Harry Maclean
e3115b5ed7
Ruby: Add test for other=
2022-08-09 15:08:17 +12:00
Harry Maclean
831f722402
Ruby: Make room for new test
2022-08-09 15:08:17 +12:00
Harry Maclean
dc853d9728
Ruby: Model ActiveRecord associations
2022-08-09 15:08:17 +12:00
Tom Hvitved
9268437a58
Ruby: Generalize SynthHashSplatParameterNode to also work for synthesized methods
2022-08-08 14:05:06 +02:00
Harry Maclean
74d529d3e3
Merge pull request #9918 from hmac/hmac/mime-type-match
...
Ruby: Model Mime::Type
2022-08-05 11:51:45 +12:00
Tom Hvitved
01c0d4b59f
Ruby: Support more flow through keyword arguments
2022-08-04 16:20:08 +02:00
Tom Hvitved
38ede25385
Ruby: Add test that illustrates missing flow for keyword arguments
2022-08-04 14:39:22 +02:00
Harry Maclean
83393dc195
Ruby: Recognise more AR write accesses
...
This change means we recognise calls like
```rb
User.create(params)
User.update(id, params)
```
as instances of `PersistentWriteAccess`.
2022-08-04 17:22:46 +12:00
Harry Maclean
d4f7f2b75e
Ruby: Add test for AR PersistentWriteAccesses
2022-08-04 17:22:46 +12:00
Harry Maclean
7ed81db32d
Ruby: Move ActiveRecord tests to new directory
2022-08-04 17:22:46 +12:00
Arthur Baars
d8592a2b05
Ruby: PrintAST: more stable order for synthesized nodes
2022-08-03 09:02:38 +02:00
Harry Maclean
f42d33312f
Ruby: Model Mime::Type
...
Add type summaries to recognise instances of Mime::Type, and recognise
arguments to Mime::Type.match? and Mime::Type.=~ as regular expression
interpretations.
2022-07-29 11:41:48 +12:00
Harry Maclean
c29eb814b2
Ruby: Reorganise ActionDispatch framework
...
Put routing modelling inside a Routing module.
2022-07-29 10:44:36 +12:00
Harry Maclean
681e58c8e0
Merge pull request #9850 from hmac/hmac/arel
...
Ruby: Model Arel.sql
2022-07-25 12:09:18 +12:00
Arthur Baars
1399610bd4
Merge branch 'main' into encoding
2022-07-21 21:21:17 +02:00
Arthur Baars
7be106d7bb
Ruby: handle magic coding: comments
2022-07-21 16:33:18 +02:00
thiggy1342
6bc2fe513d
Merge branch 'main' into add-activerecord-annotate
2022-07-19 10:29:24 -04:00
Harry Maclean
7b8603c89b
Ruby: Model Arel.sql
2022-07-19 11:27:15 +12:00
Nick Rolfe
eebba36b18
Merge pull request #9708 from github/nickrolfe/pathname
...
Ruby: model the standard library's `Pathname` class
2022-07-18 11:29:30 +01:00
Harry Maclean
1fa2144716
Ruby: Update test fixtures
2022-07-13 21:02:08 +12:00
Harry Maclean
ea95e2e1d0
Ruby: Use InclusionTests library in barrier guards
2022-07-13 18:20:27 +12:00
Harry Maclean
b9fc82a741
Ruby: Test both old and new-style barrier guards
2022-07-13 18:20:25 +12:00
Harry Maclean
5f17d8370c
Ruby: Small change to isArrayExpr
2022-07-13 18:20:14 +12:00
Harry Maclean
63dcce9a31
Ruby: Refactor isArrayConstant
2022-07-13 18:20:14 +12:00
Harry Maclean
301914d80c
Ruby: Add an extra barrier guard test
2022-07-13 18:20:14 +12:00
Harry Maclean
706d1d2eee
Ruby: Make StringArrayInclusion more sensitive
...
We now recognise the following pattern as a barrier guard for `x`:
values = ["foo", "bar"]
if values.include? x
sink x
end
2022-07-13 18:20:12 +12:00
thiggy1342
9a0a9491da
Merge branch 'main' into add-activerecord-annotate
2022-07-12 20:13:56 -04:00
Nick Rolfe
6632dfaf88
Ruby: fix another SystemCommandExecution::isShellInterpreted implementation
2022-07-11 16:53:30 +01:00
Nick Rolfe
348ad95fc0
Ruby: fix defining every dataflow node as a command execution sink
2022-07-11 15:06:27 +01:00
thiggy1342
e8e8da1b31
fix lib test expect for ActionController
2022-07-08 19:01:01 +00:00
thiggy1342
940254d251
update framework tests
2022-07-07 19:39:59 +00:00
Nick Rolfe
02dd933e5f
Ruby: move Pathname from core to stdlib
2022-06-30 10:08:25 +01:00
Nick Rolfe
c1302a90e0
Ruby: use MaD for more precise Pathname flow summaries
2022-06-29 13:16:18 +01:00
Nick Rolfe
280c959dc8
Merge branch 'main' into nickrolfe/pathname
2022-06-27 11:11:17 +01:00
Harry Maclean
101111bd2f
Merge pull request #9574 from hmac/hmac/action-cable-logger
...
Ruby: More Rails modeling
2022-06-27 19:56:54 +12:00
Asger F
d6fd43fe12
Merge pull request #9364 from asgerf/ruby/api-graph-api
...
Ruby: API graph renaming an documentation
2022-06-27 08:54:24 +02:00
Nick Rolfe
c1515db09c
Ruby: modeling of some file-related concepts for the Pathname class
2022-06-24 14:14:07 +01:00
Nick Rolfe
03d0f66247
Ruby: add flow summaries for Pathname class
2022-06-24 14:14:06 +01:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
Asger F
7c877c7861
Ruby: Rename getARhs -> asSink
2022-06-21 12:44:16 +02:00
Asger F
2f8086bb57
Ruby: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:16 +02:00
Anders Schack-Mulligen
736372ffd6
Ruby: Remove test.
2022-06-21 11:18:36 +02:00
Arthur Baars
c5d3df087d
Update tree-sitter-embeded-template
2022-06-20 17:04:27 +02:00
Harry Maclean
e1dcc207b4
Ruby: Model methods in Rails::Generators::Actions
...
These methods are sinks for command injection.
2022-06-20 13:36:09 +12:00
Harry Maclean
20ff4c4299
Ruby: Model ActiveRecord::Relation#touch_all
2022-06-20 13:36:02 +12:00
Harry Maclean
7dfab371f6
Ruby: Model redirect_back and redirect_back_or_to
...
These are ActionController methods that redirect to the HTTP Referer,
falling back to the given location if there is no Referer.
2022-06-20 13:36:02 +12:00
Harry Maclean
a298f5eb5e
Ruby: Recognise File.atomic_write as a file writer
...
This method is an ActiveSupport extension, but there's no harm in
recognising it universally as any identically-named method is likely to
also be a file writer.
2022-06-20 13:36:02 +12:00
Harry Maclean
0ce14fc4e5
Ruby: Recognise ActionCable logger class
2022-06-20 13:36:02 +12:00
Alex Ford
5923eb4962
Merge pull request #9566 from alexrford/ruby/activerecord-findby-dynamic
...
Ruby: recognize ActiveRecord `find_by_x` methods
2022-06-17 09:39:46 +01:00
Arthur Baars
e95194ce67
Merge pull request #9477 from thiggy1342/experimental-archive-api
...
RB: Adding experimental query for detecting path traversal in Archive libraries
2022-06-16 17:45:18 +02:00
