Erik Krogh Kristensen
8019b52838
run the non-us patch with "modelled/modeled"
2021-12-20 17:47:15 +01:00
Tom Hvitved
06575efce9
Data flow: Fix bad join-order
2021-12-20 15:44:16 +01:00
Tom Hvitved
aa9444b16c
Address review comment
2021-12-20 15:24:14 +01:00
Alex Ford
313e0c63fd
Merge pull request #7399 from github/ruby/stdlib-logger
...
Ruby: Model what is written to the log from stdlib `Logger` methods
2021-12-20 09:52:29 +00:00
Tom Hvitved
1e27ddf7c7
Ruby: Data flow for keyword arguments/parameters
2021-12-17 15:42:29 +01:00
Arthur Baars
46144fe0a3
Ruby: InClause and WhenClause are no longer Expr
2021-12-17 14:04:25 +01:00
Arthur Baars
974ad070d1
Revert "Ruby: CFG make in-clause post-order"
...
This reverts commit 1343ed58a21eec2954876d8d42e877a382ba89c8.
2021-12-17 14:04:25 +01:00
Arthur Baars
560413f94a
Address comments
2021-12-17 14:04:25 +01:00
Tom Hvitved
e4d9f5f29e
Fix QL doc
2021-12-17 13:14:11 +01:00
Tom Hvitved
ab2e0fdb18
Data flow: Sync files
2021-12-17 13:13:36 +01:00
Arthur Baars
83a8a60676
Ruby: CFG: consistency query to check that Expr nodes are post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
ba89653dff
Ruby: CFG: make RescueClause post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
db4b781fef
Ruby: CFG: make RescueModifier post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
cff63fa7d7
Ruby: CFG: make WhenExpr post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
a9286e897b
Ruby: CFG make in-clause post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
f49605569b
Ruby: CFG make more expressions post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
a4ea7129c2
Ruby: CFG: make 'case' a PostOrder node
2021-12-17 12:21:18 +01:00
Nick Rolfe
dba26a92e9
Merge remote-tracking branch 'origin/main' into nickrolfe/user-controlled-bypass
2021-12-16 15:05:01 +00:00
Arthur Baars
3ef707e358
Address comment
2021-12-16 15:38:41 +01:00
Arthur Baars
cdbd8b27d3
Ruby: SimpleParameter is not an Expr
2021-12-16 15:38:40 +01:00
Tom Hvitved
e9ef53c31b
Merge pull request #7390 from hvitved/ruby/deprecate-pattern-classes
...
Ruby: Deprecate `Pattern` classes
2021-12-16 14:36:13 +01:00
Tom Hvitved
4ccf9bf67c
Address review comments
2021-12-15 19:57:27 +01:00
Tom Hvitved
c6696adfde
Ruby: Add test case that would make old module resolution library diverge
2021-12-15 15:18:42 +01:00
Tom Hvitved
2187994f5c
Ruby: Prevent infinite recursion in module resolution library
2021-12-15 15:15:19 +01:00
Harry Maclean
062f7fe390
Merge pull request #7340 from github/hmac/private-methods
...
Ruby: handle private module methods
2021-12-15 21:07:49 +13:00
Harry Maclean
a32711245f
Ruby: Further speed up private method modelling
2021-12-15 17:38:52 +13:00
github-actions[bot]
59da2cdf69
Release preparation for version 2.7.4
2021-12-14 21:35:09 +00:00
Alex Ford
5fa6ecc5f1
Ruby: Model what is written to the log from stdlib Logger methods
2021-12-14 17:39:12 +00:00
Dave Bartolomeo
fa40d59332
Move older change notes to old-change-notes
...
Now that change notes are per-package, new change notes should be created in the `change-notes` folder under the affected pack (e.g., `cpp/ql/src/change-notes` for C++ query change notes. I've moved all of the change note files that were added before we started publishing them in packs to an `old-change-notes` directory under each language, to reduce the temptation to add new change notes there.
I'm working on a document to describe how and when to create change notes for packs separately.
2021-12-14 12:35:04 -05:00
Dave Bartolomeo
a62f181d42
Move new change notes to appropriate packs
2021-12-14 12:05:15 -05:00
Tom Hvitved
e882cdaca4
Ruby: Add missing getCallable() for nested destructured parameters
2021-12-14 15:04:40 +01:00
Tom Hvitved
10b2a0a54a
Ruby: Add test for nested destructured parameters
2021-12-14 15:04:40 +01:00
Tom Hvitved
9ea8b20e77
Ruby: Deprecate Pattern classes
2021-12-14 15:04:40 +01:00
Alex Ford
3262a14f22
Ruby: use DataFlow::CallNode#getBlock to remove a cast
2021-12-14 13:23:38 +00:00
Alex Ford
f3dcccb64b
Ruby: Add getBlock and getNumberOfArguments predicates to DataFlow::CallNode
2021-12-14 12:58:15 +00:00
Harry Maclean
f21948d0ca
Ruby: Speed up private method modelling
2021-12-14 11:10:38 +13:00
Nick Rolfe
dc27089714
Merge pull request #7375 from github/nickrolfe/cargo_update
...
Ruby: update crate versions
2021-12-13 18:16:29 +00:00
Nick Rolfe
b18f7a9bd7
Ruby: update crate versions
2021-12-13 15:37:35 +00:00
Alex Ford
4ae92667e1
Ruby: use Ruby object instantiation syntax in a comment
2021-12-13 12:54:45 +00:00
Rasmus Wriedt Larsen
1e45fa9ed4
JS/Py/Ruby: Add more CWEs to bad-tag-filter queries
...
CWE-185: Incorrect Regular Expression
The software specifies a regular expression in a way that causes data to
be improperly matched or compared.
https://cwe.mitre.org/data/definitions/185.html
CWE-186: Overly Restrictive Regular Expression
> A regular expression is overly restrictive, which prevents dangerous values from being detected.
>
> (...) [this CWE] is about a regular expression that does not match all
> values that are intended. (...)
https://cwe.mitre.org/data/definitions/186.html
From my understanding,
CWE-625: Permissive Regular Expression, is not applicable. (since this
is about accepting a regex match where there should not be a match).
2021-12-13 10:23:24 +01:00
Harry Maclean
6223b166c2
Update test fixtures
...
At the same time, rename some classes in `private.rb` so they don't
interact with identically-named modules in `calls.rb`.
2021-12-13 16:24:25 +13:00
Harry Maclean
e1d290d4c0
Ruby: Don't count private methods as Rails actions
...
Private instance methods on ActionController classes aren't valid
request handlers. Routing to them will raise an exception.
2021-12-13 15:36:55 +13:00
Nick Rolfe
b80a84c156
Merge pull request #7341 from github/nickrolfe/cookies
2021-12-10 19:52:23 +00:00
Andrew Eisenberg
66c1629974
Merge pull request #7285 from github/post-release-prep-2.7.3-ddd4ccbb
...
Post-release preparation 2.7.3
2021-12-10 09:59:45 -08:00
Nick Rolfe
b6c5b4d213
Ruby: define ActionViewCookiesCall
2021-12-10 16:36:26 +00:00
Nick Rolfe
a4da528812
Ruby: query to find user-controlled bypass of sensitive actions
2021-12-10 11:41:09 +00:00
Anders Schack-Mulligen
464b9c3991
Dataflow: Sync.
2021-12-10 11:20:01 +01:00
Tom Hvitved
657cd89286
Merge pull request #7347 from hvitved/cfg/more-consistency-tests
...
Shared CFG: Add two more consistency queries
2021-12-10 10:50:39 +01:00
Arthur Baars
13f7fd88f1
Merge pull request #7283 from aibaars/ruby-pattern-matching-cfg
...
Ruby: pattern matching: CFG
2021-12-10 10:24:38 +01:00
Tom Hvitved
70f76d06c7
Shared CFG: Add two more consistency queries
2021-12-10 09:56:50 +01:00
