Arthur Baars
a1873cc803
Ruby: IncompleteUrlSubstringSanitization.ql
2022-03-07 16:17:32 +01:00
Arthur Baars
c9fa1fb5bb
Ruby: copy JS version of IncompleteUrlSubstringSanitization.ql
2022-03-07 16:17:08 +01:00
Arthur Baars
98f56f4d60
Js/Ruby: Share IncompleteHostnameRegExp.ql
2022-03-07 16:10:08 +01:00
Arthur Baars
9e8930c192
Ruby: IncompleteHostnameRegExp.ql
2022-03-07 16:10:08 +01:00
Arthur Baars
602538d1c1
Ruby: add RegExpPatterns module
2022-03-07 16:09:12 +01:00
Arthur Baars
95027e746c
Ruby: TypeTracker: add smallstep for functions that return their arguments
2022-03-07 11:51:54 +01:00
Tom Hvitved
c1db0a9429
Merge pull request #8317 from hvitved/typetracker/jump-step
...
Ruby/Python: Clear call contexts after jump steps in type tracking
2022-03-07 11:38:51 +01:00
Alex Ford
98dbe3aaf3
Ruby: make ActiveRecord Persistence::ModifyAndSaveCall private
2022-03-05 18:22:32 +00:00
Alex Ford
8fed9f9aa0
Ruby: ActiveRecord - match OrmWriteAccesses for assignements to the assignment node rather than the setter call
2022-03-04 17:24:24 +00:00
Arthur Baars
cd5c71e85e
Ruby: cache regExpSource/1 instead of isInterpretedAsRegExp
2022-03-04 10:15:22 +01:00
Harry Maclean
1181779c10
Merge pull request #7920 from github/hmac/string-flow-summaries
...
Ruby: Add String flow summaries
2022-03-04 09:09:19 +13:00
Arthur Baars
b79d08523c
Merge pull request #8293 from aibaars/regex-pattern-source
...
Ruby: parse more string literals as regular expressions
2022-03-03 17:35:40 +01:00
Arthur Baars
22b0697371
Update ruby/ql/lib/codeql/ruby/security/performance/ParseRegExp.qll
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2022-03-03 17:13:19 +01:00
Tom Hvitved
9d6d479fba
Add missing QL doc
2022-03-03 14:17:41 +01:00
Tom Hvitved
b23ab8089a
Ruby: Clear call contexts after jump steps in type tracking
2022-03-03 12:29:47 +01:00
Harry Maclean
4a43731b83
Ruby: Use SimpleSummarizedCallable
...
This simplifies some String flow summaries.
2022-03-03 10:49:44 +13:00
Arthur Baars
692fc4cb02
Update ruby/ql/lib/change-notes/2022-02-28-regex-string-literals.md
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-03-02 21:13:23 +01:00
Harry Maclean
37dac186a8
Ruby: String.try_convert isn't value-preserving
...
`String.try_convert` can convert arbitrary objects to strings, which
obviously isn't value-preserving.
2022-03-02 13:31:59 +13:00
Arthur Baars
169f65526e
Merge pull request #8292 from aibaars/api-graphs-private
...
Ruby: ApiGraphs: use private imports
2022-03-02 00:35:46 +01:00
Asger Feldthaus
df379809df
Ruby: support CSV rows of form ;any;Method[foo]
2022-03-01 14:08:21 +01:00
Asger Feldthaus
bf83400bd2
Ruby: port API::EntryPoint from JS
2022-03-01 14:08:21 +01:00
Asger Feldthaus
e10e3b9466
Ruby: convert ActiveStorage::Filename model to MaD
2022-03-01 14:08:21 +01:00
Asger Feldthaus
70c083fa64
Ruby: convert Regexp.escape model to MaD
2022-03-01 14:08:21 +01:00
Asger Feldthaus
388949f12e
Ruby: support WithBlock and WithoutBlock
2022-03-01 14:08:20 +01:00
Asger Feldthaus
a33e89279d
Ruby: instantiate ApiGraphModels library in Ruby
2022-03-01 14:08:20 +01:00
Arthur Baars
61fa3ba314
Add change note
2022-03-01 13:30:56 +01:00
Arthur Baars
a51f17e0ed
Ruby: introduce RegExpPatternSource
2022-03-01 13:30:51 +01:00
Arthur Baars
1240c11c4b
Ruby: parse some string literals as regex
...
In addition to regex literals, also parse normal string literals
as regular expressions if they somehow "flow" into a method call
that is known to interpret string values as regular expressions.
2022-03-01 13:26:51 +01:00
Tamás Vajk
94cb5c2be4
Merge pull request #8296 from github/post-release-prep/codeql-cli-2.8.2
...
Post-release preparation for codeql-cli-2.8.2
2022-03-01 11:57:36 +01:00
github-actions[bot]
980f822983
Post-release preparation for codeql-cli-2.8.2
2022-03-01 09:24:30 +00:00
Arthur Baars
7e6ef7ac74
Ruby: ApiGraphs: use private imports
2022-03-01 10:24:19 +01:00
Arthur Baars
5ce6b847d1
Merge pull request #8166 from aibaars/regex-char-sequence-1
...
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-28 17:47:53 +01:00
Alex Ford
6ddacce27a
Ruby: Add OrmWriteAccess concept changenote
2022-02-28 01:18:39 +00:00
Alex Ford
63ef9a75c9
Ruby: model OrmWriteAccesses for ActiveRecord
2022-02-28 01:18:39 +00:00
Alex Ford
8c6c680a28
Ruby: Add OrmWriteAccess concept
2022-02-28 01:11:40 +00:00
Arthur Baars
0c23f5815f
Add change note
2022-02-25 18:43:43 +01:00
Arthur Baars
5044f89105
Ruby/Python re-introduce normalCharacterSequence
2022-02-25 18:43:43 +01:00
Arthur Baars
9d9abaf1f9
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-02-25 12:27:20 +01:00
github-actions[bot]
20fe22c8c8
Release preparation for version 2.8.2
2022-02-24 14:57:08 +00:00
Harry Maclean
fc351fbd64
Ruby: Remove value-flow for name-matched summaries
...
String summaries that are identified by name only should not specify
value-preserving flow as this can cause spurious flow in cases where
they are applied to different but identically-named methods.
2022-02-24 16:15:15 +13:00
Harry Maclean
07369916b0
Ruby: Remove bad flow to/from block arguments
...
In these cases there is no block argument to the method call.
2022-02-24 14:44:59 +13:00
Asger Feldthaus
f1bfb31403
Shared: fix typo in a comment
2022-02-23 14:13:41 +01:00
Asger Feldthaus
bb9348d77f
Ruby: reject ArrayElement[-n] instead of interpreting it as ArrayElement[?]
2022-02-23 14:13:41 +01:00
Asger Feldthaus
a11c6f0f8e
Ruby: use AccessPathSyntax library
2022-02-23 14:13:40 +01:00
Asger Feldthaus
5cab737ef1
Shared: sync AccessPathSyntax.qll
2022-02-23 14:13:40 +01:00
Arthur Baars
69ed121ecb
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-22 16:15:33 +01:00
Harry Maclean
340288e0d4
Ruby: Update summary access paths for dot syntax
2022-02-22 16:41:16 +13:00
Harry Maclean
d180a55b3a
Ruby: Fix value/taint flow in String summaries
2022-02-22 16:41:16 +13:00
Harry Maclean
f07ae35b87
Ruby: Fix bug with String flow summaries
...
Split summaries for methods with optional block parmaters into separate
classes. Also model the `exclusive` argument to `String#upto`.
2022-02-22 16:41:16 +13:00
Harry Maclean
379de5581d
Ruby: Disable summaries that clash with Array
...
Some String methods are named identically to Array methods, and this
leads to overlapping flow summaries. These adversely affect the original
Array flow summaries.
2022-02-22 16:41:15 +13:00
