Harry Maclean
63dcce9a31
Ruby: Refactor isArrayConstant
2022-07-13 18:20:14 +12:00
Harry Maclean
301914d80c
Ruby: Add an extra barrier guard test
2022-07-13 18:20:14 +12:00
Harry Maclean
706d1d2eee
Ruby: Make StringArrayInclusion more sensitive
...
We now recognise the following pattern as a barrier guard for `x`:
values = ["foo", "bar"]
if values.include? x
sink x
end
2022-07-13 18:20:12 +12:00
thiggy1342
7129002573
tweak tests more
2022-07-13 00:33:58 +00:00
thiggy1342
b3f1a513d1
Update tests
2022-07-13 00:25:43 +00:00
thiggy1342
9a0a9491da
Merge branch 'main' into add-activerecord-annotate
2022-07-12 20:13:56 -04:00
thiggy1342
2566ae9889
Merge branch 'main' into experimental-strong-params
2022-07-12 20:12:51 -04:00
thiggy1342
db5f63b208
add tests
2022-07-12 23:14:16 +00:00
thiggy1342
74d6061082
Merge branch 'main' into experimental-manually-check-request-verb
2022-07-12 17:15:54 -04:00
Erik Krogh Kristensen
ff25451699
rename query to overly-large-range, and rewrite the @description
2022-07-12 16:02:46 +02:00
Nick Rolfe
6632dfaf88
Ruby: fix another SystemCommandExecution::isShellInterpreted implementation
2022-07-11 16:53:30 +01:00
thiggy1342
ad7c3e7217
Merge branch 'main' into experimental-manually-check-request-verb
2022-07-11 10:20:07 -04:00
Nick Rolfe
348ad95fc0
Ruby: fix defining every dataflow node as a command execution sink
2022-07-11 15:06:27 +01:00
thiggy1342
e8e8da1b31
fix lib test expect for ActionController
2022-07-08 19:01:01 +00:00
thiggy1342
5d3232c614
refactor to use data flow
2022-07-08 18:53:24 +00:00
thiggy1342
96e66c4a50
move tests
2022-07-08 18:39:04 +00:00
thiggy1342
0435105d16
Merge remote-tracking branch 'upstream/main' into experimental-strong-params
2022-07-08 18:36:09 +00:00
thiggy1342
6aab970a9e
refactor query to use cfg and dataflow
2022-07-08 18:32:54 +00:00
thiggy1342
940254d251
update framework tests
2022-07-07 19:39:59 +00:00
thiggy1342
b4869158f2
expand query tests for cwe-089
2022-07-07 19:23:57 +00:00
thiggy1342
2f1cfa816f
Add annotate arguments as sqli sink
2022-07-07 19:23:06 +00:00
Nick Rolfe
02dd933e5f
Ruby: move Pathname from core to stdlib
2022-06-30 10:08:25 +01:00
Nick Rolfe
c1302a90e0
Ruby: use MaD for more precise Pathname flow summaries
2022-06-29 13:16:18 +01:00
Erik Krogh Kristensen
2e295e4a04
filter out potential misparses from rb/suspicious-regexp-range
2022-06-29 13:16:28 +02:00
Erik Krogh Kristensen
a343ceaf8b
add suspicious-regexp-range query
2022-06-28 09:49:27 +02:00
Nick Rolfe
280c959dc8
Merge branch 'main' into nickrolfe/pathname
2022-06-27 11:11:17 +01:00
Harry Maclean
101111bd2f
Merge pull request #9574 from hmac/hmac/action-cable-logger
...
Ruby: More Rails modeling
2022-06-27 19:56:54 +12:00
Asger F
d6fd43fe12
Merge pull request #9364 from asgerf/ruby/api-graph-api
...
Ruby: API graph renaming an documentation
2022-06-27 08:54:24 +02:00
Nick Rolfe
c1515db09c
Ruby: modeling of some file-related concepts for the Pathname class
2022-06-24 14:14:07 +01:00
Nick Rolfe
03d0f66247
Ruby: add flow summaries for Pathname class
2022-06-24 14:14:06 +01:00
thiggy1342
cf36333082
forgot to finish this test
2022-06-24 02:18:48 +00:00
Erik Krogh Kristensen
7fb3d81d2f
add further normalization of char classses
2022-06-23 14:36:25 +02:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
thiggy1342
83b720d730
first draft of weak params query
2022-06-21 19:28:53 +00:00
Asger F
7c877c7861
Ruby: Rename getARhs -> asSink
2022-06-21 12:44:16 +02:00
Asger F
2f8086bb57
Ruby: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:16 +02:00
Anders Schack-Mulligen
736372ffd6
Ruby: Remove test.
2022-06-21 11:18:36 +02:00
thiggy1342
c5bf1b8aab
update test expectation
2022-06-20 17:27:33 +00:00
thiggy1342
973013ff9c
Merge branch 'main' into experimental-decompression-api
2022-06-20 11:37:38 -04:00
thiggy1342
7932d3e4ab
Update ruby/ql/test/query-tests/security/decompression-api/DecompressionApi.expected
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 11:05:56 -04:00
Arthur Baars
c5d3df087d
Update tree-sitter-embeded-template
2022-06-20 17:04:27 +02:00
thiggy1342
b4c893d857
Update ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 09:50:12 -04:00
thiggy1342
2f505c527b
Merge branch 'main' into experimental-decompression-api
2022-06-20 09:48:21 -04:00
Rasmus Wriedt Larsen
ae44a941f9
Merge pull request #9421 from RasmusWL/inline-brackets
...
Inline Expectation Tests: Allow `tag[foo bar]`
2022-06-20 10:01:19 +02:00
Harry Maclean
e1dcc207b4
Ruby: Model methods in Rails::Generators::Actions
...
These methods are sinks for command injection.
2022-06-20 13:36:09 +12:00
Harry Maclean
20ff4c4299
Ruby: Model ActiveRecord::Relation#touch_all
2022-06-20 13:36:02 +12:00
Harry Maclean
7dfab371f6
Ruby: Model redirect_back and redirect_back_or_to
...
These are ActionController methods that redirect to the HTTP Referer,
falling back to the given location if there is no Referer.
2022-06-20 13:36:02 +12:00
Harry Maclean
a298f5eb5e
Ruby: Recognise File.atomic_write as a file writer
...
This method is an ActiveSupport extension, but there's no harm in
recognising it universally as any identically-named method is likely to
also be a file writer.
2022-06-20 13:36:02 +12:00
Harry Maclean
0ce14fc4e5
Ruby: Recognise ActionCable logger class
2022-06-20 13:36:02 +12:00
thiggy1342
0456870136
Merge branch 'main' into experimental-manually-check-request-verb
2022-06-18 15:21:53 -04:00
