Rasmus Wriedt Larsen
adf109b624
Merge branch 'main' into inline-fail-tag
2022-10-27 13:42:32 +02:00
Rasmus Wriedt Larsen
6d43db43dd
Ruby: Fix tag missing from getARelevantTag
2022-10-27 09:12:06 +02:00
Rasmus Wriedt Larsen
fc7eb5b4fc
InlineExpectationsTest: sync
2022-10-27 09:02:28 +02:00
Dave Bartolomeo
23b572e9b7
Use ${workspace} for intra-workspace dependencies
...
Now that the released CLI supports replacement variables in dependency version ranges, we can now mark our published library packs as depending on whatever version of their dependency is in our workspace, without having to manually bump the dependency version every release.
Note that when the packs are published, the dependencies in the published pack file are rewritten to have the correct specific version.
2022-10-26 16:40:01 -04:00
Rasmus Wriedt Larsen
5e9897d150
InlineExpectationsTest: sync
2022-10-26 18:21:13 +02:00
thiggy1342
9c1fbfd330
Merge branch 'main' into expand-ruby-ssrf-sinks-faraday-connection-new
2022-10-25 13:09:17 -04:00
thiggy1342
3659eaa780
add markdown file extension
2022-10-25 10:13:19 -04:00
erik-krogh
e8dce25cc2
fix rb/code-injection
2022-10-25 14:44:23 +02:00
Erik Krogh Kristensen
ef5132b0ae
Merge pull request #10883 from erik-krogh/codeSink
...
RB: don't flag code-injection for dynamic loading where an attacker only controls a substring
2022-10-24 18:59:36 +02:00
erik-krogh
aafef382dc
refactor StringPercentCall#getFormatArgument
2022-10-24 18:57:24 +02:00
thiggy1342
952ad6ea46
Merge branch 'main' into expand-ruby-ssrf-sinks-faraday-connection-new
2022-10-24 09:52:24 -04:00
Asger F
ac4cac889f
Ruby: add DataFlow::ModuleNode
...
sdf
2022-10-24 15:35:17 +02:00
Asger F
65add15416
Ruby: add getALocalUse()
...
This is the inverse of getALocalSource()
2022-10-24 15:35:17 +02:00
Asger F
aab1e1f5b4
Ruby: add some helpers at the AST level
2022-10-24 15:35:17 +02:00
Erik Krogh Kristensen
5ff98cd80e
Merge pull request #10888 from erik-krogh/glob
...
Ruby: add model for Dir.glob and other Dir methods
2022-10-24 14:17:37 +02:00
Asger F
bcfe4ece6f
Merge pull request #10918 from asgerf/rb/constant-compound-assignment
...
Ruby: handle compound constant-assignment
2022-10-24 14:07:28 +02:00
Asger F
cac2e2e2e4
Merge pull request #10928 from asgerf/rb/assumed-global-const
...
Ruby: assume some global constants are defined
2022-10-24 14:06:34 +02:00
Asger F
0ffb0f6d4d
Ruby: constant lookup is unaffected by blocks
2022-10-24 13:07:21 +02:00
erik-krogh
07d90b34df
use instanceof in DirPathAccess
2022-10-24 12:05:26 +02:00
Erik Krogh Kristensen
669b0c35fe
fix qldoc
...
Co-authored-by: Nick Rolfe <nickrolfe@github.com >
2022-10-24 12:05:26 +02:00
erik-krogh
85cd7f9121
add model for Dir.glob and other Dir methods
2022-10-24 12:05:26 +02:00
Arthur Baars
b3855b089a
Ruby: some more tests
2022-10-22 14:15:29 +02:00
Arthur Baars
ccaa12998d
Ruby: desugar compound constant-assignments
2022-10-22 01:11:35 +02:00
Nick Rolfe
9fb436e22b
Ruby: add change note for localTaintStep fix
2022-10-21 16:33:29 +01:00
Nick Rolfe
269c27757d
Ruby: include value-preserving flow in localTaintStep
2022-10-21 16:17:11 +01:00
Nick Rolfe
5319216c18
Ruby: add test of TaintTracking::localFlowStep
2022-10-21 16:04:04 +01:00
Asger F
84ae17dcbb
Ruby: ensure Object is a transitive superclass
2022-10-21 15:18:59 +02:00
Arthur Baars
a56ed88db2
Merge pull request #10920 from github/post-release-prep/codeql-cli-2.11.2
...
Post-release preparation for codeql-cli-2.11.2
2022-10-21 11:58:12 +02:00
Tom Hvitved
4422327c00
Ruby: Call-context sensitivity for singleton method calls
2022-10-21 11:48:25 +02:00
Asger F
3fd2b9ad7b
Ruby: add a comment
...
This would have saved me some time
2022-10-21 11:44:12 +02:00
Asger F
ee7970afcb
Ruby: treat String as a builtin
2022-10-21 11:44:11 +02:00
Asger F
db58e3357b
Ruby: allow speculative container qname resolution
2022-10-21 11:44:11 +02:00
github-actions[bot]
be7693283b
Post-release preparation for codeql-cli-2.11.2
2022-10-21 08:07:17 +00:00
Tom Hvitved
6feff7e3ed
Ruby: Add more data-flow call sensitivity tests
2022-10-21 09:36:34 +02:00
Asger F
d26b0892cf
Ruby: also add an AST test
2022-10-21 09:23:21 +02:00
Asger F
038bdecad7
Ruby: add test with compound assignment to a constant
2022-10-21 09:20:03 +02:00
Tom Hvitved
db699ae314
Ruby: Refactor call graph logic for singleton methods
2022-10-21 07:27:41 +02:00
thiggy1342
4e5c1f210d
Update ruby/ql/lib/change-notes/2022-10-20-expand-faraday-model-for-ssrf-sink
...
Co-authored-by: Rahul Zhade <rzhade3@users.noreply.github.com >
2022-10-20 17:33:17 -04:00
thiggy1342
244a3329e0
Merge branch 'main' into expand-ruby-ssrf-sinks-faraday-connection-new
2022-10-20 16:37:57 -04:00
thiggy1342
4c3e3e442a
Add Faraday::Connection.new as sink for SSRF query
2022-10-20 20:32:08 +00:00
Asger F
8c2c28dd56
Ruby: add test showing missing superclass edge
2022-10-20 15:56:58 +02:00
Arthur Baars
a520de3986
Merge pull request #10902 from github/release-prep/2.11.2
...
Release preparation for version 2.11.2
2022-10-20 15:55:44 +02:00
Arthur Baars
45c9a0d0b1
Apply suggestions from code review
...
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com >
2022-10-20 15:22:29 +02:00
github-actions[bot]
9a0848bbc4
Release preparation for version 2.11.2
2022-10-20 11:05:19 +00:00
Tom Hvitved
faaead682e
Ruby: Block for steps into self parameters in trackModuleAccess
2022-10-20 13:00:12 +02:00
Tom Hvitved
bda98261cc
Ruby: Add more call graph tests
2022-10-20 12:59:32 +02:00
erik-krogh
bb8bcd4643
fix typo
2022-10-20 10:48:02 +02:00
erik-krogh
c13e8e4f48
Merge branch 'main' into formatTaint
2022-10-20 10:46:16 +02:00
erik-krogh
7797211118
Merge branch 'main' into unsafeRbCmd
2022-10-20 10:34:17 +02:00
erik-krogh
24916f8538
rename runsImmediately to runsArbitraryCode
2022-10-20 10:10:11 +02:00
