Nick Rolfe
97e939ae2b
Ruby: refine summaries for Hash#reverse_merge etc.
...
- revert the changes to the taint summaries specific to ActionController
params
- make the general flow summaries value-preserving and use
WithElement[any]
2022-11-09 11:56:07 +00:00
Harry Maclean
ad7b5ae7ed
Ruby: Add inline barrier guard test
2022-11-09 16:35:28 +13:00
Harry Maclean
f1b63c4df3
Ruby: Fix in clause barrier guard
2022-11-09 16:10:17 +13:00
Harry Maclean
0ab88c2e29
Ruby: Handle simple in clauses in barrier guard
2022-11-09 16:01:33 +13:00
Harry Maclean
87944a3a75
Ruby: Add test for another case guard variant
2022-11-09 15:05:03 +13:00
Harry Maclean
4bc9096446
Ruby: Add case string comparison barrier guard
...
This recognises barriers of the form
STRINGS = ["foo", "bar"]
case foo
when "some string literal"
foo
when *["other", "strings"]
foo
when *STRINGS
foo
end
where the reads of `foo` inside each `when` are guarded by the comparison
of `foo` with the string literals.
We don't yet recognise this construct:
case foo
when "foo", "bar"
foo
end
This is due to a limitation in the shared barrier guard logic.
2022-11-09 15:03:13 +13:00
Asger F
43769ad464
Ruby: update test output
2022-11-08 19:20:57 +01:00
Nick Rolfe
a9ff0bdbbf
Ruby: accept changed test output
2022-11-08 17:36:31 +00:00
Nick Rolfe
04575674db
Ruby: generalise summaries for ActiveSupport Hash extensions
2022-11-08 15:48:20 +00:00
Asger F
271de66f01
Ruby: rename getConst -> getConstant
2022-11-08 16:41:04 +01:00
Tom Hvitved
edde3defed
Merge pull request #11153 from hvitved/ruby/basic-block-at-conditions
...
Ruby: Split basic blocks around constant conditionals
2022-11-08 13:35:52 +01:00
Tom Hvitved
f0b9ca4bf9
Ruby: Add more guards tests
2022-11-08 11:09:54 +01:00
Asger F
a75c50620c
Ruby: update more SSA test output
2022-11-08 11:03:24 +01:00
Tom Hvitved
7ba0682297
Ruby: Split basic blocks around constant conditionals
2022-11-08 09:07:23 +01:00
Tom Hvitved
c86f597153
Ruby: Add test for disjunctive guard
2022-11-08 09:01:22 +01:00
Harry Maclean
d392cdaab6
Merge pull request #11022 from hmac/try-code-injection
...
Ruby: try/try! as code execution
2022-11-08 09:42:52 +13:00
Asger F
edc5d8d644
Ruby: update test output
2022-11-07 14:17:50 +01:00
Asger F
a213e9e55d
Merge pull request #1 from hvitved/rb/data-flow-layer-capture2
...
Ruby: Make sure to always generate SSA definitions for namespace self-variables
2022-11-07 14:12:48 +01:00
Asger F
f991991474
Ruby: fix incomplete renaming of getCanonicalEnclosing/Nested module
2022-11-07 14:04:10 +01:00
Tom Hvitved
2737255705
Ruby: Make sure to always generate SSA definitions for namespace self-variables
2022-11-07 14:02:09 +01:00
Asger F
a39cefe40f
Ruby: fix broken test
2022-11-07 14:01:11 +01:00
Tom Hvitved
46631d6eaf
Merge pull request #10931 from hvitved/ruby/fix-flow-into-phis
...
Ruby: Fix flow steps into phi nodes
2022-11-02 21:07:06 +01:00
erik-krogh
6bc12e8f2b
Merge branch 'main' into formatTaint
2022-11-02 13:39:30 +01:00
Tom Hvitved
ee9163aa40
Ruby: Fix flow steps into phi nodes
...
- Add missing flow from post-update nodes into phi nodes.
- Prevent flow from reads into phi nodes when use-use flow is prohibited.
2022-11-01 16:33:06 +01:00
Tom Hvitved
a191edfbd5
Ruby: Add data flow tests that illustrate problems with flow into SSA phi nodes
2022-11-01 16:32:46 +01:00
Tom Hvitved
e8f9429b92
Merge pull request #10917 from hvitved/ruby/singleton-call-sensitivity
...
Ruby: Call-context sensitivity for singleton method calls
2022-11-01 14:13:26 +01:00
Asger F
056b1e8d63
Ruby: add some basic tests
2022-10-31 14:05:11 +01:00
Asger F
9be2512050
Ruby: rename one of the PostsController2 classes
...
These had the same name and ended up being unified
2022-10-31 13:33:41 +01:00
Asger F
b4b34cc994
Ruby: port part of ActionController model
2022-10-31 13:33:41 +01:00
Asger F
9f59b6b439
Update type-tracking test
2022-10-31 13:33:41 +01:00
Asger F
0a8f39fe96
Ruby: recover some incomplete capture flow
2022-10-31 13:33:41 +01:00
Asger F
b29ac5249e
Ruby: add type-tracking inline test in global flow test
2022-10-31 13:33:41 +01:00
Asger F
4ed61c13f8
Ruby: add some captured-variable flow tests
2022-10-31 13:33:41 +01:00
Harry Maclean
fd61a5253d
Ruby: Recognise try/try! as code executions
2022-10-31 11:53:22 +13:00
Harry Maclean
3f403f0f87
Merge pull request #10700 from hmac/activesupport
...
Ruby: Model some ActiveSupport methods
2022-10-31 11:50:44 +13:00
Asger F
436cc60138
Ruby: update some uses of getConstantValue()
2022-10-28 15:16:14 +02:00
Harry Maclean
5e781f24b6
Ruby: Remove duplicate test
...
This is already tested in hash-flow.
2022-10-28 11:31:55 +13:00
Harry Maclean
4ec527a9ea
Ruby: Explain difference between flow tests
...
The type-tracking flow tests document the difference in sensitivity
between type-tracking and dataflow, so failures in that test are
expected.
2022-10-28 11:31:55 +13:00
Harry Maclean
6e8446b6ae
Fix tests
2022-10-28 11:31:55 +13:00
Harry Maclean
71d703f2a5
Ruby: Add ActiveSupport extensions
2022-10-28 11:31:55 +13:00
Harry Maclean
cb37a0e835
Ruby: Add summaries for Hash#deep_merge(!)
2022-10-28 11:31:55 +13:00
Harry Maclean
3dea1d6a60
Ruby: Add flow summary for Hash#except!
2022-10-28 11:31:55 +13:00
Harry Maclean
0454642220
Ruby: Model deep_dup and presence
2022-10-28 11:31:55 +13:00
Harry Maclean
9f260853ac
Ruby: Model more ActiveSupport string extensions
2022-10-28 11:31:55 +13:00
Harry Maclean
b389d50943
Ruby: Identify safe_constantize
2022-10-28 11:31:54 +13:00
Rasmus Wriedt Larsen
adf109b624
Merge branch 'main' into inline-fail-tag
2022-10-27 13:42:32 +02:00
Rasmus Wriedt Larsen
6d43db43dd
Ruby: Fix tag missing from getARelevantTag
2022-10-27 09:12:06 +02:00
thiggy1342
952ad6ea46
Merge branch 'main' into expand-ruby-ssrf-sinks-faraday-connection-new
2022-10-24 09:52:24 -04:00
Asger F
bcfe4ece6f
Merge pull request #10918 from asgerf/rb/constant-compound-assignment
...
Ruby: handle compound constant-assignment
2022-10-24 14:07:28 +02:00
Asger F
cac2e2e2e4
Merge pull request #10928 from asgerf/rb/assumed-global-const
...
Ruby: assume some global constants are defined
2022-10-24 14:06:34 +02:00
