3397 Commits

Author	SHA1	Message	Date
erik-krogh	db3bf0e482	use the sanitizers from ReflectedXSS in unsafe-html-construction	2024-03-20 10:11:07 +01:00
Tom Hvitved	90779f4413	Ruby: Extend barrier guards to handle phi inputs	2024-03-20 10:02:20 +01:00
Dave Bartolomeo	311ba8ea1b	Merge from main to resolve conflicts	2024-03-19 10:41:31 -04:00
Harry Maclean	219cd4e415	Merge pull request #14426 from hmac/hmac-ar-scopes ... Ruby: Track flow into ActiveRecord scopes	2024-03-19 14:19:14 +00:00
Harry Maclean	7e479e3c8e	Ruby: Fix Hash#keys flow summary	2024-03-19 13:47:45 +00:00
Harry Maclean	22ddf2129b	Ruby: remove isString from TSymbol	2024-03-19 12:27:34 +00:00
Tom Hvitved	865026f22b	Ruby: Add up/downgrade scripts (sigh)	2024-03-19 13:04:12 +01:00
Tom Hvitved	72ff494739	Ruby: Regenerate dbscheme and stats	2024-03-19 13:04:07 +01:00
Harry Maclean	dde148ee7e	Ruby: add changenote	2024-03-19 08:40:30 +00:00
Harry Maclean	32b80f8cb1	Ruby: Add tests for hash flow	2024-03-19 08:38:14 +00:00
Tom Hvitved	fc55567d90	Merge pull request #15853 from hvitved/dataflow/get-location ... Data flow: Replace `hasLocationInfo` with `getLocation`	2024-03-18 20:21:46 +01:00
Harry Maclean	187a68bf76	Ruby: Add flow summary for Hash#keys	2024-03-18 17:56:10 +00:00
Harry Maclean	e895f96a3a	Ruby: Taint flow to second block param in map ... When `map` is called on a hash, the values in the hash are passed to the second parameter of the block.	2024-03-18 17:55:02 +00:00
Harry Maclean	80ae017aa1	Ruby: Track flow into ActiveRecord scopes	2024-03-18 15:01:37 +00:00
Joe Farebrother	4177c38ed4	Merge pull request #15907 from joefarebrother/ruby-uploaded-file ... Ruby: Model ActiveDispatch::Http::UploadedFile	2024-03-18 14:02:33 +00:00
github-actions[bot]	aebe9f6992	Post-release preparation for codeql-cli-2.16.5	2024-03-18 12:16:26 +00:00
github-actions[bot]	0a6243d07b	Release preparation for version 2.16.5	2024-03-18 10:14:07 +00:00
Arthur Baars	a810165e35	Fix minor formatting issues in changenotes	2024-03-18 10:57:05 +01:00
Joe Farebrother	8c5fff2d11	Update names and qldoc for params taint predicates	2024-03-15 14:43:29 +00:00
Tom Hvitved	e7b00a7b42	Ruby: Add post-update argument nodes for string constants	2024-03-15 10:47:39 +01:00
Joe Farebrother	f464f1b94e	Accept test output + fix qldoc typo	2024-03-14 22:25:37 +00:00
Joe Farebrother	b4ed77343b	Add change note + fix qldoc	2024-03-14 22:25:36 +00:00
Joe Farebrother	5333c75919	Model additional string attributes	2024-03-14 22:25:36 +00:00
Joe Farebrother	8c31b612ca	Model UploadedFile original_filename and read	2024-03-14 22:25:35 +00:00
Tom Hvitved	4085c8ec8f	Merge pull request #15866 from hvitved/ruby/orm-tracking-ap-limit ... Ruby: Lower access path limit to 1 for `OrmTracking`	2024-03-13 10:57:09 +01:00
Harry Maclean	dd5eb982ec	Merge pull request #15524 from hmac/hmac-process-spawn ... Ruby: Add some more command injection sinks	2024-03-13 09:53:10 +00:00
Tom Hvitved	695e728ed5	Ruby: Lower access path limit to 1 for OrmTracking	2024-03-12 14:58:29 +01:00
Tom Hvitved	dddba3228b	Merge pull request #15867 from hvitved/dataflow/ap-limit ... Data flow: Add `ConfigSig::accessPathLimit`	2024-03-12 14:57:51 +01:00
Tom Hvitved	4291290277	Ruby: Implement new data flow interface	2024-03-11 20:56:38 +01:00
Joe Farebrother	9c51514bd9	Merge pull request #15857 from joefarebrother/ruby-activerecord-from ... Ruby: Model second argument of `ActiveRecord` `from`	2024-03-11 16:49:52 +00:00
Tom Hvitved	da66281fef	Sync files	2024-03-11 13:02:04 +01:00
Tom Hvitved	7a39f077d9	Data flow: Add ConfigSig::accessPathLimit	2024-03-11 13:01:58 +01:00
Joe Farebrother	dbd33d1cf0	Model Argument[1] of ActiveRecord from	2024-03-08 14:04:01 +00:00
Tom Hvitved	85782ff1d4	Ruby: Exclude calls with arguments from OrmFieldAsSource	2024-03-07 17:34:01 +01:00
github-actions[bot]	dc9092c9ec	Post-release preparation for codeql-cli-2.16.4	2024-03-06 22:19:33 +00:00
github-actions[bot]	2f058ffb4d	Release preparation for version 2.16.4	2024-03-06 20:56:51 +00:00
Angela P Wen	ce31f8641a	Revert "Release preparation for version 2.16.4"	2024-03-06 12:07:33 -08:00
Harry Maclean	350dab4621	Merge pull request #15722 from hmac/mad-sinks	2024-03-06 08:18:19 +00:00
github-actions[bot]	661e68dab5	Release preparation for version 2.16.4	2024-03-05 18:13:58 +00:00
Joe Farebrother	dcc6f83d3b	Merge pull request #15782 from joefarebrother/ruby-typhoeus ... Ruby: Model `Typhoeus::Request.new`	2024-03-05 16:55:38 +00:00
Angela P Wen	967963a653	Revert "Release preparation for version 2.16.4"	2024-03-05 08:53:33 -08:00
Joe Farebrother	7027b7fe82	Apply review suggestions: Use getInstance and clarify predicate name/qldoc. Also fix changenote formatting.	2024-03-05 16:34:48 +00:00
Harry Maclean	148241183a	Ruby: update changenote	2024-03-05 10:20:25 +00:00
Harry Maclean	91cb2a37fd	Ruby: Model Process.exec	2024-03-05 10:19:22 +00:00
Harry Maclean	179aaa1342	Ruby: model Open4.popen4ext	2024-03-05 09:35:18 +00:00
Harry Maclean	87f3b43576	Ruby: remove deprecated private class	2024-03-05 08:28:16 +00:00
github-actions[bot]	a67218a027	Release preparation for version 2.16.4	2024-03-04 17:42:08 +00:00
Angela P Wen	2b2ea597ce	Fix formatting on changenotes	2024-03-04 16:42:38 +00:00
Joe Farebrother	31687afd5d	Fix performance	2024-03-04 09:47:12 +00:00
Joe Farebrother	5a1c0f60e6	Fix qldoc typo	2024-03-01 15:12:16 +00:00