Tom Hvitved
007ab2b7ce
Ruby: Do not expose AST layer through ruby.qll
2022-09-13 19:59:56 +02:00
Tom Hvitved
4247843a27
Ruby: Adjust the scope of singleton class targets
...
In
```rb
class << x
...
end
```
the scope of `x` is not the singleton class itself, but rather the outer scope.
2022-09-13 11:39:38 +02:00
Tom Hvitved
87db5fc6b1
Ruby: Add tests for getEnclosing{Method,Module}
2022-09-13 11:39:15 +02:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
Arthur Baars
7ca2e4c51f
Merge pull request #9953 from aibaars/update-grammar
...
Update tree-sitter-ruby
2022-09-12 10:51:37 +02:00
Alex Ford
0da367f6e5
Ruby: address QL4QL alerts for rb/sensitive-get-query
2022-09-12 08:56:17 +01:00
Alex Ford
f84035a65c
Ruby: add rb/sensitive-get-query query
2022-09-10 17:43:15 +01:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
Tom Hvitved
e3948e6683
Merge pull request #10354 from hvitved/ruby/convert-flow-test
...
Ruby: Convert data-flow test to use inline test expectations
2022-09-08 15:20:58 +02:00
Tom Hvitved
46127f9f59
Ruby: Convert data-flow test to use inline test expectations
2022-09-08 14:32:21 +02:00
Rasmus Wriedt Larsen
1d834799a2
Merge pull request #10114 from RasmusWL/shared-http-client-request
...
Ruby/Python: Shared HTTP client request concept
2022-09-08 11:58:06 +02:00
Harry Maclean
30c9bea8b3
Merge pull request #9974 from hmac/hmac/active-resource
...
Ruby: Model ActiveResource
2022-09-08 07:44:59 +01:00
Asger F
6b2ebcce3a
Merge pull request #10276 from asgerf/mad-typedef-entry-points
...
Add TypeModel hook for adding MaD type-defs from CodeQL
2022-09-07 14:14:48 +02:00
erik-krogh
79a048968e
make the alert messages of taint-tracking queries more consistent
2022-09-07 12:22:50 +02:00
Rasmus Wriedt Larsen
a9e1e72196
Merge branch 'main' into shared-http-client-request
2022-09-06 10:52:27 +02:00
Tom Hvitved
b197eff23e
Ruby: Add missing edges to the call graph for singleton methods
2022-09-05 14:11:04 +02:00
Tom Hvitved
ab22f932a5
Ruby: Add more tests for singleton methods
2022-09-05 14:09:59 +02:00
Asger F
62383fb3c9
Ruby: add TypeModel hook for adding type-defs from CodeQL
2022-09-03 13:51:02 +02:00
Asger F
55fdf84d15
Ruby+JS: change LabelEntryPoint.toString()
...
fixup Ruby entry point tests
2022-09-03 13:24:45 +02:00
Asger F
c9ba6f171b
Ruby: rename EntryPoint.getAUse,getARhs -> getASource,getASink
2022-09-03 13:13:32 +02:00
Harry Maclean
6fff02817d
Ruby: Fix bug in disablesCertificateValidation
2022-09-02 13:15:02 +12:00
Harry Maclean
570a03a08f
Ruby: Test disablesCertificateValidation
2022-09-02 13:00:29 +12:00
Tom Hvitved
4d485163a6
Ruby: Exclude top-level self accesses from trackModule
2022-09-01 11:05:53 +02:00
erik-krogh
7fd426e748
print a correct range for ranges that doesn't contain any alpha-numeric chars
2022-08-30 13:57:11 +02:00
Harry Maclean
aa6edb0edb
Ruby: Model ActiveResource
2022-08-29 14:24:37 +12:00
Nick Rolfe
898689f550
Merge pull request #9896 from github/nickrolfe/hardcoded_code
...
Ruby: port js/hardcoded-data-interpreted-as-code
2022-08-26 13:49:25 +01:00
Nick Rolfe
95bf18fdc9
Ruby: make hex-escaped strings ("\xCD\xEF" etc.) sources of hardcoded data
2022-08-26 09:33:03 +01:00
Arthur Baars
f77c2ac3d0
Update tests
2022-08-25 17:40:52 +02:00
Arthur Baars
59773eb743
Ruby: update tree-sitter grammar
2022-08-25 17:21:29 +02:00
Nick Rolfe
acf5b11139
Merge remote-tracking branch 'origin/main' into nickrolfe/hardcoded_code
2022-08-25 11:44:55 +01:00
erik-krogh
1c0f2251e2
Merge branch 'main' into msgConsis
2022-08-24 14:38:57 +02:00
erik-krogh
94ec0b8a52
update expected output of tests
2022-08-23 07:19:37 +02:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
Rasmus Wriedt Larsen
61bf2154cd
Merge branch 'main' into shared-http-client-request
2022-08-22 12:05:37 +02:00
Chris Smowton
8d20b9cf52
Use hasLocationInfo to match several Location fields at once
2022-08-19 19:03:17 +01:00
Chris Smowton
1ea7caf559
Fix join ordering in inline-expectations test
2022-08-19 18:17:22 +01:00
Rasmus Wriedt Larsen
10968bf115
Ruby: Fix alert-msg logic for RequestWithoutValidation.ql
...
This really surprised me, but as shown on the results, it does actually
make a difference in the alert-message.
2022-08-19 15:50:09 +02:00
Rasmus Wriedt Larsen
0ac3624342
Ruby: Implement new disablesCertificateValidation for all HTTP client models
...
Sadly most alert text changed, but the two important changes are:
1. The request on RestClient.rb:19 now has an expanded alert text,
highlighting where the origin of the value that disables certificate
validation comes from. (in this case, it's trivial since it's the
line right above)
2. We handle passing `false`/`OpenSSL::SSL::VERIFY_NONE` the same in the
argument passing examples in Faraday.rb
2022-08-19 15:46:22 +02:00
Rasmus Wriedt Larsen
1f028ac206
Ruby: Implement new disablesCertificateValidation for RestClient
2022-08-19 15:43:19 +02:00
Rasmus Wriedt Larsen
07d95918f2
Ruby: Add more RequestWithoutValidation.ql tests
...
Added:
- one where the value is not directly used when disabling certificate
validation.
- one with argument passing, Faraday, where it is only the passing of
`OpenSSL::SSL::VERIFY_NONE` that is recognized.
2022-08-19 15:42:50 +02:00
Rasmus Wriedt Larsen
47c9c5bddd
Ruby: Update RequestWithoutValidation.ql to match Python version
...
No library modeling currently has support for the new disablesCertificateValidation/2, so only the alert text has changed
(removed an import from Python so the queries would ACTUALLY match)
2022-08-18 14:32:41 +02:00
Rasmus Wriedt Larsen
4a82025087
Ruby: Base HTTP::Client::Request on shared concept
...
Fixing up deprecation errors in next commit
2022-08-18 13:42:53 +02:00
Rasmus Wriedt Larsen
9d96b73b8b
Ruby: Fixup test annotation
2022-08-18 13:42:49 +02:00
Tom Hvitved
08a5b5dc73
Merge pull request #10089 from hvitved/ruby/local-source-nodes
...
Ruby: Reduce size of `isLocalSourceNode`
2022-08-18 12:02:35 +02:00
Nick Rolfe
a46e2b3f2f
Merge pull request #10056 from hmac/hmac/action-controller-response-body
...
Ruby: Recognise Rails render calls as HTTP responses
2022-08-18 10:02:17 +01:00
Harry Maclean
70ec70940a
Merge pull request #8142 from github/hmac/incomplete-multi-char-sanitization
2022-08-18 10:02:39 +12:00
Tom Hvitved
ed2ec1acc0
Ruby: Reduce size of isLocalSourceNode
2022-08-17 17:19:30 +02:00
Alex Ford
d4d6657cb7
Merge pull request #10008 from alexrford/rb/log-injection
...
Ruby: Add `rb/log-injection` query
2022-08-17 15:01:22 +01:00
Nick Rolfe
94a51142d0
Ruby: fix typo in internal predicate name
2022-08-17 11:05:39 +01:00
