Harry Maclean
24a10aa5ff
Recognise send_file as a FileSystemAccess
...
This method is available in ActionController actions, and sends the file
at the given path to the client.
2022-09-28 12:14:22 +13:00
Nick Rolfe
bfda08e69c
Ruby: detect uses of libxml with entity substitution enabled by default
...
Including uses of ActiveSupport::XmlMini with the libxml backend
2022-09-27 11:53:43 +01:00
Nick Rolfe
7c30d333ad
Ruby: move XXE tests to subdirectory
2022-09-27 11:53:43 +01:00
Alex Ford
b018706afd
Ruby: update rb/unsafe-deserialization tests
2022-09-26 11:28:24 +01:00
Harry Maclean
9f99a3ca1f
Ruby: Model sanitize ActionView helper
2022-09-26 20:56:11 +13:00
Harry Maclean
1d693d336f
Ruby: Model javascript_include_tag and friends
2022-09-26 20:56:09 +13:00
Harry Maclean
ed0c85e3af
Ruby: Model ActionView helper XSS sinks
2022-09-26 20:55:04 +13:00
Alex Ford
364bc883ba
Ruby: add YAML.load_file as an unsafe deserialization sink
2022-09-23 15:54:15 +01:00
Nick Rolfe
2edbc16829
Ruby: add Hash.from_trusted_xml as an unsafe deserialization sink
2022-09-21 13:01:21 +01:00
Tom Hvitved
a9f2e5272f
Merge pull request #10376 from hvitved/ruby/no-ast-by-default
...
Ruby: Do not expose AST layer through `ruby.qll`
2022-09-21 13:15:30 +02:00
Erik Krogh Kristensen
7e17a919ae
Merge pull request #10304 from erik-krogh/rb-followMsg
...
RB: make the alert messages of taint-tracking queries more consistent
2022-09-20 22:58:31 +02:00
Alex Ford
08c8db8937
Ruby: stop rb/sensitive-get-query from considering ID type data as sensitive
2022-09-16 15:40:13 +01:00
Tom Hvitved
007ab2b7ce
Ruby: Do not expose AST layer through ruby.qll
2022-09-13 19:59:56 +02:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
Alex Ford
0da367f6e5
Ruby: address QL4QL alerts for rb/sensitive-get-query
2022-09-12 08:56:17 +01:00
Alex Ford
f84035a65c
Ruby: add rb/sensitive-get-query query
2022-09-10 17:43:15 +01:00
erik-krogh
79a048968e
make the alert messages of taint-tracking queries more consistent
2022-09-07 12:22:50 +02:00
Rasmus Wriedt Larsen
a9e1e72196
Merge branch 'main' into shared-http-client-request
2022-09-06 10:52:27 +02:00
erik-krogh
7fd426e748
print a correct range for ranges that doesn't contain any alpha-numeric chars
2022-08-30 13:57:11 +02:00
Nick Rolfe
898689f550
Merge pull request #9896 from github/nickrolfe/hardcoded_code
...
Ruby: port js/hardcoded-data-interpreted-as-code
2022-08-26 13:49:25 +01:00
Nick Rolfe
95bf18fdc9
Ruby: make hex-escaped strings ("\xCD\xEF" etc.) sources of hardcoded data
2022-08-26 09:33:03 +01:00
Nick Rolfe
acf5b11139
Merge remote-tracking branch 'origin/main' into nickrolfe/hardcoded_code
2022-08-25 11:44:55 +01:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
Rasmus Wriedt Larsen
10968bf115
Ruby: Fix alert-msg logic for RequestWithoutValidation.ql
...
This really surprised me, but as shown on the results, it does actually
make a difference in the alert-message.
2022-08-19 15:50:09 +02:00
Rasmus Wriedt Larsen
0ac3624342
Ruby: Implement new disablesCertificateValidation for all HTTP client models
...
Sadly most alert text changed, but the two important changes are:
1. The request on RestClient.rb:19 now has an expanded alert text,
highlighting where the origin of the value that disables certificate
validation comes from. (in this case, it's trivial since it's the
line right above)
2. We handle passing `false`/`OpenSSL::SSL::VERIFY_NONE` the same in the
argument passing examples in Faraday.rb
2022-08-19 15:46:22 +02:00
Rasmus Wriedt Larsen
1f028ac206
Ruby: Implement new disablesCertificateValidation for RestClient
2022-08-19 15:43:19 +02:00
Rasmus Wriedt Larsen
07d95918f2
Ruby: Add more RequestWithoutValidation.ql tests
...
Added:
- one where the value is not directly used when disabling certificate
validation.
- one with argument passing, Faraday, where it is only the passing of
`OpenSSL::SSL::VERIFY_NONE` that is recognized.
2022-08-19 15:42:50 +02:00
Rasmus Wriedt Larsen
47c9c5bddd
Ruby: Update RequestWithoutValidation.ql to match Python version
...
No library modeling currently has support for the new disablesCertificateValidation/2, so only the alert text has changed
(removed an import from Python so the queries would ACTUALLY match)
2022-08-18 14:32:41 +02:00
Rasmus Wriedt Larsen
4a82025087
Ruby: Base HTTP::Client::Request on shared concept
...
Fixing up deprecation errors in next commit
2022-08-18 13:42:53 +02:00
Rasmus Wriedt Larsen
9d96b73b8b
Ruby: Fixup test annotation
2022-08-18 13:42:49 +02:00
Harry Maclean
70ec70940a
Merge pull request #8142 from github/hmac/incomplete-multi-char-sanitization
2022-08-18 10:02:39 +12:00
Alex Ford
d4d6657cb7
Merge pull request #10008 from alexrford/rb/log-injection
...
Ruby: Add `rb/log-injection` query
2022-08-17 15:01:22 +01:00
Harry Maclean
f1a546c4d6
Rename IncompleteMultiCharacterSanitization[Query]
2022-08-17 16:03:49 +12:00
Harry Maclean
f2384a6a8f
Ruby: Share more code with JS
2022-08-17 16:03:49 +12:00
Harry Maclean
025e34d8e1
Ruby: Simplify imports
2022-08-17 16:03:48 +12:00
Harry Maclean
b7d9bf4066
Share IncompleteMultiCharacterSanitization JS/Ruby
...
Most of the classes and predicates in this query can be shared between
the two languages. There's just a few language-specific things that we
place in IncompleteMultiCharacterSanitizationSpecific.
2022-08-17 16:03:46 +12:00
Harry Maclean
c234bd94d1
Ruby: IncompleteMultiCharacterSanitization Query
...
This query is similar to IncompleteSanitization but for multi-character
sequences.
2022-08-17 16:02:48 +12:00
Erik Krogh Kristensen
f106e064fa
Merge pull request #9422 from erik-krogh/refacReDoS
...
Refactorizations of the ReDoS libraries
2022-08-16 09:32:08 +02:00
Erik Krogh Kristensen
0adb588fe8
Merge pull request #9712 from erik-krogh/badRange
...
JS/RB/PY/Java: add suspicious range query
2022-08-15 13:55:44 +02:00
Alex Ford
44c4b9ba5c
Ruby: add rb/log-injection test cases
2022-08-10 16:17:37 +01:00
Erik Krogh Kristensen
49276b1f38
Merge branch 'main' into refacReDoS
2022-08-09 16:18:46 +02:00
Nick Rolfe
6356b20928
Ruby: port js/hardcoded-data-interpreted-as-code
2022-07-26 16:05:22 +01:00
Harry Maclean
cb3ebeedf9
Merge pull request #9696 from thiggy1342/experimental-strong-params
...
RB: Experimental strong params query
2022-07-25 12:08:55 +12:00
thiggy1342
6cfde70898
Merge branch 'main' into experimental-strong-params
2022-07-22 20:41:33 -04:00
thiggy1342
871b6515d5
Merge branch 'main' into experimental-manually-check-request-verb
2022-07-21 18:47:07 -04:00
thiggy1342
8fabc06d37
fix test assertion
2022-07-21 21:25:44 +00:00
thiggy1342
304203ad2f
fix path problem output
2022-07-19 00:25:50 +00:00
thiggy1342
2cc703387b
use taint config for data flow
2022-07-14 00:11:52 +00:00
thiggy1342
7129002573
tweak tests more
2022-07-13 00:33:58 +00:00
thiggy1342
b3f1a513d1
Update tests
2022-07-13 00:25:43 +00:00
