Joe Farebrother
4b1626c83a
Add change note
2024-03-01 14:59:24 +00:00
Joe Farebrother
65b30c1dff
Add tests and qldoc
2024-03-01 14:46:55 +00:00
Joe Farebrother
a08b292099
Add models for Typhoeus::Request
2024-03-01 14:23:24 +00:00
Peter Stöckli
a693c6d9b4
Ruby: sinks for code injection via calls to method
2024-03-01 14:42:22 +01:00
Joe Farebrother
abdae2c437
Apply reveiw suggestion - update change note
...
Co-authored-by: Harry Maclean <hmac@github.com >
2024-03-01 09:57:28 +00:00
Joe Farebrother
bf2174ffce
Add change note
2024-03-01 09:57:28 +00:00
Joe Farebrother
0b7b7ea1b8
Add test cases and improve controller model
2024-03-01 09:57:24 +00:00
Joe Farebrother
ef0a1d2873
Implement models for translation methods
2024-03-01 09:52:53 +00:00
Tom Hvitved
914a605a87
Ruby: Rework hidden synthetic data-flow nodes
2024-02-27 15:33:58 +01:00
Joe Farebrother
3ab6f222d0
Merge pull request #15718 from joefarebrother/ruby-arel-sqlliteral
...
Ruby: Model Arel::Nodes::SqlLiteral.new
2024-02-27 12:43:47 +00:00
Harry Maclean
d0e7fbc871
Ruby: Add changenote
2024-02-27 09:47:51 +00:00
Tom Hvitved
bbeee8f38d
Merge pull request #15717 from hvitved/csharp/view-cfg
...
Shared `View CFG` implementation
2024-02-27 09:13:18 +01:00
Joe Farebrother
cb733dcf85
Simplify model defenition
2024-02-26 14:59:03 +00:00
Harry Maclean
f7b8e8af41
Ruby: Include request forgery sinks from MaD
2024-02-26 11:34:11 +00:00
Harry Maclean
8bed3fbed4
Ruby: Add basic model for Terrapin library
2024-02-26 11:32:41 +00:00
Harry Maclean
9d13a1ff51
Ruby: Add model for Process.spawn
2024-02-26 11:26:38 +00:00
Harry Maclean
d1847566b6
Ruby: Ql4QL fix
2024-02-26 11:26:38 +00:00
Harry Maclean
beef9965cc
Ruby: Model Open4 library
...
Also remove duplicate modeling of Process.spawn.
2024-02-26 11:26:38 +00:00
Harry Maclean
a03c06802e
Ruby: Add some more command injection sinks
2024-02-26 11:26:38 +00:00
Cornelius Riemenschneider
fd85c44129
Ruby: Start building the language pack using bazel.
...
This PR introduces a bazel and `rules_rust`-based build system
for the ruby extractor and language pack.
This replacese the existing, `cargo` and `cross`-based build system.
For local development, nothing changes, and the existing `cargo`-based
build still keeps working as-is.
We no longer need to use `cross` to compile our Linux binaries,
as we now can link against our hermetic C++ toolchain, which ships
with an old enough glibc, so that we don't run into symbol version issues
when deploying the binaries to older systems.
Besides the one change in dependency (explained in detail in `Cargo.toml`
and in https://github.com/github/codeql/pull/15595 ), nothing ought to
change in how we build the extractor.
2024-02-26 11:21:22 +00:00
Joe Farebrother
fb06e9f6b2
Merge pull request #15719 from joefarebrother/ruby-changenote-formatting
...
Ruby: Fix change note formatting
2024-02-26 11:12:01 +00:00
Tom Hvitved
5b6e76c030
Move View CFG implementation from Ruby/Swift into shared library
2024-02-26 11:23:49 +01:00
Joe Farebrother
403a1ac483
Fix change note formatting
2024-02-26 10:21:26 +00:00
Joe Farebrother
2257df5c6f
Model Arel::Nodes::SqlLiteral.new
2024-02-26 10:09:33 +00:00
Tom Hvitved
03a125de38
Merge pull request #15562 from Marcono1234/patch-2
...
Ruby: Fix formatting in changelog
2024-02-26 10:03:29 +01:00
Tom Hvitved
2683e40038
Merge pull request #15708 from hvitved/share-ide-contextual
...
Share `getFileBySourceArchiveName` implementation
2024-02-23 19:56:33 +01:00
Harry Maclean
f5be407989
Ruby: deprecate old ProtectFromForgeryCall class
2024-02-23 12:02:26 +00:00
Harry Maclean
7b3f1a0982
Ruby: fix comment
2024-02-23 11:14:52 +00:00
Harry Maclean
3ee425cc47
Ruby: Identify ActionController::API
...
`ActionController::API < ActionController::Base` is a base controller
class, so we should recognise it as such.
2024-02-23 11:13:17 +00:00
Harry Maclean
1fbf177b54
Ruby: QLDoc fix
2024-02-23 11:13:16 +00:00
Harry Maclean
3499d169f9
Ruby: Add missing QLDoc
2024-02-23 11:13:16 +00:00
Harry Maclean
3c69ab10f2
Ruby: Restrict rb/csrf-protection-not-enabled
...
This query only applies to codebases using Ruby on Rails < 5.2, or where
there is no call to `csrf_meta_tags` in the base ERb template.
2024-02-23 11:13:15 +00:00
Harry Maclean
49d826f667
Ruby: Add a query for CSRF protection not enabled
...
Specifically in Rails apps, we look for root ActionController classes
without a call to `protect_from_forgery`.
2024-02-23 11:13:14 +00:00
Tom Hvitved
62b16c0fa3
Share getFileBySourceArchiveName implementation
2024-02-23 11:25:49 +01:00
Tom Hvitved
94113521d1
Merge pull request #15689 from hvitved/ruby/no-field-branch-limit-summarized-callable
...
Ruby: No `fieldFlowBranchLimit` for `SummarizedCallable`s
2024-02-23 10:47:22 +01:00
Harry Maclean
fbc689227d
Merge pull request #15604 from p-/p--rails-more-request-sources
...
Ruby: add additional sources on the request object of Rails
2024-02-22 16:35:59 +00:00
Joe Farebrother
67e8f17c4c
Merge pull request #15619 from joefarebrother/ruby-activerecord-connection
...
Ruby: Add additional sql sinks for ActiveRecord connection methods
2024-02-22 14:02:31 +00:00
Joe Farebrother
1f409b0456
Merge pull request #15671 from joefarebrother/ruby-activerecord-extra-args
...
Ruby: Consider additional arguments to certain `ActiveRecord` methods as sql injection sinks.
2024-02-22 14:01:56 +00:00
Joe Farebrother
92bdd637a3
Address reveiw comment - add create nd remove select_insert
2024-02-22 09:55:46 +00:00
Tom Hvitved
ebee35b385
Ruby: No fieldFlowBranchLimit for SummarizedCallables
2024-02-22 10:27:25 +01:00
Tom Hvitved
23869fc8e6
Ruby: Fix bug in allowParameterReturnInSelf
2024-02-22 09:43:52 +01:00
github-actions[bot]
37f8fa3413
Post-release preparation for codeql-cli-2.16.3
2024-02-20 16:50:47 +00:00
Joe Farebrother
10da4d14d9
Add addtional arguments as sinks to certain methods
2024-02-20 16:35:29 +00:00
github-actions[bot]
6d061fbc35
Release preparation for version 2.16.3
2024-02-20 14:26:23 +00:00
Joe Farebrother
e36b9f4d3c
Add tests and change note
2024-02-15 15:26:20 +00:00
Harry Maclean
a9abba5859
Merge pull request #15520 from hmac/hmac-erb-raw-output-directive
...
Ruby: Recognise raw Erb output as XSS sink
2024-02-15 08:05:16 +00:00
Joe Farebrother
37eb81097f
Add additional sinks for connection methods
2024-02-14 22:42:03 +00:00
Peter Stöckli
2f7b946c9f
Ruby: add sources on request object of Rails
2024-02-13 15:52:18 +01:00
Harry Maclean
6cc5c09769
Ruby: Simplify ErbOutputDirective
2024-02-13 08:38:16 +00:00
Harry Maclean
11040d628b
Ruby: Add changenote
2024-02-13 08:38:15 +00:00
