Nick Rolfe
9034d74663
Ruby: add file-level qldoc
2021-11-12 11:12:27 +00:00
Anders Schack-Mulligen
7ffd9b4f9e
Dataflow: Include read/store steps when finding non-hidden return.
2021-11-11 11:26:21 +01:00
Anders Schack-Mulligen
6d9fb3ca43
Dataflow: Sync.
2021-11-10 15:11:13 +01:00
Tom Hvitved
7178a98e45
Ruby: Rename pruneUseNode{Fwd,Rev}
2021-11-09 15:16:36 +01:00
Tom Hvitved
30251740e3
Ruby: Prune nodes before computing trackUseNode
2021-11-09 15:16:36 +01:00
Tom Hvitved
8195ebf4b3
Merge pull request #7059 from hvitved/ruby/basic-store-step-postupdate
...
Ruby: Fix `basicStoreStep`
2021-11-09 15:16:07 +01:00
Alex Ford
556cdbaa21
ruby: QL format
2021-11-09 14:09:11 +00:00
Alex Ford
340897f262
ruby: drop unnecessary variable
2021-11-09 14:06:21 +00:00
Alex Ford
a23750a9c7
ruby: inline some predicates
2021-11-09 14:06:21 +00:00
Anders Schack-Mulligen
e0b121cd90
Merge pull request #7047 from hvitved/csharp/ssa/dominance-frontier
...
Shared SSA: Improved dominance frontier calculation
2021-11-08 08:50:46 +01:00
Alex Ford
5f78bbbf52
add missing documentation
2021-11-04 21:07:54 +00:00
Alex Ford
4666024419
model some ways to configure Rails
2021-11-04 19:56:56 +00:00
Alex Ford
91f99ed2a1
model skip_forgery_protection calls in ActionController classes
2021-11-04 19:56:56 +00:00
Alex Ford
8a412dc5fd
Add CSRFProtectionSetting concept
2021-11-04 18:18:29 +00:00
Tom Hvitved
3544c85445
Ruby: Make the target of basicStoreStep the post-update node
2021-11-04 14:21:22 +01:00
Tom Hvitved
1101b1054d
Ruby: Make target of basicStoreStep a normal data flow node
2021-11-04 14:20:07 +01:00
Erik Krogh Kristensen
02f500b9c2
Merge branch 'main' into htmlReg
2021-11-04 12:58:42 +01:00
Tom Hvitved
16d96d2ad3
Ruby: Remove Node::getEnclosingCallable and ParameterNode::isParameterOf
2021-11-03 15:59:29 +01:00
Tom Hvitved
df6962143d
Shared SSA: Sync files
2021-11-03 14:21:50 +01:00
Nick Rolfe
dd17271ec8
Merge remote-tracking branch 'origin/main' into nickrolfe/regex_injection
2021-11-03 11:55:42 +00:00
Tom Hvitved
ab37ae6613
Merge pull request #7036 from hvitved/ruby/truncate-get-value-text
...
Ruby: Truncate concatenated strings in `getValueText`
2021-11-03 10:57:43 +01:00
Mathias Vorreiter Pedersen
4a2894a707
Merge pull request #7025 from MathiasVP/nomagic-parameterCand
...
Dataflow: Replace a 'noinline' pragma with a 'nomagic' pragma
2021-11-02 20:40:44 +00:00
Tom Hvitved
8b287a7846
Ruby: Truncate concatenated strings in getValueText
2021-11-02 18:19:49 +01:00
Anders Schack-Mulligen
7d0152f3c0
Merge pull request #6932 from aschackmull/dataflow/flow-features
...
Dataflow: Add support for call context restrictions on sources/sinks.
2021-11-02 13:24:17 +01:00
Mathias Vorreiter Pedersen
6f4107ff23
Dataflow: Replace a 'noinline' pragma with a 'nomagic' pragma.
2021-11-02 11:37:40 +00:00
Tom Hvitved
302373d154
Merge pull request #6858 from hvitved/python/type-tracker-changes
...
Python: Type tracker changes
2021-11-02 11:47:01 +01:00
CodeQL CI
5d62aa5b29
Merge pull request #6994 from erik-krogh/redundant-cast
...
Approved by RasmusWL, aschackmull, esbena, geoffw0, hvitved, nickrolfe
2021-11-02 03:45:48 -07:00
Tom Hvitved
fe80c4a17b
Ruby: Sync files
2021-11-02 11:16:46 +01:00
Anders Schack-Mulligen
5951ae79b9
Dataflow: Add language specific predicates.
2021-10-29 11:11:35 +02:00
Anders Schack-Mulligen
00df6798b1
Dataflow: Sync
2021-10-29 11:00:23 +02:00
Erik Krogh Kristensen
15c90adec5
remove redundant cast where the type is enforced by an equality comparison
2021-10-28 18:08:20 +02:00
Erik Krogh Kristensen
e75448ebb0
remove redundant inline casts
2021-10-28 16:35:53 +02:00
Nick Rolfe
11154a9409
Ruby: add regex injection query
2021-10-27 15:58:12 +01:00
Anders Schack-Mulligen
6eabb610b4
Dataflow: Sync Ruby
2021-10-27 13:58:30 +02:00
Erik Krogh Kristensen
8a4b043cb1
fix imports
2021-10-26 15:39:45 +02:00
Erik Krogh Kristensen
97264b5dda
add the bad tag filter query to ruby
2021-10-26 15:25:12 +02:00
Erik Krogh Kristensen
c15ddf6e92
update ReDoSUtil in ruby
2021-10-26 15:03:09 +02:00
Erik Krogh Kristensen
2ddf445caf
move ruby files to match file structure from js/py
2021-10-26 14:54:12 +02:00
Mathias Vorreiter Pedersen
67fd38f328
C#/Ruby: Use a 'noinline' instead of a 'only_bind_into'.
2021-10-26 09:41:52 +01:00
Mathias Vorreiter Pedersen
4b137ede0e
Ruby: Sync identical files.
2021-10-25 22:03:44 +01:00
Tom Hvitved
f020b2e437
Merge pull request #335 from github/hmac/self-flow
2021-10-22 19:14:20 +02:00
Nick Rolfe
3851a27fc1
Merge pull request #358 from github/external-control-file-path
...
Add rb/path-injection query
2021-10-22 15:38:39 +01:00
Tom Hvitved
61d7cdeec0
Data flow: Assign empty locations to summary nodes
2021-10-22 14:48:33 +02:00
Harry Maclean
87df3a0a99
Minor refactor
2021-10-22 11:44:38 +01:00
Nick Rolfe
d4cee73720
Add taint summaries for ActiveStorage::Filename
2021-10-22 11:15:42 +01:00
Harry Maclean
336bd15d2f
Override isCapturedAccess for self variables
...
Many `self` reads are synthesised from method calls with an implicit
`self` receiver. Synthesised nodes have no `toGenerated` result, which
the default definition of `isCapturedAccess` uses to determine if a
variable's scope matches the access's scope.
Hence we override the definition to properly identify accesses like the
call `puts` (below) as captured reads of a `self` variable defined in a
parent scope.
In other words, `puts x` is short for `self.puts x` and the `self`
refers to its value in the scope of the module `Foo`.
```ruby
module Foo
MY_PROC = -> (x) { puts x }
end
```
We also have to update the SSA `SelfDefinition` to exclude captured
`self` variables.
2021-10-22 10:56:34 +01:00
Harry Maclean
f1add388a0
Synthesise writes to self for classes/modules
...
This requires changing the CFG trees for classes and modules from
post-order to pre-order so that we can place the writes at the root node
of the tree, to prevent them overlapping with reads in the body of the
class/module.
We need to do this because classes and modules don't define their own
basic block, but re-use the surrounding one. This problem doesn't occur
for `self` variables in methods because each method has its own basic
block and we can place the write on the entry node of the bock.
2021-10-22 10:56:34 +01:00
Arthur Baars
4f72d0853a
Merge pull request #375 from github/rc/3.3
...
Merge rc/3.3 into main
2021-10-21 18:16:57 +02:00
Nick Rolfe
5734f51792
Merge remote-tracking branch 'origin/main' into external-control-file-path
2021-10-21 10:58:38 +01:00
Arthur Baars
630ee17613
Ruby: sync-files and add allowParameterReturnInSelf()
2021-10-20 15:39:46 +02:00
