Harry Maclean
f1a546c4d6
Rename IncompleteMultiCharacterSanitization[Query]
2022-08-17 16:03:49 +12:00
Harry Maclean
f2384a6a8f
Ruby: Share more code with JS
2022-08-17 16:03:49 +12:00
Harry Maclean
025e34d8e1
Ruby: Simplify imports
2022-08-17 16:03:48 +12:00
Harry Maclean
b7d9bf4066
Share IncompleteMultiCharacterSanitization JS/Ruby
...
Most of the classes and predicates in this query can be shared between
the two languages. There's just a few language-specific things that we
place in IncompleteMultiCharacterSanitizationSpecific.
2022-08-17 16:03:46 +12:00
Harry Maclean
c234bd94d1
Ruby: IncompleteMultiCharacterSanitization Query
...
This query is similar to IncompleteSanitization but for multi-character
sequences.
2022-08-17 16:02:48 +12:00
Tom Hvitved
aa93986d1a
Ruby: Add tests that demonstrate missing flow through positional arguments
2022-08-16 10:36:40 +02:00
Erik Krogh Kristensen
f106e064fa
Merge pull request #9422 from erik-krogh/refacReDoS
...
Refactorizations of the ReDoS libraries
2022-08-16 09:32:08 +02:00
Harry Maclean
7ef6ffbc54
Ruby: Recognise Rails render calls as HTTP responses
2022-08-16 14:03:26 +12:00
Erik Krogh Kristensen
0adb588fe8
Merge pull request #9712 from erik-krogh/badRange
...
JS/RB/PY/Java: add suspicious range query
2022-08-15 13:55:44 +02:00
erik-krogh
b54f037424
Merge branch 'main' into refacReDoS
2022-08-12 20:28:30 +02:00
Alex Ford
44c4b9ba5c
Ruby: add rb/log-injection test cases
2022-08-10 16:17:37 +01:00
Tom Hvitved
19043bdf38
Merge pull request #9976 from hvitved/ruby/hash-literal-summary-simplification
...
Ruby: Simplify flow summaries for hash literals
2022-08-10 08:57:33 +02:00
Harry Maclean
30ff18aec8
Merge pull request #9919 from hmac/hmac/ar-associations
...
Ruby: ActiveRecord associations
2022-08-10 11:13:39 +12:00
Erik Krogh Kristensen
49276b1f38
Merge branch 'main' into refacReDoS
2022-08-09 16:18:46 +02:00
Tom Hvitved
28c8d9b885
Ruby: Add two more hash flow tests
2022-08-09 14:17:07 +02:00
Tom Hvitved
975edac34e
Merge pull request #9969 from hvitved/ruby/kwargs-missing-flow
...
Ruby: Support more flow through keyword arguments
2022-08-09 09:59:57 +02:00
Harry Maclean
22d7b046ab
Ruby: Fix <<
2022-08-09 15:08:17 +12:00
Harry Maclean
e3115b5ed7
Ruby: Add test for other=
2022-08-09 15:08:17 +12:00
Harry Maclean
831f722402
Ruby: Make room for new test
2022-08-09 15:08:17 +12:00
Harry Maclean
dc853d9728
Ruby: Model ActiveRecord associations
2022-08-09 15:08:17 +12:00
Tom Hvitved
9268437a58
Ruby: Generalize SynthHashSplatParameterNode to also work for synthesized methods
2022-08-08 14:05:06 +02:00
Harry Maclean
74d529d3e3
Merge pull request #9918 from hmac/hmac/mime-type-match
...
Ruby: Model Mime::Type
2022-08-05 11:51:45 +12:00
Tom Hvitved
01c0d4b59f
Ruby: Support more flow through keyword arguments
2022-08-04 16:20:08 +02:00
Tom Hvitved
38ede25385
Ruby: Add test that illustrates missing flow for keyword arguments
2022-08-04 14:39:22 +02:00
Harry Maclean
83393dc195
Ruby: Recognise more AR write accesses
...
This change means we recognise calls like
```rb
User.create(params)
User.update(id, params)
```
as instances of `PersistentWriteAccess`.
2022-08-04 17:22:46 +12:00
Harry Maclean
d4f7f2b75e
Ruby: Add test for AR PersistentWriteAccesses
2022-08-04 17:22:46 +12:00
Harry Maclean
7ed81db32d
Ruby: Move ActiveRecord tests to new directory
2022-08-04 17:22:46 +12:00
Arthur Baars
d8592a2b05
Ruby: PrintAST: more stable order for synthesized nodes
2022-08-03 09:02:38 +02:00
Harry Maclean
f42d33312f
Ruby: Model Mime::Type
...
Add type summaries to recognise instances of Mime::Type, and recognise
arguments to Mime::Type.match? and Mime::Type.=~ as regular expression
interpretations.
2022-07-29 11:41:48 +12:00
Harry Maclean
c29eb814b2
Ruby: Reorganise ActionDispatch framework
...
Put routing modelling inside a Routing module.
2022-07-29 10:44:36 +12:00
Nick Rolfe
6356b20928
Ruby: port js/hardcoded-data-interpreted-as-code
2022-07-26 16:05:22 +01:00
Harry Maclean
681e58c8e0
Merge pull request #9850 from hmac/hmac/arel
...
Ruby: Model Arel.sql
2022-07-25 12:09:18 +12:00
Harry Maclean
cb3ebeedf9
Merge pull request #9696 from thiggy1342/experimental-strong-params
...
RB: Experimental strong params query
2022-07-25 12:08:55 +12:00
thiggy1342
6cfde70898
Merge branch 'main' into experimental-strong-params
2022-07-22 20:41:33 -04:00
thiggy1342
b4d762fb21
Merge branch 'main' into experimental-manually-check-request-verb
2022-07-22 20:41:23 -04:00
thiggy1342
871b6515d5
Merge branch 'main' into experimental-manually-check-request-verb
2022-07-21 18:47:07 -04:00
thiggy1342
8fabc06d37
fix test assertion
2022-07-21 21:25:44 +00:00
Arthur Baars
1399610bd4
Merge branch 'main' into encoding
2022-07-21 21:21:17 +02:00
Arthur Baars
7be106d7bb
Ruby: handle magic coding: comments
2022-07-21 16:33:18 +02:00
thiggy1342
cf23d338f3
Merge branch 'main' into experimental-strong-params
2022-07-19 10:29:36 -04:00
thiggy1342
6bc2fe513d
Merge branch 'main' into add-activerecord-annotate
2022-07-19 10:29:24 -04:00
thiggy1342
304203ad2f
fix path problem output
2022-07-19 00:25:50 +00:00
Harry Maclean
7b8603c89b
Ruby: Model Arel.sql
2022-07-19 11:27:15 +12:00
thiggy1342
fc00e56058
Merge branch 'main' into experimental-manually-check-request-verb
2022-07-18 10:58:13 -04:00
Nick Rolfe
eebba36b18
Merge pull request #9708 from github/nickrolfe/pathname
...
Ruby: model the standard library's `Pathname` class
2022-07-18 11:29:30 +01:00
thiggy1342
2cc703387b
use taint config for data flow
2022-07-14 00:11:52 +00:00
Harry Maclean
1fa2144716
Ruby: Update test fixtures
2022-07-13 21:02:08 +12:00
Harry Maclean
ea95e2e1d0
Ruby: Use InclusionTests library in barrier guards
2022-07-13 18:20:27 +12:00
Harry Maclean
b9fc82a741
Ruby: Test both old and new-style barrier guards
2022-07-13 18:20:25 +12:00
Harry Maclean
5f17d8370c
Ruby: Small change to isArrayExpr
2022-07-13 18:20:14 +12:00
