thiggy1342
09f082081f
Simple tests passing
2022-05-28 23:29:58 +00:00
thiggy1342
39baadbdd2
test ql packs must be in the security directory
2022-05-28 23:19:32 +00:00
Adam Thigpen
52ac93b82e
adding skeleton for experimental unit tests
2022-05-28 15:14:42 -04:00
Tom Hvitved
a7b39ebeca
Ruby: Flow through hash-splat parameters
2022-05-25 12:37:22 +02:00
Tom Hvitved
faf24a4f18
Ruby: Data-flow through hashes
2022-05-24 14:27:55 +02:00
Arthur Baars
68aeb2ba85
Update test output
2022-05-20 16:30:58 +02:00
Alex Ford
4752c45fe5
ruby: update rb/weak-cryptographic-algorithm to specify the block mode if appropriate
2022-05-13 16:32:30 +01:00
Harry Maclean
ba1d43dd42
Merge pull request #8658 from hmac/hmac/insecure-download
...
Ruby: Add InsecureDownload query
2022-04-28 11:07:35 +12:00
Harry Maclean
6998608257
Ruby: Document missing test result
2022-04-27 12:47:09 +12:00
Harry Maclean
bb3fb0325b
Ruby: Add InsecureDownload query
...
This query finds cases where a potentially unsafe file is downloaded
over an unsecured connection.
2022-04-27 12:47:09 +12:00
Harry Maclean
2feb4a48be
Ruby: Add hasMisleadingAnchorPrecedence to MissingRegExpAnchor
2022-04-27 10:12:33 +12:00
Harry Maclean
e3c3c00c68
Ruby: Add MissingRegExpAnchor query
2022-04-27 10:12:33 +12:00
Nick Rolfe
9b6e610e24
Merge remote-tracking branch 'origin/main' into nickrolfe/incomplete_sanitization
2022-04-20 12:05:22 +01:00
Harry Maclean
c3f1fba985
Merge pull request #8598 from hmac/hmac/insecure-dep-resolution
...
Ruby: Add rb/insecure-dependency query
2022-04-14 02:09:44 +02:00
Nick Rolfe
fdca896614
Ruby: improve handling of [g]sub!
...
rb/incomplete-sanitization has a few cases where we find flow from one
one string substitution call to another, e.g.
a.sub(...).sub(...)
But this didn't find typical chained uses of the destructive variants,
e.g.
a.sub!(...)
a.sub!(...)
We now handle those cases by tracking flow from the post-update node for
the receiver of the first call.
2022-04-13 17:19:25 +01:00
Nick Rolfe
bbb8177176
Ruby: add rc/incomplete-sanitization query
2022-04-13 16:48:43 +01:00
Harry Maclean
8f3578c92a
Ruby: Include query results in test
2022-04-05 10:20:02 +12:00
Harry Maclean
3d96c5e6db
Ruby: Add test case for rb/insecure-dependency
...
This tests that we recognise kwargs in hashrocket style:
gem "foo", "1.2.3", :git => "..."
as well as the modern style:
gem "foo", "1.2.3", git: "..."
2022-04-01 15:30:07 +13:00
Alex Ford
882f78c6f9
Merge remote-tracking branch 'origin/main' into ruby/weak-cryptographic-algorithm
2022-03-31 17:17:46 +01:00
Arthur Baars
15c54f6100
Merge pull request #8354 from aibaars/incomplete-url-string-sanitization
...
Incomplete url string sanitization
2022-03-31 10:59:51 +02:00
Harry Maclean
37cedda63a
Ruby: Add InsecureDependencyResolution query
...
This query looks for places in a Gemfile where URLs with insecure
protocols (HTTP or FTP) are specified.
2022-03-30 13:39:15 +13:00
Arthur Baars
74aea81fe3
Ruby: refactor regex libraries
2022-03-24 11:37:02 +01:00
Arthur Baars
65f8f56095
Merge branch 'main' into incomplete-url-string-sanitization
2022-03-24 11:27:30 +01:00
Arthur Baars
06a99c3987
Ruby: fix location of setter-call argument
2022-03-23 12:55:52 +01:00
Harry Maclean
ff1d96c922
Ruby: Add rb/http-to-file-access query
2022-03-22 11:09:08 +13:00
Harry Maclean
6c18e1d7ac
Merge pull request #8272 from hmac/hmac/tainted-format-string
2022-03-22 08:37:47 +13:00
Alex Ford
c891c53835
Merge pull request #8395 from alexrford/ruby/clear-text-storage
...
Ruby: add `rb/clear-text-storage-sensitive-data` query
2022-03-21 10:05:39 +00:00
Harry Maclean
5a6da827d0
Ruby: Avoid FP in TaintedFormatString query
...
Kernel#printf supports two call signatures:
printf(String, *args)
printf(IO, String, *args)
We want to identify the String argument, which is the format string.
Previously we would return the 0th and 1st arguments, which gives some
FPs when the 1st arg is not a format string.
We now try to rule out the trivial case by checking if arg 0 has a
string value, and then assuming it is the format string. Otherwise we
fall back to returning both arguments.
This still has some false positive potential, but less than previously.
2022-03-21 12:51:47 +13:00
Harry Maclean
4249e30824
Ruby: Test tainted interpolated format arg
2022-03-21 12:51:18 +13:00
Harry Maclean
f6215d4c7e
Ruby: Add rb/tainted-format-string query
2022-03-21 12:51:18 +13:00
Arthur Baars
bf888f0f0b
Merge remote-tracking branch 'upstream/main' into incomplete-url-string-sanitization
...
Conflicts:
config/identical-files.json
javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.ql
javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qll
ruby/ql/src/queries/security/cwe-020/IncompleteUrlSubstringSanitization.qll
2022-03-18 16:09:20 +01:00
Arthur Baars
431b60506e
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-18 13:05:34 +01:00
Arthur Baars
1a51f0cf56
Ruby: regex: fix getGroupNumber
...
non-capture groups should not have a group number
2022-03-16 18:50:51 +01:00
Arthur Baars
fb8cc6e1a4
Ruby: String.index method returns 'nil', not '-1'
2022-03-16 16:18:19 +01:00
Asger F
228570129e
Merge branch 'main' into ruby/mad-prototype
2022-03-16 13:50:31 +01:00
Arthur Baars
6b323eeda8
Update expected output
2022-03-16 12:34:03 +01:00
Arthur Baars
ab93b3784b
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-16 12:31:12 +01:00
Nick Rolfe
6bd9616c6e
Ruby: interpret string escape sequences in getConstantValue()
2022-03-14 15:45:57 +00:00
Alex Ford
40b87e6df7
Ruby: tests for rb/weak-cryptographic-algorithm
2022-03-13 21:25:24 +00:00
Alex Ford
0f0a51e2e0
Ruby: update test output
2022-03-10 18:27:06 +00:00
Alex Ford
43fb759dfa
Ruby: add a few more rb/clear-text-storage-sensitive-data test cases
2022-03-10 17:52:50 +00:00
Alex Ford
37c0702cdd
Ruby: update test output
2022-03-10 17:50:29 +00:00
Alex Ford
0f3cf47ca9
Ruby/JS/Py: Add "random" to the notSensitiveRegexp() heuristic
2022-03-10 17:38:52 +00:00
Alex Ford
8be1be388e
Ruby: update CleartextStorage test output for source locations
2022-03-10 17:38:52 +00:00
Alex Ford
ef29a372a4
Ruby: Cleartext storage tests
2022-03-10 17:38:52 +00:00
Arthur Baars
a1873cc803
Ruby: IncompleteUrlSubstringSanitization.ql
2022-03-07 16:17:32 +01:00
Arthur Baars
c9fa1fb5bb
Ruby: copy JS version of IncompleteUrlSubstringSanitization.ql
2022-03-07 16:17:08 +01:00
Arthur Baars
097c661362
Ruby: drop results that cannot be found yet from IncompleteHostnameRegExp.expected
2022-03-07 16:10:08 +01:00
Arthur Baars
9e8930c192
Ruby: IncompleteHostnameRegExp.ql
2022-03-07 16:10:08 +01:00
Arthur Baars
832c9c4b0b
Ruby: copy IncompleteHostnameRegExp files from JavaScript
2022-03-07 16:10:07 +01:00
