Harry Maclean
bf51cbad88
Ruby: Update test fixture
2023-09-14 09:26:38 +01:00
Tom Hvitved
e11a4b63e9
Ruby: Remove SynthSplatArgParameterNode
2023-09-14 09:26:38 +01:00
Harry Maclean
5a6a52b767
Ruby: Use fewer SynthSplatArgumentElementNodes
...
In cases such as
def f(x, *y); end
f(*[1, 2])
we don't need any `SynthSplatArgumentElementNodes`. We get flow from the
splat argument to a `SynthSplatParameterNode` via `parameterMatch`, then
from element 0 of the synth splat to the positional param `x` via a
read step.
We add a read step from element 1 to `SynthSplatParameterElementNode(1)`.
From there we get flow to element 0 of `*y` via an existing store step.
2023-09-14 09:26:38 +01:00
Harry Maclean
4c1beea465
Ruby: Address review comments
2023-09-14 09:26:33 +01:00
Harry Maclean
3c8683428b
Ruby: Model more splat flow (alternative approach)
2023-09-14 08:55:59 +01:00
Harry Maclean
9ccd8cd248
Ruby: Update documentation
2023-09-14 08:54:49 +01:00
Harry Maclean
ef63ea8399
Ruby: Update fixture
2023-09-14 08:54:48 +01:00
Harry Maclean
7ebd51163e
Ruby: Handle more splat arg flow
...
Allow flow from a splat argument to a positional parameter in cases
where there are positional arguments left of the splat. For example:
def foo(x, y, z); end
foo(1, *[2, 3])
2023-09-14 08:54:48 +01:00
Tom Hvitved
e258324960
Ruby: Allow for implicit array reads at all sinks during taint tracking
2023-09-14 09:40:05 +02:00
Anders Schack-Mulligen
f5a4b792bd
C++/Go/Python/Ruby/Swift: Add dummy localMustFlowStep.
2023-09-13 15:43:46 +02:00
Alex Ford
79c305c1a1
Merge pull request #14124 from alexrford/rb/dataflow-query-refactor
...
Ruby: Use the new dataflow API for checked in queries
2023-09-13 14:24:47 +01:00
Tom Hvitved
f15cbb9316
Ruby: Simplify viableSourceCallableNonInit
2023-09-13 14:25:28 +02:00
Tom Hvitved
f3a78efe03
Ruby: Fix semantic merge conflict
2023-09-13 14:04:20 +02:00
Alex Ford
b5ec99cb2f
Ruby: fix missing qldoc
2023-09-13 12:28:19 +01:00
Tom Hvitved
7400b4741e
Merge pull request #14108 from hvitved/dataflow/more-consistency-checks
...
Data flow: Add `ArgumentNode` consistency checks
2023-09-13 11:30:51 +02:00
Tom Hvitved
88d2e2590f
Ruby: Rename LambdaSelfParameterNode to LambdaSelfReferenceNode
2023-09-13 08:52:22 +02:00
Tom Hvitved
b470c36c82
Ruby: Implement multipleArgumentCallExclude
2023-09-12 20:05:11 +02:00
Tom Hvitved
c13a8e41ad
Data flow: Add more consistency checks
2023-09-12 20:05:05 +02:00
github-actions[bot]
d699880c86
Post-release preparation for codeql-cli-2.14.4
2023-09-08 21:17:52 +00:00
amammad
d44c9d3e74
stash
2023-09-08 05:51:21 +10:00
Alex Ford
5b013dd5d2
Merge branch 'main' into rb/dataflow-query-refactor
2023-09-07 14:57:38 +01:00
Alex Ford
947fa0de62
Ruby: fix qldoc warnings
2023-09-07 14:57:04 +01:00
Alex Ford
4a01de13ef
Ruby: avoid toString in query warning
2023-09-07 14:54:50 +01:00
Alex Ford
0aee7f6ac6
Ruby: qlformat
2023-09-07 14:47:02 +01:00
Alex Ford
13300a2e2f
Ruby: un-private PathGraph imports
2023-09-07 14:24:46 +01:00
Alex Ford
a893911dba
Ruby: Use a newtype instead of DataFlow::FlowState for insecure-download
2023-09-07 14:22:18 +01:00
Alex Ford
75fdde543f
Ruby: Use a newtype instead of DataFlow::FlowState for hardcoded-data
2023-09-07 14:13:26 +01:00
Alex Ford
0d7d5a35c9
Ruby: Use a newtype instead of DataFlow::FlowState for code-injection
2023-09-07 13:39:10 +01:00
Alex Ford
dfc3b33910
Ruby: Use a newtype instead of DataFlow::FlowState for unicode-bypass-validation
2023-09-07 12:09:47 +01:00
amammad
4191b07b1f
Merge branch 'github:main' into amammad-ruby-bombs
2023-09-06 20:17:49 +10:00
Tom Hvitved
a06a9ffa29
Address review comments
2023-09-06 11:01:54 +02:00
Tom Hvitved
6de315d086
Add change note
2023-09-06 11:01:54 +02:00
Tom Hvitved
48e2dcfa35
Ruby: Reimplement flow through captured variables using field flow
2023-09-06 11:00:55 +02:00
Tom Hvitved
5d1c399371
Ruby: Add more data-flow tests for captured variables
2023-09-06 10:34:34 +02:00
github-actions[bot]
abf2b12b1c
Release preparation for version 2.14.4
2023-09-05 16:56:14 +00:00
Tom Hvitved
a2912cd72b
Ruby: Use proper PathGraph module in inline flow tests
...
Gets rid of
```
PathNode is incompatible with PathNode (the type of the edge relation).
```
warnings.
2023-09-04 20:27:34 +02:00
Tom Hvitved
4a1163b38c
Merge pull request #14109 from hvitved/ruby/hide-desugared-assignments-in-dataflow
2023-09-04 19:59:33 +02:00
Alex Ford
11e5565344
Merge branch 'main' into add-cwe-208
2023-09-04 12:45:49 +01:00
Alex Ford
98851736d6
Revert "Ruby: configsig rb/tainted-format-string"
...
This reverts commit f5860cb4818dc3c07eeb6731e75bf5df203dd48f.
2023-09-03 17:20:06 +01:00
Alex Ford
bf6837cca0
Revert "Ruby: configsig rb/http-to-file-access"
...
This reverts commit e77ba1589663905c952cdb643ab66885760b27bd.
2023-09-03 17:20:06 +01:00
Alex Ford
e399eac2b3
Ruby: changenote for using new dataflow api
2023-09-03 17:20:06 +01:00
Alex Ford
73ed5696f3
Ruby: configsig rb/xxe
2023-09-03 17:20:06 +01:00
Alex Ford
956207b7d9
Ruby: configsig rb/meta/tainted-nodes
2023-09-03 17:20:06 +01:00
Alex Ford
f24102e0e7
Ruby: configsig rb/weak-params
2023-09-03 17:20:06 +01:00
Alex Ford
6c06def5d7
Ruby: configsig rb/manually-checking-http-verb
2023-09-03 17:20:06 +01:00
Alex Ford
39af2d2870
Ruby: configsig rb/user-controlled-file-decompression
2023-09-03 17:20:06 +01:00
Alex Ford
cdc788b162
Ruby: configsig rb/hardcoded-credentials
2023-09-03 17:20:06 +01:00
Alex Ford
4d1684e37b
Ruby: configsig rb/overly-permissive-file
2023-09-03 17:20:06 +01:00
Alex Ford
b6d12f8b1c
Ruby: configsig rb/zip-slip
2023-09-03 17:20:05 +01:00
Alex Ford
ebf2a2e1f5
Ruby: configsig rb/unicode-bypass-validation
2023-09-03 17:20:05 +01:00
