Alex Ford
6b7abef405
Ruby: remove unnecessary CryptographicOperation#isWeak override
2022-05-19 16:01:34 +01:00
Alex Ford
8b7bb7c358
Ruby: add missing qldoc
2022-05-19 15:55:48 +01:00
Alex Ford
d3662cf54a
Deprecate CryptographicOperation#isWeak and add a default implementation
2022-05-19 15:46:13 +01:00
Alex Ford
3d66905dc6
Share the CryptographicOperation and BlockMode concepts between dynamic langs
2022-05-19 15:46:03 +01:00
Rasmus Wriedt Larsen
5d6fbcec64
Ruby: Autoformat
2022-05-19 16:30:12 +02:00
Rasmus Wriedt Larsen
e810ba4ef6
Ruby: Expand flowToAnyArg test
2022-05-19 16:27:04 +02:00
Rasmus Wriedt Larsen
0879b6ae12
Ruby: Fix Argument[any,any-named] handling for path component in MaD
2022-05-19 15:51:30 +02:00
Rasmus Wriedt Larsen
7784b9f879
Ruby: WIP: Make Argument[any] and any-named work
...
It's not fully working I think the problem is that the code below ties
up `Argument[x]` with parameter positions, and `Parameter[x]` with
argument positions. This flip might be correct for flow-summaries, but
it does NOT seem to be correct for the `path` component in MaD.
Specifically, quick-eval for ParameterPosition does NOT include `keyword key` while
quick-eval for ArgumentPosition DOES include `keyword key`!
For the test `Foo.sinkAnyNamedArg(key: tainted) # $ MISSING: hasValueFlow=tainted`
c8be8d30b3/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsSpecific.qll (L130-L133)
2022-05-19 15:51:25 +02:00
Rasmus Wriedt Larsen
df83a51e1e
Ruby: Add anyNamedArg summary test
2022-05-19 15:42:41 +02:00
Rasmus Wriedt Larsen
cb6e5c24fc
Ruby: Prepare for anyNamedArg summary test
2022-05-19 15:42:41 +02:00
Rasmus Wriedt Larsen
a7f627af0c
Ruby: Add test for Argument[any] and any-named
2022-05-19 15:42:41 +02:00
Rasmus Wriedt Larsen
cb5ad8b775
Ruby: Don't include Argument[self] in Argument[any]
...
For flow-sumamries
2022-05-19 15:42:41 +02:00
Alex Ford
9e483ac4e0
Fix change note formatting
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-05-19 14:25:44 +01:00
Tom Hvitved
a18aef23f9
Data flow: Do not discard call context when computing reverse lambda flow through jumps
2022-05-19 15:19:41 +02:00
Tom Hvitved
ea703bc49a
Ruby: Add test that illustrates false negative lambda flow
2022-05-19 15:19:34 +02:00
Rasmus Wriedt Larsen
051754cf7e
Ruby: Add test of what Argument[any] for input/output includes
...
and an explicit test of what `Argument[self]` includes.
2022-05-19 14:02:22 +02:00
Tom Hvitved
2b2ac06128
Data flow: Sync files
2022-05-19 13:28:56 +02:00
Anders Schack-Mulligen
0e830f6052
C#/Ruby/Java: Fix pragmas.
2022-05-19 11:26:38 +02:00
Michael Nebel
73802cbd6d
Ruby: Refactor SummarizedCallable.
2022-05-19 11:04:18 +02:00
Erik Krogh Kristensen
215a6a72cc
Merge branch 'main' into useStringComp
2022-05-18 10:55:31 +02:00
Tom Hvitved
5e57e82997
Merge pull request #9191 from hvitved/ruby/taint-tracking-stage
...
Ruby: Force cached taint tracking predicates to be evaluated in data flow stage
2022-05-18 09:54:38 +02:00
Anders Schack-Mulligen
af7df79289
Autoformat
2022-05-18 09:38:11 +02:00
Anders Schack-Mulligen
48ab5b2403
C#/Ruby/Java: Fix references.
2022-05-18 09:27:54 +02:00
Anders Schack-Mulligen
829eb7f7a5
C#/Ruby: Sync FlowSummaryImpl.
2022-05-18 09:27:48 +02:00
Alex Ford
4bb6d1db3a
Add missing qldoc
2022-05-17 15:01:28 +01:00
Alex Ford
f92782d4e7
Ruby: fix some cases where we assume that a CryptographicOperation is using CBC when it is not
2022-05-17 14:57:11 +01:00
Alex Ford
c620fceb82
Ruby: remove unnecessary line from test
2022-05-17 14:57:11 +01:00
Alex Ford
6b496c78ef
Ruby: failing crypto op test
2022-05-17 14:57:11 +01:00
Erik Krogh Kristensen
86e97c32d6
fix all ql/use-string-compare
2022-05-17 14:11:05 +02:00
Tom Hvitved
f1f96b7e5c
Ruby: Force cached taint tracking predicates to be evaluated in data flow stage
2022-05-17 12:54:26 +02:00
Tom Hvitved
284357d2a0
Data flow: Do not materialize summaryArgParam
2022-05-17 12:50:01 +02:00
Erik Krogh Kristensen
bb289e29b9
sync typo fix to JS/RB
2022-05-17 12:26:31 +02:00
Arthur Baars
fcb3b82bde
Merge pull request #9178 from aibaars/update-tree-sitter-ruby
...
Ruby: update tree-sitter-ruby
2022-05-17 11:47:41 +02:00
Mathias Vorreiter Pedersen
1280d43e36
Merge pull request #9141 from github/post-release-prep/codeql-cli-2.9.2
...
Post-release preparation for codeql-cli-2.9.2
2022-05-17 10:01:37 +01:00
Arthur Baars
05dce09037
Ruby: update tree-sitter-ruby
2022-05-16 19:08:46 +02:00
Nick Rolfe
c518150b49
Merge pull request #9132 from github/nickrolfe/misspelling
...
QL for QL: generalise non-US spelling query
2022-05-16 16:03:36 +01:00
Alex Ford
0cc0494586
codeql format
2022-05-16 15:54:31 +01:00
Alex Ford
bda1c21562
BrokenCryptoAlgorithm block mode change notes
2022-05-16 15:49:19 +01:00
Tom Hvitved
a9f6d203cd
Merge pull request #8971 from aibaars/safe-nagivation
...
Ruby: add safe navigation operator
2022-05-16 10:53:56 +02:00
Anders Schack-Mulligen
83f817ca45
Merge pull request #9134 from aschackmull/dataflow/perf-std-order
...
Dataflow: Improve standard order through easier type check elimination.
2022-05-16 10:05:17 +02:00
Alex Ford
03e34e071a
ruby: inline expectations tests for CryptographicOperation concept
2022-05-13 16:32:36 +01:00
Alex Ford
4752c45fe5
ruby: update rb/weak-cryptographic-algorithm to specify the block mode if appropriate
2022-05-13 16:32:30 +01:00
Alex Ford
46bb247da9
ruby: add BlockMode concept
2022-05-13 15:33:20 +01:00
github-actions[bot]
b7cbd8fd75
Post-release preparation for codeql-cli-2.9.2
2022-05-12 18:21:38 +00:00
Nick Rolfe
1115227f9d
Merge remote-tracking branch 'origin/main' into nickrolfe/misspelling
2022-05-12 16:10:27 +01:00
Nick Rolfe
8caad12011
Ruby: fix typos in comments
2022-05-12 16:02:20 +01:00
Harry Maclean
64206a1c29
Ruby: Add getAPrimaryQlClass to CfgNodes classes
2022-05-12 15:32:36 +01:00
Anders Schack-Mulligen
8c8440a58a
Merge pull request #9101 from hvitved/dataflow/include-hidden
...
Data flow: Add `Configuration::includeHiddenNodes()`
2022-05-12 15:36:12 +02:00
Joe Farebrother
59e400d2e0
Merge pull request #7723 from joefarebrother/redos
...
Java: Add ReDoS queries
2022-05-12 13:50:38 +01:00
Anders Schack-Mulligen
adb56dfa39
Dataflow: Improve standard order through easier type check elimination.
2022-05-12 14:31:38 +02:00
