Harry Maclean
546bfcb8ea
Ruby: split tests to match stdlib changes
2022-02-17 20:44:04 +13:00
Erik Krogh Kristensen
25d64a7901
Merge pull request #7930 from erik-krogh/rbApiIpa
...
RB: convert the ruby ApiGraphs to use IPA labels
2022-02-11 14:35:39 +01:00
Harry Maclean
017183e7f3
Merge pull request #7919 from github/hmac/open-uri
...
Ruby: recognise additional form for OpenURI
2022-02-11 14:03:26 +13:00
Erik Krogh Kristensen
9739929795
convert the ruby ApiGraphs to use IPA labels
2022-02-10 17:54:19 +01:00
Alex Ford
7c1bd9a533
Ruby: add a test case for cleartext logging that uses NonCleartextPasswordFlow
2022-02-10 15:50:56 +00:00
Alex Ford
59ab384825
Ruby: rb/clear-text-logging-sensitive-data - match on CFG nodes rather than AST nodes
2022-02-10 15:50:56 +00:00
CodeQL CI
a57ee019c2
Merge pull request #7819 from asgerf/asgerf/ruby-def-nodes
...
Approved by hvitved
2022-02-10 12:37:34 +00:00
Harry Maclean
d966ca8466
Ruby: recognise additional form for OpenURI
2022-02-10 15:42:15 +13:00
Harry Maclean
f30222256f
Merge pull request #7061 from github/hmac/actiondispatch
...
Ruby: Rails route resolution
2022-02-10 09:46:36 +13:00
Tom Hvitved
0bd8411cb6
Ruby: Hide more SSA nodes from data-flow path explanations
2022-02-09 15:31:10 +01:00
Nick Rolfe
1eba8277ee
Merge pull request #7614 from github/nickrolfe/array_flow_summaries
...
Ruby: add more Array/Enumerable flow summaries
2022-02-09 09:57:59 +00:00
Harry Maclean
3206384884
Merge pull request #7824 from github/hmac/constantize
2022-02-09 08:30:21 +13:00
Asger Feldthaus
2b36703bfb
Ruby: add def= tags to API graph test
2022-02-08 10:20:25 +01:00
Arthur Baars
ac03fab986
Merge pull request #7753 from aibaars/ruby-3.1
...
Ruby 3.1 features
2022-02-06 21:06:16 +01:00
Nick Rolfe
45962f1cad
Ruby: make this unique for each method
...
Even when summaries are shared in a single class.
2022-02-04 17:03:55 +00:00
Nick Rolfe
7a9ddc28bf
Ruby: address some more feedback on array flow summaries
2022-02-04 16:33:27 +00:00
Nick Rolfe
ed00f2b0d2
Ruby: address some feedback on array flow summaries
2022-02-04 13:40:39 +00:00
Nick Rolfe
161d766ba9
Ruby: address review comments on array_flow.rb
2022-02-04 11:59:59 +00:00
Asger Feldthaus
87c62db781
Ruby: disable test line not currently working
2022-02-04 11:20:42 +01:00
Asger Feldthaus
5e350a0270
Ruby: Derive edge labels from {Argument,Parameter}Position
2022-02-04 11:20:42 +01:00
Asger Feldthaus
d2e381aa79
Ruby: more def-node tests
2022-02-04 11:20:41 +01:00
Asger Feldthaus
32e0f42969
Ruby: refactor Return(x) to Method(x).return
2022-02-04 11:20:39 +01:00
Asger Feldthaus
55b5f19b92
Ruby: Add def-nodes to API graphs
2022-02-04 11:06:35 +01:00
Asger Feldthaus
9c17a5ce99
Ruby: replace "instance" label with a call to new
2022-02-04 11:03:25 +01:00
Harry Maclean
ab7fd89653
Merge pull request #7663 from github/hmac/api-graph-subclass
...
Ruby: Add basic subclassing support to API Graphs
2022-02-04 10:19:07 +13:00
Arthur Baars
6525035f0a
Address comments
2022-02-03 13:47:03 +01:00
Harry Maclean
c65ca8ff86
Model calls to constantize as code executions
...
`constantize` is an ActiveSupport extension to `String` that attempts to
look up a constant with a name matching the receiver.
2022-02-03 15:22:07 +13:00
Harry Maclean
704b58519f
Ruby: Include subclasses in more API calls
...
Change the behaviour of `API::getInstance()` and `API::getReturn()` to
include results on subclasses of the current API node.
2022-02-03 11:35:59 +13:00
Harry Maclean
80835a5a19
Ruby: Don't expose abstract class
...
Make ActionDispatch::Route into a private class
ActionDispatch::RouteImpl, defining a new class Route which exposes the
necessary public API from RouteImpl.
Also rename getHTTPMethod to getHttpMethod.
2022-02-03 10:41:30 +13:00
Harry Maclean
a8a7c156d0
via - update tests
2022-02-03 10:40:23 +13:00
Arthur Baars
a22868ba27
Merge branch 'main' into ruby-3.1
2022-02-02 19:00:03 +01:00
Arthur Baars
fdcef6225b
Ruby: fix QL warnings
2022-02-02 13:29:09 +01:00
Harry Maclean
47823b5a9a
Handle via: :all in Rails routes
...
ActionDispatch modelling now understands that
match "/foo", to: "foo#bar", via: :all
is equivalent to
match "/foo",
to: "foo#bar",
via: [:get, :post, :put, :patch, :delete]
2022-02-02 16:26:20 +13:00
Harry Maclean
3786fbfc7d
Ruby: Rewrite ActionDispatch::underscore
...
This version is much shorter and hopefully performs a bit better.
2022-02-02 16:26:20 +13:00
Harry Maclean
fa28e55645
Add a test for ActionDispatch::underscore
...
This shows how the predicate behaves, as well as a case where it goes
wrong.
2022-02-02 16:26:20 +13:00
Harry Maclean
314683d5fb
Ruby: Improve UrlRedirect query using Rails routes
...
Handlers for non-GET requests aren't vulnerable to URL redirect attacks,
because browsers won't initiate non-GET requests when you click a link.
We can use Rails routing information, if present, to filter out any
handlers for non-GET requests.
2022-02-02 16:26:20 +13:00
Harry Maclean
870c6d7412
Ruby: Rails route resolution
...
Add `Route` classes which model Rails routing information, typically
defined in a `routes.rb` file. We extract only the most basic
information: HTTP method, path, controller and action. This is enough to
determine whether a given controller method is a route handler, and what
HTTP method it handles, which is useful for, among other things, the URL
redirect query.
2022-02-02 16:26:19 +13:00
Harry Maclean
fb00a6c61b
Merge pull request #7666 from github/hmac/file-open-access
...
Ruby: Add File.open as a FileSystemAccess
2022-02-02 07:32:16 +13:00
Nick Rolfe
990e07b986
Ruby/C#: add semmle.order attribute to edges in CFG tests
2022-01-31 20:08:24 +00:00
Arthur Baars
abf3ce6223
Ruby: expressions in pin operator ^
2022-01-28 19:47:31 +01:00
Arthur Baars
00fb4d3776
Ruby: Values in Hash literals and keyword arguments can be omitted
2022-01-28 19:47:31 +01:00
Arthur Baars
3e2ca61c01
Ruby: support anonymous block parameters/arguments
2022-01-28 19:47:31 +01:00
Arthur Baars
b9258e78ca
Ruby: non-local variables in variable reference pattern
2022-01-28 19:47:31 +01:00
Alex Ford
7ed447842f
Ruby: cleartext logging test output
2022-01-28 17:24:56 +00:00
Alex Ford
91ccd307e8
Ruby: Implement rb/clear-text-logging-sensitive-data
2022-01-28 17:24:56 +00:00
Nick Rolfe
8248a942ce
Ruby: enable taint checking for array-flow test
2022-01-28 11:33:59 +00:00
Nick Rolfe
693ff6a904
Ruby: add flow summaries for remaining Array methods
2022-01-28 11:33:59 +00:00
Nick Rolfe
030cfa36da
Ruby: add flow summaries for all remaining Enumerable methods
2022-01-28 11:33:59 +00:00
Harry Maclean
b01f81aab3
Use modified getAPath predicate for test
2022-01-28 19:45:52 +13:00
Nick Rolfe
6f06263d49
Ruby: add more properties for ordering nodes in graph tests
2022-01-27 13:57:43 +00:00
