Harry Maclean
fef46e1ee4
Ruby: Add flow summaries for String methods
2022-02-22 16:41:15 +13:00
Asger F
02c4966109
Merge pull request #7878 from asgerf/dot-separated-access-paths
...
Shared: Switch to dot-separated access paths in summary specs
2022-02-21 13:29:09 +01:00
Alex Ford
9196b64d6e
Merge pull request #8138 from github/ruby/file-write
...
Ruby: Implement `FileSystemWriteAccess` concept
2022-02-21 10:13:27 +00:00
Alex Ford
746290d903
Merge pull request #7713 from github/ruby/clear-text-logging
...
Ruby: Add `rb/clear-text-logging-sensitive-data` query
2022-02-21 10:12:33 +00:00
Asger Feldthaus
7848fcec80
Shared: sync AccessPathSyntax.qll
2022-02-21 08:21:53 +01:00
Asger Feldthaus
55ac5cb012
Shared: auto format
2022-02-21 08:21:53 +01:00
Asger Feldthaus
4985fbb526
Shared: update getSummaryCsv and related test output
2022-02-21 08:21:53 +01:00
Asger Feldthaus
dcc523a2b7
Shared: auto format
2022-02-21 08:21:53 +01:00
Asger Feldthaus
7fcbdbeada
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
2022-02-21 08:21:52 +01:00
Asger Feldthaus
2907d53e17
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
2022-02-21 08:21:52 +01:00
Asger Feldthaus
57bf0b1432
Ruby: remove support for legacy syntax
2022-02-21 08:21:51 +01:00
Asger Feldthaus
e3605eed44
Ruby: update CSV rows to dot-separated syntax
2022-02-21 08:21:50 +01:00
Asger Feldthaus
7005d53a67
Ruby: manually rewrite DigSummary access path
2022-02-21 08:16:55 +01:00
Asger Feldthaus
6dbeb81f36
Ruby: use AccessPathSyntax.qll to parse input/output summary specs
2022-02-21 08:16:55 +01:00
Alex Ford
6b8537c4e0
Ruby: FileSystemWriteAccess changenote
2022-02-20 20:14:01 +00:00
Alex Ford
12ce3d4784
Ruby: Implement FileSystemWriteAccess for IO/File API
2022-02-20 19:27:11 +00:00
Alex Ford
4f0174e89a
Ruby: add FileSystemWriteAccess concept
2022-02-20 19:26:54 +00:00
Alex Ford
dd383f942f
Merge remote-tracking branch 'origin/main' into ruby/clear-text-logging
2022-02-17 15:32:31 +00:00
Alex Ford
33f4fffe16
Ruby: Simplify sub!/gsub! sanitizers for cleartext logging query
2022-02-17 13:10:44 +00:00
Harry Maclean
bfd2c14555
Ruby: Add shim StandardLibrary.qll
...
This file re-exports everything it used to define, marking each as
deprecated to warn users that they should import `Core` or `Stdlib`
instead.
2022-02-17 20:44:04 +13:00
Harry Maclean
459f949c24
Ruby: fix old import in ActiveSupport
...
codeql.ruby.frameworks.StandardLibrary is deprecated
2022-02-17 20:44:04 +13:00
Harry Maclean
9fff2cfcff
Ruby: Add missing documentation
2022-02-17 20:44:04 +13:00
Harry Maclean
eb4f333c25
Ruby: Move UnknownMethodCall to ast/Call.qll
2022-02-17 20:44:04 +13:00
Harry Maclean
a397c65d36
Ruby: Split standard library modeling
...
Split the classes modeling various standard library concepts into a
structured group of multiple files.
Things that are part of the core language live in framworks/core and
standard libraries (that aren't part of core) live in frameworks/stdlib.
This mirrors the structure followed by the Ruby docs
(https://docs.ruby-lang.org/en/3.1/ ).
Tests are split in a followup commit.
2022-02-17 20:44:04 +13:00
Arthur Baars
ebb87c4b36
Merge pull request #7975 from github/post-release-prep/codeql-cli-2.8.1
...
Post-release preparation for codeql-cli-2.8.1
2022-02-15 20:17:35 +01:00
Erik Krogh Kristensen
25d64a7901
Merge pull request #7930 from erik-krogh/rbApiIpa
...
RB: convert the ruby ApiGraphs to use IPA labels
2022-02-11 14:35:39 +01:00
github-actions[bot]
21bf29353f
Post-release preparation for codeql-cli-2.8.1
2022-02-11 11:07:31 +00:00
Erik Krogh Kristensen
5a39708cf7
move TLabel to the Impl module and cache it
2022-02-11 10:54:45 +01:00
Erik Krogh Kristensen
daa96cc218
change some docstrings based on review, and make fields private
2022-02-11 10:25:54 +01:00
Erik Krogh Kristensen
6ae4652ce9
make the Impl module private again
2022-02-11 10:17:24 +01:00
Harry Maclean
017183e7f3
Merge pull request #7919 from github/hmac/open-uri
...
Ruby: recognise additional form for OpenURI
2022-02-11 14:03:26 +13:00
github-actions[bot]
f25fc70b7c
Release preparation for version 2.8.1
2022-02-10 22:08:24 +00:00
Alex Ford
d55ba2542a
Ruby: fix an alert
2022-02-10 18:35:22 +00:00
Erik Krogh Kristensen
02ed1ca392
add missing qldoc
2022-02-10 18:06:53 +01:00
Erik Krogh Kristensen
9739929795
convert the ruby ApiGraphs to use IPA labels
2022-02-10 17:54:19 +01:00
Alex Ford
bc53570a25
Ruby: fewer mappings from dataflow nodes to ast nodes
2022-02-10 15:58:31 +00:00
Alex Ford
83a3808bbe
Ruby: avoid marking mutator methods as being safe (i.e. not returning sensitive data)
2022-02-10 15:50:56 +00:00
Alex Ford
b46e4ccd71
Ruby: drop SanitizerIn from ClearTextLoggingQuery
2022-02-10 15:50:56 +00:00
Alex Ford
7b4af39315
Ruby: track masked variables potentially containing sensitive data more accurately
2022-02-10 15:50:56 +00:00
Alex Ford
59ab384825
Ruby: rb/clear-text-logging-sensitive-data - match on CFG nodes rather than AST nodes
2022-02-10 15:50:56 +00:00
CodeQL CI
a57ee019c2
Merge pull request #7819 from asgerf/asgerf/ruby-def-nodes
...
Approved by hvitved
2022-02-10 12:37:34 +00:00
Harry Maclean
d966ca8466
Ruby: recognise additional form for OpenURI
2022-02-10 15:42:15 +13:00
Harry Maclean
f30222256f
Merge pull request #7061 from github/hmac/actiondispatch
...
Ruby: Rails route resolution
2022-02-10 09:46:36 +13:00
Tamás Vajk
6483a92587
Merge pull request #7865 from github/post-release-prep/codeql-cli-2.8.0
...
Post-release preparation for codeql-cli-2.8.0
2022-02-09 16:42:38 +01:00
Tom Hvitved
0bd8411cb6
Ruby: Hide more SSA nodes from data-flow path explanations
2022-02-09 15:31:10 +01:00
Nick Rolfe
1eba8277ee
Merge pull request #7614 from github/nickrolfe/array_flow_summaries
...
Ruby: add more Array/Enumerable flow summaries
2022-02-09 09:57:59 +00:00
Harry Maclean
f276904fa9
Ruby: Add nomagic pragma to helper
2022-02-09 22:38:35 +13:00
Tom Hvitved
9440a45015
Merge branch 'main' into post-release-prep/codeql-cli-2.8.0
2022-02-09 09:40:33 +01:00
Harry Maclean
3206384884
Merge pull request #7824 from github/hmac/constantize
2022-02-09 08:30:21 +13:00
Tom Hvitved
b2419d60bd
Merge pull request #7090 from hvitved/ruby/perf
...
Ruby: Cache more predicates
2022-02-08 20:02:33 +01:00
