Jeroen Ketema
c53e529bac
Ruby: Update remaining inline expectation tests to use the paramterized module
2023-06-20 10:16:01 +02:00
Asger F
8539db07c4
Ruby: Update ActiveDispatch due to change in toString
2023-06-19 12:16:07 +02:00
Asger F
f392af220b
Ruby: benign changes to SQLi tests (fixed FNs)
2023-06-19 12:15:57 +02:00
Asger F
ce0073b30c
Ruby: update StoredXSS test results
...
These results were previously flagged for the wrong reason.
Calls to a user-define method were seen as ORM calls. The real source is inside the user-defined method, but we miss that due to lack of 'self' handling in ORM tracking.
2023-06-19 12:15:57 +02:00
Asger F
e3a04499f6
Ruby: minor overhaul of ActiveResource model
2023-06-19 12:15:57 +02:00
Asger F
8bc4193ce0
Ruby: minor overhaul of ActiveRecord model
...
Old version had scalability issues when adding taking more interprocedural flow and inheritance into account.
2023-06-19 12:15:44 +02:00
Asger F
0110610c6a
Ruby: overhaul API graphs
2023-06-19 12:01:42 +02:00
Jeroen Ketema
6a84e6cbfd
Add the merged PathGraph to all copies of the InlineFlowTest library
2023-06-19 10:28:10 +02:00
Jeroen Ketema
d82c3ce11a
Ruby: Rewrite InlineFlowTest as a parameterized module
2023-06-15 10:52:23 +02:00
Anders Schack-Mulligen
1a4fca334f
Merge pull request #13273 from aschackmull/dataflow/summarynode-refactor
...
Dataflow: Refactor FlowSummaryImpl to synthesize nodes independently from DataFlow::Node.
2023-06-14 09:38:36 +02:00
Alex Ford
75ccbe58ee
Ruby: rack - use Mimetype rather than MimeType in predicate names for consistency with concepts
2023-06-13 12:44:29 +01:00
Alex Ford
977ceb89fd
Ruby: rack - remove PotentialResponseNode#getAStatusCode
2023-06-13 12:42:46 +01:00
Jeroen Ketema
c3ba206b6a
Merge pull request #13346 from jketema/inline-2
...
Update inline expectation tests to use parameterized module
2023-06-13 10:10:55 +02:00
Asger F
0d45074caa
Merge pull request #13422 from asgerf/rb/map_filter
...
Ruby: fix bug in filter_map summary
2023-06-13 09:43:47 +02:00
Arthur Baars
fad73d71e5
Merge pull request #13307 from hmac/amammad-ruby-YAMLunsafeLoad
...
Ruby: Add YAML unsafe deserialization sinks
2023-06-12 10:43:37 +02:00
Anders Schack-Mulligen
0c62901a67
Ruby: Fix tests.
2023-06-09 15:39:18 +02:00
Asger F
d47477bd3b
Ruby: update line numbers in expectation file
2023-06-09 14:52:21 +02:00
Asger F
a50d91ea48
Ruby: fix bug in filter_map summary
2023-06-09 14:31:10 +02:00
Jeroen Ketema
4485560f43
Ruby: Rewrite inline expectation tests to use parameterized module
2023-06-09 10:43:05 +02:00
Alex Ford
397a809426
Merge remote-tracking branch 'origin/main' into rb/rack-redirect
2023-06-08 12:07:57 +01:00
Alex Ford
22b9ab43c6
Merge pull request #13259 from alexrford/rb/actiondispatch-refactor
...
Ruby: Refactor and slightly expand `ActionDispatch` modelling
2023-06-08 11:08:36 +01:00
Tom Hvitved
cee70883f0
Merge pull request #12964 from hvitved/ruby/remove-synth-returns
...
Ruby: Remove canonical return nodes
2023-06-08 10:07:48 +02:00
Arthur Baars
7324d1705e
Merge branch 'main' into amammad-ruby-YAMLunsafeLoad
2023-06-06 12:09:06 +02:00
Alex Ford
c95cf5ad6f
Merge pull request #13062 from maikypedia/maikypedia/sqli-sink
...
Ruby: Add MySQL as SQL Injection Sink
2023-06-02 17:06:35 +01:00
Erik Krogh Kristensen
219ec9d05d
Merge pull request #13127 from erik-krogh/polReDoS
...
ReDoS: revert new superlinear algorithm.
2023-06-02 16:10:24 +02:00
Jeroen Ketema
5f64354a70
Merge pull request #13353 from jketema/expecation
...
Fix typo in spelling of expectation
2023-06-02 12:29:49 +02:00
Jeroen Ketema
7b17b92aca
Fix typo in spelling of expectation
2023-06-02 10:36:11 +02:00
Alex Ford
6fa9e13a2e
Ruby: update TaintStep output
2023-06-01 16:27:20 +01:00
Alex Ford
d09f6d318c
Merge branch 'main' into maikypedia/sqli-sink
2023-06-01 15:02:44 +01:00
Alex Ford
4905a70e21
Ruby: update rack test output
2023-06-01 14:01:40 +01:00
Alex Ford
a5a15f3804
Ruby: restructure rack model
2023-06-01 14:01:40 +01:00
Alex Ford
b2958f87b2
ruby: rack - add redirect responses
2023-06-01 14:01:40 +01:00
Alex Ford
c3ab867595
ruby: start restructuring rack
2023-06-01 14:01:40 +01:00
Alex Ford
f8d2cbbe79
ruby: rack responses implement are HTTP responses
2023-06-01 14:01:39 +01:00
Alex Ford
c87c266871
ruby: add Rack::ResponseNode#getAStatusCode
2023-06-01 14:01:39 +01:00
Alex Ford
7d943c7621
Ruby: update test output
2023-06-01 13:50:32 +01:00
Alex Ford
4794066d3c
Merge branch 'main' into maikypedia/sqli-sink-2
2023-06-01 13:04:54 +01:00
Maiky
62353122c0
Add Improper LDAP Authentication query (CWE-287)
2023-05-29 21:16:13 +02:00
Maiky
d45d046fa7
Add test file and .expected
2023-05-28 17:29:34 +02:00
Harry Maclean
b8c3cba4ff
Ruby: Consolidate unsafe deserialization queries
...
Merge the experimental YAMLUnsafeDeserialization and
PlistUnsafeDeserialization queries into the generate
UnsafeDeserialization query in the default suite.
These queries look for some specific sinks that we now find in the
general query.
Also apply some small code and comment refactors.
2023-05-27 01:20:04 +00:00
amammad
b9296d3df8
v2.1 fix file names
2023-05-27 01:14:36 +00:00
amammad
4360a56b45
v2 add plist.parse_xml as a dangerous sink and enhancements on documents
2023-05-27 01:14:36 +00:00
amammad
0521ffe175
v1.4 correct dirs uppercase issue
2023-05-27 01:14:36 +00:00
amammad
0e343e5a12
v1.3
2023-05-27 01:14:36 +00:00
amammad
486a5ac96f
v1
2023-05-27 01:14:36 +00:00
Arthur Baars
e0466900ad
Merge pull request #12992 from Sim4n6/ruby-UBV
...
[Ruby] Add Unicode Bypass Validation query, test and help file
2023-05-26 13:00:21 +02:00
Alex Ford
baabd2d1fa
Merge pull request #12832 from maikypedia/maikypedia/pg-sqli
...
Ruby: Add SQL Injection Sinks
2023-05-26 11:36:17 +01:00
Alex Ford
609319da20
ruby: update TaintStep.ql test output
2023-05-25 17:53:01 +01:00
Tom Hvitved
13ada1e6ad
Ruby: Remove canonical return nodes
2023-05-24 11:11:50 +02:00
Asger F
6d1a4451fb
Ruby: update a test expectation
2023-05-24 10:15:51 +02:00
