Asger Feldthaus
e6fdd4d34a
Ruby: Make hasLocalSource private/cached
2022-02-04 11:01:03 +01:00
Asger Feldthaus
9a496e647f
Ruby: Drive-by fix type-tracking through params with default values
2022-02-04 11:01:03 +01:00
Harry Maclean
ab7fd89653
Merge pull request #7663 from github/hmac/api-graph-subclass
...
Ruby: Add basic subclassing support to API Graphs
2022-02-04 10:19:07 +13:00
Harry Maclean
e328c6222a
Merge pull request #7797 from github/hmac/pin-rust
...
Ruby: Pin Rust to 1.54
2022-02-04 10:18:46 +13:00
Harry Maclean
912842623d
Simplify cache key
2022-02-04 07:41:29 +13:00
Arthur Baars
6525035f0a
Address comments
2022-02-03 13:47:03 +01:00
Tom Hvitved
6bb71f051b
Merge pull request #7791 from hvitved/dataflow/inline-local-flow-star
...
Data flow: Inline `local(Expr|Instruction)?(Flow|Taint)`
2022-02-03 09:02:43 +01:00
Harry Maclean
c65ca8ff86
Model calls to constantize as code executions
...
`constantize` is an ActiveSupport extension to `String` that attempts to
look up a constant with a name matching the receiver.
2022-02-03 15:22:07 +13:00
Harry Maclean
704b58519f
Ruby: Include subclasses in more API calls
...
Change the behaviour of `API::getInstance()` and `API::getReturn()` to
include results on subclasses of the current API node.
2022-02-03 11:35:59 +13:00
Harry Maclean
61cd05cfc5
Ruby: Ensure TRoute and TRouteBlock are private
2022-02-03 10:55:28 +13:00
Harry Maclean
80835a5a19
Ruby: Don't expose abstract class
...
Make ActionDispatch::Route into a private class
ActionDispatch::RouteImpl, defining a new class Route which exposes the
necessary public API from RouteImpl.
Also rename getHTTPMethod to getHttpMethod.
2022-02-03 10:41:30 +13:00
Harry Maclean
a8a7c156d0
via - update tests
2022-02-03 10:40:23 +13:00
Arthur Baars
a22868ba27
Merge branch 'main' into ruby-3.1
2022-02-02 19:00:03 +01:00
Arthur Baars
3b05cb621c
Address comment
2022-02-02 14:11:45 +01:00
Arthur Baars
fdcef6225b
Ruby: fix QL warnings
2022-02-02 13:29:09 +01:00
Tom Hvitved
712418e5f8
Merge pull request #7781 from hvitved/dataflow/summary-stack-bottom-less-nonlinear
...
Data flow: Reduce non-linear recursion in `SummaryComponentStack::bottom`
2022-02-02 10:35:53 +01:00
Harry Maclean
5adcdf1cf8
Ruby: Minor refactor
2022-02-02 17:32:11 +13:00
Harry Maclean
8f5380122a
Ruby: Cache ActionDispatch IPA types
2022-02-02 17:31:47 +13:00
Harry Maclean
749dc092ae
Ruby: Attempt to mitigate potential bad join
...
By joining simultaneously on controller class and name.
2022-02-02 17:03:46 +13:00
Harry Maclean
a38bc9fe89
Ruby Fix handling of via: in ActionDispatch
2022-02-02 17:03:27 +13:00
Harry Maclean
856c3d332c
Minor cleanup to ActionDispatch modelling
...
`x.isStringOrSymbol(result)` is slightly terser than
`result = x.getStringOrSymbol()`.
2022-02-02 16:26:20 +13:00
Harry Maclean
47823b5a9a
Handle via: :all in Rails routes
...
ActionDispatch modelling now understands that
match "/foo", to: "foo#bar", via: :all
is equivalent to
match "/foo",
to: "foo#bar",
via: [:get, :post, :put, :patch, :delete]
2022-02-02 16:26:20 +13:00
Harry Maclean
8bdc05ddaf
getValueText -> getConstantValue
2022-02-02 16:26:20 +13:00
Harry Maclean
417287153b
Ruby: QL style fixes
2022-02-02 16:26:20 +13:00
Harry Maclean
e975f92091
Ruby: remove unused predicate
2022-02-02 16:26:20 +13:00
Harry Maclean
3786fbfc7d
Ruby: Rewrite ActionDispatch::underscore
...
This version is much shorter and hopefully performs a bit better.
2022-02-02 16:26:20 +13:00
Harry Maclean
eff2136f52
Ruby: remove unused predicate
2022-02-02 16:26:20 +13:00
Harry Maclean
dead7a8059
Ruby: Make most of ActionDispatch private
...
Any classes/predicates not used externally or in tests are now private.
Also fix some typos.
2022-02-02 16:26:20 +13:00
Harry Maclean
fa28e55645
Add a test for ActionDispatch::underscore
...
This shows how the predicate behaves, as well as a case where it goes
wrong.
2022-02-02 16:26:20 +13:00
Harry Maclean
9c67869875
Remove ActionDispatch::capitalize
...
This predicate isn't used.
2022-02-02 16:26:20 +13:00
Harry Maclean
ad71fdbb24
Add missing documentation to ActionDispatch::Route
2022-02-02 16:26:20 +13:00
Harry Maclean
1766916fc5
Ruby: Document ActionDispatch modelling
2022-02-02 16:26:20 +13:00
Harry Maclean
314683d5fb
Ruby: Improve UrlRedirect query using Rails routes
...
Handlers for non-GET requests aren't vulnerable to URL redirect attacks,
because browsers won't initiate non-GET requests when you click a link.
We can use Rails routing information, if present, to filter out any
handlers for non-GET requests.
2022-02-02 16:26:20 +13:00
Harry Maclean
751d8a7f59
Ruby: Document getACapture
2022-02-02 16:26:20 +13:00
Harry Maclean
870c6d7412
Ruby: Rails route resolution
...
Add `Route` classes which model Rails routing information, typically
defined in a `routes.rb` file. We extract only the most basic
information: HTTP method, path, controller and action. This is enough to
determine whether a given controller method is a route handler, and what
HTTP method it handles, which is useful for, among other things, the URL
redirect query.
2022-02-02 16:26:19 +13:00
Harry Maclean
ce0354acb3
Include rust-toolchain.toml in Ruby cache keys
...
This ensures that if we change our Rust version, the caches will be
invalidated.
2022-02-02 08:08:11 +13:00
Harry Maclean
9c32ab7122
rust-toolchain -> rust-toolchain.toml
2022-02-02 08:05:46 +13:00
Harry Maclean
613ecbb418
Ruby: Pin Rust to 1.54
...
Add a rust-toolchain file to the Ruby directory, which instructs Rustup
to install a specific version of Rust (1.54). This will be used in CI,
so any use of language features or dependencies that don't support 1.54
will result in a CI failure.
This should ensure we have a documented minimum supported rust version
and an easy to way to update it in the future (update the rust-toolchain
file).
2022-02-02 08:05:46 +13:00
Harry Maclean
fb00a6c61b
Merge pull request #7666 from github/hmac/file-open-access
...
Ruby: Add File.open as a FileSystemAccess
2022-02-02 07:32:16 +13:00
Arthur Baars
6451a71a78
Ruby: use ruby specific cache key
2022-02-01 15:18:09 +01:00
Nick Rolfe
990e07b986
Ruby/C#: add semmle.order attribute to edges in CFG tests
2022-01-31 20:08:24 +00:00
Tom Hvitved
f2352d8272
Data flow: Inline local(Expr|Instruction)?(Flow|Taint)
...
Computing a full transitive closure is often bad; by inlining all calls we are
providing more context to the QL optimizer.
2022-01-31 14:33:41 +01:00
Arthur Baars
abf3ce6223
Ruby: expressions in pin operator ^
2022-01-28 19:47:31 +01:00
Arthur Baars
00fb4d3776
Ruby: Values in Hash literals and keyword arguments can be omitted
2022-01-28 19:47:31 +01:00
Arthur Baars
3e2ca61c01
Ruby: support anonymous block parameters/arguments
2022-01-28 19:47:31 +01:00
Arthur Baars
b9258e78ca
Ruby: non-local variables in variable reference pattern
2022-01-28 19:47:31 +01:00
Arthur Baars
966b8be5f9
Ruby: add downgrade scripts
2022-01-28 19:47:31 +01:00
Arthur Baars
e5eb01ca45
Ruby: add upgrade scripts
2022-01-28 19:47:31 +01:00
Arthur Baars
c85012460a
Ruby: update dbscheme stats
2022-01-28 19:47:31 +01:00
Arthur Baars
c6a36a50c2
Ruby: regenerate dbscheme and library
2022-01-28 19:47:31 +01:00
