Harry Maclean
d814e15a2f
Ruby: Refactor
2023-03-14 12:58:32 +13:00
erik-krogh
8b99e8af88
fix bad join by removing bad recursion
2023-03-13 17:34:11 +01:00
erik-krogh
25a6d496d9
Merge branch 'main' into HEAD
2023-03-13 17:33:06 +01:00
Tony Torralba
705691b096
Merge pull request #12446 from github/java/update-mad-decls-after-triage-2023-03-08T14-51-59
...
Java: Update MaD Declarations after Triage
2023-03-13 14:07:59 +01:00
Anders Schack-Mulligen
0c95ab2cdc
Merge pull request #12474 from hvitved/dataflow/call-back-post-update
...
Data flow: Synthesize post-update nodes for callback arguments inside summarized callables
2023-03-13 13:21:52 +01:00
Erik Krogh Kristensen
060c37b6a2
Merge pull request #12345 from erik-krogh/delOldDeps
...
delete old deprecations
2023-03-13 12:48:24 +01:00
Tom Hvitved
163bb2b94d
Add change note
2023-03-13 12:45:46 +01:00
Tom Hvitved
714b61b63e
Ruby: Add missing flow through self.new constructor calls
2023-03-13 12:45:46 +01:00
Anders Schack-Mulligen
c380ecbbbc
Data flow: Add change notes.
2023-03-13 11:09:13 +01:00
erik-krogh
6c1ebd999e
Merge branch 'main' into delOldDeps
2023-03-13 11:00:29 +01:00
Harry Maclean
3734a544bc
Ruby: Add change note
2023-03-13 21:38:45 +13:00
Harry Maclean
e80ff4efba
Ruby: Fix tests and qldoc
2023-03-13 20:32:37 +13:00
Harry Maclean
071517c74b
Ruby: Clean up Sinatra modeling
2023-03-13 19:25:56 +13:00
Harry Maclean
bfe42a656c
Ruby: QL4QL fix
2023-03-13 19:04:46 +13:00
Harry Maclean
384e7c7a80
Jump step for sinatra callbacks
2023-03-13 19:03:32 +13:00
Harry Maclean
e65d7224db
Ruby: tests, patterns, fix erb flow
2023-03-13 19:03:32 +13:00
Harry Maclean
eada3b91df
Ruby: track flow from sinatra routes to erb files
2023-03-13 19:03:32 +13:00
Harry Maclean
c82b4638c6
Ruby: Import Sinatra modeling by default
2023-03-13 19:03:32 +13:00
Harry Maclean
a1fab31bfc
Ruby: Model Sinatra
...
Adds some very basic modeling of Sinatra applications.
We recognise the `params` call in Sinatra routes as an HTTP request
input access.
2023-03-13 19:03:32 +13:00
Harry Maclean
9c3d141c9c
Ruby: Add change note
2023-03-13 18:57:55 +13:00
Harry Maclean
fe995dd99b
Ruby: ActiveRecord::Connection.execute SQL sink
2023-03-13 09:03:54 +13:00
Harry Maclean
025cd34dab
Ruby: Taint flow through ActionController params
...
We were not recognising "require" as returning a Parameters instance.
2023-03-13 08:52:41 +13:00
Harry Maclean
2d95b6a049
Ruby: Add count_by_sql as SQL sink
2023-03-13 08:40:32 +13:00
Harry Maclean
c97dccf0de
Ruby: Add reorder as a SQL sink
...
In recent versions of Rails this method doesn't seem to be vulnerable,
but it may be in previous versions. There's a slight FP risk here, but
I think it is small.
2023-03-13 08:38:17 +13:00
Anders Schack-Mulligen
1e64748ffe
Dataflow: Autoformat.
2023-03-10 15:12:19 +01:00
Anders Schack-Mulligen
289f921171
Dataflow: Sync.
2023-03-10 14:56:54 +01:00
Anders Schack-Mulligen
00f0879ff5
Dataflow: Sync.
2023-03-10 14:56:54 +01:00
Tom Hvitved
6eea906bbf
Data flow: Synthesize post-update nodes for callback arguments inside summarized callables
2023-03-10 12:43:21 +01:00
Tony Torralba
8aa80882ea
Sync files
2023-03-10 12:35:13 +01:00
Anders Schack-Mulligen
159d8e978c
Dataflow: one more autoformat post rebase
2023-03-10 10:04:35 +01:00
Anders Schack-Mulligen
a5d229903d
Ruby: Autoformat
2023-03-10 09:41:20 +01:00
Arthur Baars
348165205c
Merge pull request #12442 from aibaars/diagnostics-tests
...
Ruby: add some integration tests for diagnostic messages
2023-03-09 21:58:42 +01:00
Mathias Vorreiter Pedersen
59402eb754
Merge pull request #12462 from MathiasVP/disable-std-order-in-fwd-flow-stage-1
...
DataFlow: Disable standard order in `Stage1::fwdFlow`
2023-03-09 15:30:05 +00:00
Alex Ford
5ef71f9d28
Merge pull request #12306 from alexrford/rb/more-expr-nodes
...
Ruby: ensure that all Ast `Expr`s have a dataflow node type more precise than `ExprNode`
2023-03-09 14:54:34 +00:00
Asger F
6e744093e2
Merge pull request #12398 from github/post-release-prep/codeql-cli-2.12.4
...
Post-release preparation for codeql-cli-2.12.4
2023-03-09 15:38:21 +01:00
Rasmus Wriedt Larsen
38fe9b71b9
Ruby: Use new parameter position for synthetic hash-splat instead
...
We wanted to ensure that a callable did not have multiple parameters
with same parameter position. Originally we fixed this with
e0bd210797
2023-03-09 15:05:07 +01:00
Arthur Baars
8096f86224
Ruby: lower severity of parse error to warning
2023-03-09 13:14:57 +01:00
Mathias Vorreiter Pedersen
1f77f77153
DataFlow: Sync identical files.
2023-03-09 10:41:15 +00:00
Maiky
d9d63bbdc6
Change ERB to Erb
2023-03-08 10:41:24 +01:00
Maiky
3e1808d92e
Apply suggestions from code review
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-03-08 10:30:43 +01:00
Tom Hvitved
b6a709df50
Ruby: Rewrite Stored XSS query to use new data flow interface
2023-03-07 07:23:27 +01:00
Mathias Vorreiter Pedersen
92ad099c1b
DataFlow: Remove bindingsets, remove the call column, and swap parameter and argument columns.
2023-03-06 13:47:59 +00:00
Mathias Vorreiter Pedersen
3bf28cc752
DataFlow: Sync identical files.
2023-03-06 13:46:21 +00:00
Mathias Vorreiter Pedersen
e6b6369a21
Ruby: Add stub.
2023-03-06 13:44:59 +00:00
Anders Schack-Mulligen
5c7f2ac7f7
Merge pull request #12186 from aschackmull/dataflow/refactor-configuration
...
Data flow: Refactor configuration
2023-03-06 13:38:59 +01:00
Arthur Baars
d2ab40c184
Merge pull request #12208 from gregxsunday/main
...
Add ZipSlip and TarSlip query to ruby
2023-03-06 10:40:06 +01:00
Anders Schack-Mulligen
557cb17f4d
Dataflow: Minor perf fix for single config wrapper.
2023-03-06 10:24:33 +01:00
Dave Bartolomeo
e169702165
Merge branch 'main' into post-release-prep/codeql-cli-2.12.4
2023-03-04 09:20:44 -05:00
github-actions[bot]
af61b45785
Post-release preparation for codeql-cli-2.12.4
2023-03-04 14:16:55 +00:00
github-actions[bot]
462da63970
Release preparation for version 2.12.4
2023-03-03 14:11:51 +00:00
