Alex Ford
edf8a3f810
Ruby: update test output
2022-03-10 00:17:29 +00:00
Alex Ford
8abee165a5
Ruby: test cases for PersistentWriteAccess in rails model class
2022-03-09 22:35:40 +00:00
Alex Ford
ee433637f8
Ruby: replace OrmWriteAccess with PersistentWriteAccess concept
2022-03-09 18:59:16 +00:00
Taus
7b877fb317
Merge pull request #8336 from tausbn/python-fix-a-bunch-of-ql-warnings
...
Python: Fix a bunch of QL warnings
2022-03-09 16:31:28 +01:00
Tom Hvitved
1e1b2e284d
Ruby: Cleanup flow through self
2022-03-09 13:17:11 +01:00
Tom Hvitved
f5fbf50d7d
Ruby: Fix incorrect parsing of ranges
2022-03-08 19:53:17 +01:00
Tom Hvitved
89c3d0535a
Ruby: Add regex test that outputs all RegExpTerms
2022-03-08 19:53:17 +01:00
Tom Hvitved
5f48cc06bb
Ruby: Fix off-by-one error in getGroupName
2022-03-08 15:59:47 +01:00
Tom Hvitved
6dd126b6e3
Ruby: Add regex group tests
2022-03-08 15:59:28 +01:00
Taus
063a8bbc43
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-08 15:20:35 +01:00
Tom Hvitved
6d4eecff14
Ruby: Fix regex parsing of /[|]/
2022-03-08 09:52:06 +01:00
Tom Hvitved
a7442b7a2b
Ruby: Add regex test case for /[|]/
2022-03-08 09:51:39 +01:00
Taus
af7f532212
Python: Fix up a bunch of function QLDoc
2022-03-07 18:59:49 +00:00
Arthur Baars
a1873cc803
Ruby: IncompleteUrlSubstringSanitization.ql
2022-03-07 16:17:32 +01:00
Arthur Baars
c9fa1fb5bb
Ruby: copy JS version of IncompleteUrlSubstringSanitization.ql
2022-03-07 16:17:08 +01:00
Arthur Baars
097c661362
Ruby: drop results that cannot be found yet from IncompleteHostnameRegExp.expected
2022-03-07 16:10:08 +01:00
Arthur Baars
9e8930c192
Ruby: IncompleteHostnameRegExp.ql
2022-03-07 16:10:08 +01:00
Arthur Baars
832c9c4b0b
Ruby: copy IncompleteHostnameRegExp files from JavaScript
2022-03-07 16:10:07 +01:00
Arthur Baars
200a965fda
Update expected output
2022-03-07 11:51:54 +01:00
Tom Hvitved
9c4c35141a
Ruby: Update type tracker test
2022-03-07 11:51:54 +01:00
Alex Ford
8fed9f9aa0
Ruby: ActiveRecord - match OrmWriteAccesses for assignements to the assignment node rather than the setter call
2022-03-04 17:24:24 +00:00
Harry Maclean
1181779c10
Merge pull request #7920 from github/hmac/string-flow-summaries
...
Ruby: Add String flow summaries
2022-03-04 09:09:19 +13:00
Harry Maclean
37dac186a8
Ruby: String.try_convert isn't value-preserving
...
`String.try_convert` can convert arbitrary objects to strings, which
obviously isn't value-preserving.
2022-03-02 13:31:59 +13:00
Asger Feldthaus
df379809df
Ruby: support CSV rows of form ;any;Method[foo]
2022-03-01 14:08:21 +01:00
Asger Feldthaus
05ea33033b
Ruby: add test for API::EntryPoint
2022-03-01 14:08:21 +01:00
Asger Feldthaus
e6a3747656
Ruby: add test for ActiveStorage.Filename.new
2022-03-01 14:08:21 +01:00
Asger Feldthaus
cbd044a768
Ruby: add a code injection test for flwo through Regexp.escape
2022-03-01 14:08:21 +01:00
Asger Feldthaus
63e7c16d6b
Ruby: add test with sinks and type-defs
2022-03-01 14:08:20 +01:00
Asger Feldthaus
388949f12e
Ruby: support WithBlock and WithoutBlock
2022-03-01 14:08:20 +01:00
Asger Feldthaus
d6bc9c259e
Ruby: add simple test case
2022-03-01 14:08:20 +01:00
Arthur Baars
b2745d44f2
Ruby: update ReDoS.expected
2022-03-01 13:30:56 +01:00
Arthur Baars
5ce6b847d1
Merge pull request #8166 from aibaars/regex-char-sequence-1
...
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-28 17:47:53 +01:00
Alex Ford
b1fd321b65
Ruby: update Rails framework test output for existing tests
2022-02-28 01:13:26 +00:00
Alex Ford
283a48c76d
Ruby: tests for OrmWriteAccess
2022-02-28 01:12:49 +00:00
Harry Maclean
fc351fbd64
Ruby: Remove value-flow for name-matched summaries
...
String summaries that are identified by name only should not specify
value-preserving flow as this can cause spurious flow in cases where
they are applied to different but identically-named methods.
2022-02-24 16:15:15 +13:00
Arthur Baars
69ed121ecb
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-22 16:15:33 +01:00
Harry Maclean
07c70adde5
Ruby: Update CleartextLogging fixture
...
The flow summary for `String#sub` leads to two new results in this test.
They are duplicates of existing results, because the query is quite
liberal in what it considers a source.
```ruby
password = "abc"
password_masked = password.sub(/./, "x")
Logger.new(STDOUT).info password_masked
```
In the example above, the query considers lines 1 and 2 to both be
sources, with a sink at line 3. Previously there was no flow from line 1
to line 3 because of the missing flow summary for `String#sub`, and
therefore there was just one result. Now we have the flow summary, there
are two results.
Line 2 is considered a source because it is an assignment to a variable
that contains the term "password". I'm not sure how to adjust the query
to avoid these duplicates, so I'm leaving them in for now.
2022-02-22 16:58:41 +13:00
Harry Maclean
d180a55b3a
Ruby: Fix value/taint flow in String summaries
2022-02-22 16:41:16 +13:00
Harry Maclean
f07ae35b87
Ruby: Fix bug with String flow summaries
...
Split summaries for methods with optional block parmaters into separate
classes. Also model the `exclusive` argument to `String#upto`.
2022-02-22 16:41:16 +13:00
Harry Maclean
379de5581d
Ruby: Disable summaries that clash with Array
...
Some String methods are named identically to Array methods, and this
leads to overlapping flow summaries. These adversely affect the original
Array flow summaries.
2022-02-22 16:41:15 +13:00
Harry Maclean
fef46e1ee4
Ruby: Add flow summaries for String methods
2022-02-22 16:41:15 +13:00
Asger F
02c4966109
Merge pull request #7878 from asgerf/dot-separated-access-paths
...
Shared: Switch to dot-separated access paths in summary specs
2022-02-21 13:29:09 +01:00
Alex Ford
9196b64d6e
Merge pull request #8138 from github/ruby/file-write
...
Ruby: Implement `FileSystemWriteAccess` concept
2022-02-21 10:13:27 +00:00
Alex Ford
746290d903
Merge pull request #7713 from github/ruby/clear-text-logging
...
Ruby: Add `rb/clear-text-logging-sensitive-data` query
2022-02-21 10:12:33 +00:00
Asger Feldthaus
e3605eed44
Ruby: update CSV rows to dot-separated syntax
2022-02-21 08:21:50 +01:00
Asger Feldthaus
6dbeb81f36
Ruby: use AccessPathSyntax.qll to parse input/output summary specs
2022-02-21 08:16:55 +01:00
Harry Maclean
9a60c7e4ac
Ruby: Update filename in test fixture
2022-02-21 09:43:36 +13:00
Alex Ford
baabe66551
Ruby: update Files.ql tests for write accesses
2022-02-20 19:28:12 +00:00
Alex Ford
dd383f942f
Merge remote-tracking branch 'origin/main' into ruby/clear-text-logging
2022-02-17 15:32:31 +00:00
Harry Maclean
459f949c24
Ruby: fix old import in ActiveSupport
...
codeql.ruby.frameworks.StandardLibrary is deprecated
2022-02-17 20:44:04 +13:00
