Alex Ford
91bca4a2c3
Ruby: limit ActiveRecord conditions sink to first array element
2024-04-12 15:32:16 +01:00
Alex Ford
2950890180
Ruby: add more ActiveRecord conditions arg test cases
2024-04-12 15:31:28 +01:00
Alex Ford
f98479dca3
Ruby: prepare test case whitespace
2024-04-12 15:30:42 +01:00
Tom Hvitved
04de315e0e
Ruby: Deprecate models-as-data CSV interface
2024-04-12 13:40:14 +02:00
Joe Farebrother
5cebcadc56
Merge pull request #15987 from joefarebrother/ruby-mass-reassignment
...
Ruby: Add query for insecure mass assignment
2024-04-12 10:18:41 +01:00
Anders Schack-Mulligen
2c43d0c5a4
Ruby: Update expected output (interesting).
2024-04-12 09:20:38 +02:00
Anders Schack-Mulligen
7cc8fd00aa
Ruby: Update expected output (uninteresting).
2024-04-12 09:20:35 +02:00
Joe Farebrother
0a3d73d902
Add flow steps and sanitizers for permit calls
2024-04-10 21:47:07 +01:00
erik-krogh
642a134035
add tests for the fixes in the qhelp, and fix an FP that appeared
2024-04-08 12:00:27 +02:00
Harry Maclean
409f46ef7b
Merge pull request #14308 from hmac/hmac-rb-csrf-not-enabled
...
Ruby: Add a query for CSRF protection not enabled
2024-04-02 11:30:36 +01:00
erik-krogh
c60cec36d4
add calls to .html_safe? as a shared XSS sanitizer
2024-03-22 17:46:39 +01:00
Joe Farebrother
b74145349b
Add test cases
2024-03-22 14:07:11 +00:00
Joe Farebrother
507a6102a2
Reorganise into Custimizations file + add some more sinks on ActiveRecord methods
2024-03-22 14:07:04 +00:00
Joe Farebrother
89838981b7
Add test cases
2024-03-22 14:04:52 +00:00
Harry Maclean
80ae017aa1
Ruby: Track flow into ActiveRecord scopes
2024-03-18 15:01:37 +00:00
Harry Maclean
dd5eb982ec
Merge pull request #15524 from hmac/hmac-process-spawn
...
Ruby: Add some more command injection sinks
2024-03-13 09:53:10 +00:00
Joe Farebrother
dbd33d1cf0
Model Argument[1] of ActiveRecord from
2024-03-08 14:04:01 +00:00
Joe Farebrother
0b7b7ea1b8
Add test cases and improve controller model
2024-03-01 09:57:24 +00:00
Tom Hvitved
914a605a87
Ruby: Rework hidden synthetic data-flow nodes
2024-02-27 15:33:58 +01:00
Joe Farebrother
3ab6f222d0
Merge pull request #15718 from joefarebrother/ruby-arel-sqlliteral
...
Ruby: Model Arel::Nodes::SqlLiteral.new
2024-02-27 12:43:47 +00:00
Harry Maclean
8212f5de1b
Ruby: Update test
2024-02-26 13:10:27 +00:00
amammad
32f5667bb6
revert YAML.qll and yaml sinks to previous PR, make a separate experimental query only for yaml
2024-02-26 12:12:03 +00:00
amammad
c582ea626d
update expected test file
2024-02-26 12:10:04 +00:00
amammad
9c5c8c8362
fix test file
2024-02-26 12:05:35 +00:00
amammad
464e2e4291
fix qldoc and test files
2024-02-26 12:04:52 +00:00
amammad
1410574f76
make seperate steps for YAML.parse* and use getAsuccessor*() to reach final to_ruby method call, All parts have Rewritten with API graphs exclusively
2024-02-26 11:59:35 +00:00
Harry Maclean
8bed3fbed4
Ruby: Add basic model for Terrapin library
2024-02-26 11:32:41 +00:00
Harry Maclean
dd092fd18f
Ruby: Fix CSRF test
2024-02-26 11:02:54 +00:00
Joe Farebrother
2257df5c6f
Model Arel::Nodes::SqlLiteral.new
2024-02-26 10:09:33 +00:00
Harry Maclean
32b775fdc3
Ruby: reduce duplicate alerts for csrf query
...
Only generate an alert on the top-most vulnerable Rails controller in
the controller tree.
2024-02-23 11:13:17 +00:00
Harry Maclean
6d6f8ba512
Ruby: Make CSRF query more sensitive
...
Generate an alert for every controller class that doesn't have or
inherity a `protect_from_forgery` setting.
2024-02-23 11:13:15 +00:00
Harry Maclean
49d826f667
Ruby: Add a query for CSRF protection not enabled
...
Specifically in Rails apps, we look for root ActionController classes
without a call to `protect_from_forgery`.
2024-02-23 11:13:14 +00:00
Joe Farebrother
1f409b0456
Merge pull request #15671 from joefarebrother/ruby-activerecord-extra-args
...
Ruby: Consider additional arguments to certain `ActiveRecord` methods as sql injection sinks.
2024-02-22 14:01:56 +00:00
Joe Farebrother
10da4d14d9
Add addtional arguments as sinks to certain methods
2024-02-20 16:35:29 +00:00
Harry Maclean
5af58d24e0
Ruby: Recognise raw Erb output as XSS sink
2024-02-12 13:28:44 +00:00
Anders Schack-Mulligen
35a3aa0a09
Ruby: Add empty provenance column to expected files.
2024-02-09 11:32:08 +01:00
Koen Vlaswinkel
87eb1ab103
Ruby: Include ReturnValue and exclude self for constructors
2024-02-08 13:40:10 +01:00
Koen Vlaswinkel
49dbad96f9
Switch from details string to DataFlow::Node
2024-02-05 16:33:01 +01:00
Koen Vlaswinkel
f83d2a7d55
Ruby: Avoid using toString where possible
2024-02-02 14:18:21 +01:00
Koen Vlaswinkel
8853acb4dd
Ruby: Add query for access paths in model editor
2024-02-01 16:20:00 +01:00
Koen Vlaswinkel
ce4d8d6b51
Merge pull request #15490 from github/koesie10/ruby-model-constructor-on-new
...
Ruby: Model constructors in endpoint query on new instead of initialize
2024-02-01 09:31:49 +01:00
Harry Maclean
06334eee2e
Merge pull request #14554 from maikypedia/maikypedia/insecure-randomness
...
Ruby: Add Insecure Randomness Query
2024-01-31 17:16:32 +00:00
Koen Vlaswinkel
c1aaf5a574
Ruby: Model constructors in endpoint query on new
2024-01-31 13:54:48 +01:00
Arthur Baars
4591560692
Merge pull request #14544 from p-/p--oj-ox-unsafe-deser
...
Ruby: additional unsafe deserialization sinks for ox and one for oj
2024-01-30 19:28:32 +01:00
Peter Stöckli
1947dee46a
Merge branch 'main' into p--oj-ox-unsafe-deser
2024-01-30 15:33:39 +01:00
Sid Shankar
b1d7a635f5
Renames diagnostic query files and tests
...
This commit renames the files relating to the diagnostic query that produces information on the number of files extracted. The files have been renamed from "SuccessfullExtractedFiles.*" to "ExtractedFiles.*". All related tests and test files have been renamed too.
The `@tags` and `@id` attributes of the queries have been left untouched, consistent with the `@tags` and `@id` for similar queries in other languages.
2024-01-29 20:19:20 +00:00
Sid Shankar
b26fef816a
Rb: Report any extracted file as successfully extracted
2024-01-08 22:21:30 +00:00
Harry Maclean
ece196cb25
Ruby: Update model editor tests
2023-12-08 14:52:51 +00:00
Harry Maclean
1dc0a063b0
Merge pull request #14679 from hmac/hmac-model-editor-ruby
...
Ruby: Experimental model editor support
2023-12-08 11:03:38 +00:00
Harry Maclean
d630773575
Merge pull request #14627 from alexrford/rb/update_all_sink
...
Ruby: refine `ActiveRecord` `update_all` as an SQL sink
2023-12-04 13:02:14 +00:00
