f6f3d
|
Update expected test output
|
2024-03-08 10:00:43 +01:00 |
|
Tom Hvitved
|
e793a1e9fe
|
Ruby: Add variable capture spurious flow test
|
2024-03-08 10:00:42 +01:00 |
|
Anders Schack-Mulligen
|
0dbe8c3d8a
|
Merge pull request #15140 from hvitved/dataflow/pruned-ctx-sensitivity
Data flow: prune context-sensitivity relations
|
2024-03-06 10:04:48 +01:00 |
|
Joe Farebrother
|
dcc6f83d3b
|
Merge pull request #15782 from joefarebrother/ruby-typhoeus
Ruby: Model `Typhoeus::Request.new`
|
2024-03-05 16:55:38 +00:00 |
|
Harry Maclean
|
91cb2a37fd
|
Ruby: Model Process.exec
|
2024-03-05 10:19:22 +00:00 |
|
Tom Hvitved
|
bd7b2c4cc6
|
Update expected output
|
2024-03-05 10:44:13 +01:00 |
|
Harry Maclean
|
179aaa1342
|
Ruby: model Open4.popen4ext
|
2024-03-05 09:35:18 +00:00 |
|
Peter Stöckli
|
4adc373dfe
|
Ruby: more test cases for code injection via method
|
2024-03-01 16:01:07 +01:00 |
|
Joe Farebrother
|
65b30c1dff
|
Add tests and qldoc
|
2024-03-01 14:46:55 +00:00 |
|
Peter Stöckli
|
a693c6d9b4
|
Ruby: sinks for code injection via calls to method
|
2024-03-01 14:42:22 +01:00 |
|
Joe Farebrother
|
0b7b7ea1b8
|
Add test cases and improve controller model
|
2024-03-01 09:57:24 +00:00 |
|
Tom Hvitved
|
914a605a87
|
Ruby: Rework hidden synthetic data-flow nodes
|
2024-02-27 15:33:58 +01:00 |
|
Tom Hvitved
|
994d990f37
|
Ruby: Add another data flow test
|
2024-02-27 15:33:58 +01:00 |
|
Joe Farebrother
|
3ab6f222d0
|
Merge pull request #15718 from joefarebrother/ruby-arel-sqlliteral
Ruby: Model Arel::Nodes::SqlLiteral.new
|
2024-02-27 12:43:47 +00:00 |
|
Tom Hvitved
|
bbeee8f38d
|
Merge pull request #15717 from hvitved/csharp/view-cfg
Shared `View CFG` implementation
|
2024-02-27 09:13:18 +01:00 |
|
Harry Maclean
|
8212f5de1b
|
Ruby: Update test
|
2024-02-26 13:10:27 +00:00 |
|
amammad
|
32f5667bb6
|
revert YAML.qll and yaml sinks to previous PR, make a separate experimental query only for yaml
|
2024-02-26 12:12:03 +00:00 |
|
amammad
|
c582ea626d
|
update expected test file
|
2024-02-26 12:10:04 +00:00 |
|
amammad
|
9c5c8c8362
|
fix test file
|
2024-02-26 12:05:35 +00:00 |
|
amammad
|
464e2e4291
|
fix qldoc and test files
|
2024-02-26 12:04:52 +00:00 |
|
amammad
|
1410574f76
|
make seperate steps for YAML.parse* and use getAsuccessor*() to reach final to_ruby method call, All parts have Rewritten with API graphs exclusively
|
2024-02-26 11:59:35 +00:00 |
|
Harry Maclean
|
8bed3fbed4
|
Ruby: Add basic model for Terrapin library
|
2024-02-26 11:32:41 +00:00 |
|
Harry Maclean
|
beef9965cc
|
Ruby: Model Open4 library
Also remove duplicate modeling of Process.spawn.
|
2024-02-26 11:26:38 +00:00 |
|
Joe Farebrother
|
386defc3c7
|
Update test output
|
2024-02-26 11:21:03 +00:00 |
|
Harry Maclean
|
dd092fd18f
|
Ruby: Fix CSRF test
|
2024-02-26 11:02:54 +00:00 |
|
Tom Hvitved
|
5b6e76c030
|
Move View CFG implementation from Ruby/Swift into shared library
|
2024-02-26 11:23:49 +01:00 |
|
Joe Farebrother
|
2257df5c6f
|
Model Arel::Nodes::SqlLiteral.new
|
2024-02-26 10:09:33 +00:00 |
|
Harry Maclean
|
32b775fdc3
|
Ruby: reduce duplicate alerts for csrf query
Only generate an alert on the top-most vulnerable Rails controller in
the controller tree.
|
2024-02-23 11:13:17 +00:00 |
|
Harry Maclean
|
f19a5a9837
|
Ruby: Add tests for Gemfile modeling
|
2024-02-23 11:13:16 +00:00 |
|
Harry Maclean
|
6d6f8ba512
|
Ruby: Make CSRF query more sensitive
Generate an alert for every controller class that doesn't have or
inherity a `protect_from_forgery` setting.
|
2024-02-23 11:13:15 +00:00 |
|
Harry Maclean
|
49d826f667
|
Ruby: Add a query for CSRF protection not enabled
Specifically in Rails apps, we look for root ActionController classes
without a call to `protect_from_forgery`.
|
2024-02-23 11:13:14 +00:00 |
|
Harry Maclean
|
fbc689227d
|
Merge pull request #15604 from p-/p--rails-more-request-sources
Ruby: add additional sources on the request object of Rails
|
2024-02-22 16:35:59 +00:00 |
|
Joe Farebrother
|
67e8f17c4c
|
Merge pull request #15619 from joefarebrother/ruby-activerecord-connection
Ruby: Add additional sql sinks for ActiveRecord connection methods
|
2024-02-22 14:02:31 +00:00 |
|
Joe Farebrother
|
1f409b0456
|
Merge pull request #15671 from joefarebrother/ruby-activerecord-extra-args
Ruby: Consider additional arguments to certain `ActiveRecord` methods as sql injection sinks.
|
2024-02-22 14:01:56 +00:00 |
|
Joe Farebrother
|
92bdd637a3
|
Address reveiw comment - add create nd remove select_insert
|
2024-02-22 09:55:46 +00:00 |
|
Tom Hvitved
|
23869fc8e6
|
Ruby: Fix bug in allowParameterReturnInSelf
|
2024-02-22 09:43:52 +01:00 |
|
Tom Hvitved
|
007d08ea63
|
Ruby: Add another variable capture test
|
2024-02-22 09:39:01 +01:00 |
|
Joe Farebrother
|
10da4d14d9
|
Add addtional arguments as sinks to certain methods
|
2024-02-20 16:35:29 +00:00 |
|
Joe Farebrother
|
e36b9f4d3c
|
Add tests and change note
|
2024-02-15 15:26:20 +00:00 |
|
Harry Maclean
|
a9abba5859
|
Merge pull request #15520 from hmac/hmac-erb-raw-output-directive
Ruby: Recognise raw Erb output as XSS sink
|
2024-02-15 08:05:16 +00:00 |
|
Peter Stöckli
|
2f7b946c9f
|
Ruby: add sources on request object of Rails
|
2024-02-13 15:52:18 +01:00 |
|
Harry Maclean
|
3d9f9afa77
|
Merge pull request #15566 from hmac/hmac-actioncontroller-regex
Ruby: Fix ActionController path regex
|
2024-02-12 14:14:57 +00:00 |
|
Harry Maclean
|
99497e5f3c
|
Merge pull request #15521 from hmac/hmac-ar-connection
Ruby: Recognise more ActiveRecord connections
|
2024-02-12 14:06:50 +00:00 |
|
Harry Maclean
|
5af58d24e0
|
Ruby: Recognise raw Erb output as XSS sink
|
2024-02-12 13:28:44 +00:00 |
|
Tom Hvitved
|
37d774176b
|
Ruby: Fix SSA inconsistency
|
2024-02-09 14:49:26 +01:00 |
|
Tom Hvitved
|
1ea7717714
|
Capture flow: Take overwrites in nested scopes into account
|
2024-02-09 14:49:23 +01:00 |
|
Tom Hvitved
|
0c43ad45b4
|
Ruby: Add another captured variable data flow test
|
2024-02-09 14:48:36 +01:00 |
|