Tom Hvitved
49488fa0a0
Ruby: Fix bad join in ActionControllerHelperMethod
...
```
[2022-01-25 12:35:14] (234s) Tuple counts for ActionController::ActionControllerHelperMethod#class#ff/2@ef816fil after 1.5s:
7685 ~0% {3} r1 = JOIN ActionController::ActionControllerContextCall#ff#shared WITH Method::Method::getName_dispred#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'controllerClass', Lhs.0 'this'
13198 ~0% {3} r2 = JOIN r1 WITH Constant::ConstantValue::getStringOrSymbol_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'controllerClass', Lhs.2 'this', Rhs.1
15835365 ~4% {5} r3 = JOIN r2 WITH AST::AstNode::getEnclosingModule_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, "helper_method", Lhs.0 'controllerClass', Lhs.1 'this', Lhs.2
12943 ~1% {4} r4 = JOIN r3 WITH Call::MethodCall::getMethodName_dispred#ff ON FIRST 2 OUTPUT Lhs.4, Lhs.2 'controllerClass', Lhs.3 'this', Lhs.0
1146184 ~0% {4} r5 = JOIN r4 WITH Expr::Expr::getConstantValue_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.3, Rhs.1, Lhs.1 'controllerClass', Lhs.2 'this'
212 ~0% {2} r6 = JOIN r5 WITH project#Call::Call::getArgument_dispred#fff ON FIRST 2 OUTPUT Lhs.3 'this', Lhs.2 'controllerClass'
return r6
```
Joining on enclosing module and name simultaneously yields a much better join.
2022-01-25 13:00:13 +01:00
Tom Hvitved
67962cb93d
Ruby: Fix bad join in access predicate
...
Joining on variable name alone is a bad thing:
```
[2022-01-25 11:13:20] (228s) Tuple counts for Variable::Cached::access#ff#shared/3@868b54tu after 3m37s:
112554 ~0% {3} r1 = JOIN Variable::VariableReal::getNameImpl_dispred#ff WITH Variable::VariableReal::getDeclaringScopeImpl_dispred#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.0 'arg2', Rhs.1 'arg1'
561015756 ~1% {3} r2 = JOIN r1 WITH Variable::variableName#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1 'arg0', Lhs.2 'arg1', Lhs.1 'arg2'
return r2
```
This change ensures that we join on name and scope simultaneously.
2022-01-25 11:37:38 +01:00
Tom Hvitved
0299b4603f
Merge pull request #7677 from hvitved/ruby/constant-value
...
Ruby: Replace `getValueText` with `getConstantValue`
2022-01-25 10:31:02 +01:00
Harry Maclean
c5904b7410
Add inline tests for API Graph subclassing
2022-01-25 16:41:49 +13:00
Harry Maclean
d0a274c1e8
Use API graph subclassing in GraphQL modelling
...
This simplifies some of the code.
2022-01-25 16:41:24 +13:00
Harry Maclean
5e7a29a979
Ruby: Use API graph subclassing in Rails modelling
...
Now that API graphs have basic subclassing support, we can simplify some
of the ActiveRecord and ActionController code.
2022-01-25 16:40:14 +13:00
Tom Hvitved
66a24c5c49
Ruby: Introduce TAnyArrayElementContent
2022-01-24 20:25:05 +01:00
Tom Hvitved
cc712c20cb
Ruby: Use bitShiftLeft instead of pow in parseInteger
2022-01-24 16:06:35 +01:00
Tom Hvitved
6efa595478
Merge pull request #7688 from hvitved/dataflow/required-component-stack
...
Data flow: Restructure `RequiredSummaryComponentStack`
2022-01-24 15:10:08 +01:00
Tom Hvitved
2a972dc045
Address review comments
2022-01-24 14:27:42 +01:00
Tom Hvitved
64f19637d4
Address review comments
2022-01-24 13:33:18 +01:00
Arthur Baars
78b4d7cbb5
Ruby: remove redundant cast
2022-01-24 11:27:31 +01:00
Arthur Baars
0cef887683
Ruby: address comments
2022-01-24 11:27:26 +01:00
Arthur Baars
5df1f7a0c3
Ruby: use CfgNodes classes to implement case value to pattern variable taint steps
2022-01-24 10:31:08 +01:00
Arthur Baars
7d7e9ba9e1
Ruby: add CasePattern classes to CfgNodes
2022-01-24 10:31:08 +01:00
Arthur Baars
634c8cd060
Ruby: Generalize CfgNodes::ChildMapping
2022-01-24 10:31:08 +01:00
Arthur Baars
fcec8a8388
Address comments
2022-01-24 10:31:08 +01:00
Arthur Baars
ab4935fe68
Ruby: fix some alerts
2022-01-24 10:31:08 +01:00
Arthur Baars
26a0167d6d
Ruby: add taint step test for hash patterns
2022-01-24 10:31:06 +01:00
Arthur Baars
49c452239e
Ruby: add taint steps from case value to variables in patterns
2022-01-24 10:10:22 +01:00
Arthur Baars
77a3e4bd61
Ruby: CFG: fix completion of AsPattern variable
2022-01-24 10:10:22 +01:00
Harry Maclean
8419daad03
Ruby: Add subclassing support to API Graphs
...
Given the code
class A; end
class B < A; end
class C < A; end
You can find uses of B and C with the expression
API::getTopLevelMember("A").getASubclass()
2022-01-24 12:21:39 +13:00
Tom Hvitved
85e1cda81b
Ruby: Distinguish symbols from strings in ConstantValue
2022-01-21 19:16:12 +01:00
Harry Maclean
8e40899dfd
Merge pull request #7419 from github/hmac/const-get
2022-01-22 07:01:09 +13:00
Harry Maclean
2fa18801aa
Merge pull request #7665 from github/hmac/barrier-guard-array-const
2022-01-22 06:59:51 +13:00
Erik Krogh Kristensen
b75c316c27
fix non-us spelling
2022-01-21 11:46:33 +01:00
Erik Krogh Kristensen
f500bccbe4
add explicit this to member call
2022-01-21 11:46:33 +01:00
Tom Hvitved
cba733136c
Data flow: Sync
2022-01-21 09:42:16 +01:00
Tom Hvitved
aa9cfebc65
Ruby: Replace getValueText with getConstantValue
2022-01-21 09:19:19 +01:00
Erik Krogh Kristensen
a77b2b0209
Merge pull request #7668 from erik-krogh/simplify-casts
...
simplify expressions that could be type-casts
2022-01-20 15:20:18 +01:00
Alex Ford
9613ff743b
Merge pull request #7611 from github/ruby/protect_from_forgery-without-exception
...
Ruby: flag up `protect_from_forgery` calls without an exception strategy
2022-01-20 13:45:30 +00:00
github-actions[bot]
ab218421da
Post-release preparation for codeql-cli-2.7.6
2022-01-20 12:59:20 +00:00
Erik Krogh Kristensen
4e8e3a7420
simplify expressions that could be type-casts
2022-01-20 10:41:35 +01:00
github-actions[bot]
4ce8ccc52b
Release preparation for version 2.7.6
2022-01-20 08:21:18 +00:00
Harry Maclean
5dcee6ba27
Ruby: Add File.open as a FileSystemAccess
2022-01-20 21:09:41 +13:00
Harry Maclean
6bae03a7cc
Ruby: Update string const barrier guard
...
This change recognises guards like `FOO.include?`, where `FOO` is an array
constant.
2022-01-20 17:34:12 +13:00
Tom Hvitved
cb098df4ea
Merge pull request #7334 from github/hmac/regexp-interpolations
...
Ruby: Resolve simple string interpolations
2022-01-19 14:43:58 +01:00
Harry Maclean
08d48b9375
Add top-level doc comment to GraphQL.qll
2022-01-19 21:42:46 +13:00
Tom Hvitved
f02aeafef1
Ruby: Move regex/non-regex split into TAstNode to convey disjointness
2022-01-19 09:22:01 +01:00
Harry Maclean
4f7f92490a
Distinguish regex components from strings
...
Create a set of classes for components of regex literals,
separate from those of string literals. This allows us to special-case
components of free-spacing regexes (ones with the /x flag) to not have a
`getValueText()`.
This in turn is useful because our regex parser can't handle free-spacing
regexes, so excluding them ensures that we don't generate erroneous
ReDoS alerts.
2022-01-19 11:23:40 +13:00
Jeff Gran
47697f59c1
Ruby: Add classes for detecting user input from graphql-ruby
2022-01-18 09:13:58 -07:00
Anders Schack-Mulligen
fff3b5c5b4
Dataflow: Add qldoc.
2022-01-18 10:39:55 +01:00
Anders Schack-Mulligen
71e39353ca
Dataflow: Sync.
2022-01-18 10:36:52 +01:00
Anders Schack-Mulligen
dfa79f6119
Dataflow: Sync.
2022-01-18 10:30:09 +01:00
Chris Smowton
2c37885f6e
Sync dataflow
2022-01-18 10:30:09 +01:00
Owen Mansel-Chan
065043b311
Merge pull request #7588 from owen-mc/add-specific-needs-reference-predicates
...
Dataflow: Add language-specific NeedsReference predicates
2022-01-17 15:51:34 +00:00
Alex Ford
d09f48ecb4
Ruby: flag up protect_from_forgery calls without an exception strategy
2022-01-16 20:56:13 +00:00
Andrew Eisenberg
fbb5d7196f
Merge branch 'main' into post-release-prep/codeql-cli-2.7.5
2022-01-14 08:23:43 -08:00
Anders Schack-Mulligen
0b24af901d
Merge pull request #7349 from aschackmull/dataflow/state
...
Dataflow: Add support for flow state
2022-01-14 09:12:38 +01:00
Owen Mansel-Chan
d41c55c69c
Add needed predicates for Ruby and C#
...
This was done manually.
2022-01-13 15:10:19 +00:00
