Harry Maclean
ab7fd89653
Merge pull request #7663 from github/hmac/api-graph-subclass
...
Ruby: Add basic subclassing support to API Graphs
2022-02-04 10:19:07 +13:00
Harry Maclean
fb00a6c61b
Merge pull request #7666 from github/hmac/file-open-access
...
Ruby: Add File.open as a FileSystemAccess
2022-02-02 07:32:16 +13:00
Harry Maclean
5e7a29a979
Ruby: Use API graph subclassing in Rails modelling
...
Now that API graphs have basic subclassing support, we can simplify some
of the ActiveRecord and ActionController code.
2022-01-25 16:40:14 +13:00
Harry Maclean
8e40899dfd
Merge pull request #7419 from github/hmac/const-get
2022-01-22 07:01:09 +13:00
Harry Maclean
5dcee6ba27
Ruby: Add File.open as a FileSystemAccess
2022-01-20 21:09:41 +13:00
Jeff Gran
47697f59c1
Ruby: Add classes for detecting user input from graphql-ruby
2022-01-18 09:13:58 -07:00
Harry Maclean
43ddc54f2b
Ruby: Add Module#const_get as a code execution
...
Module#const_get takes a single string argument and interprets it as the
name of a constant. It then looks up the constant and returns its value.
Object.const_get("Math::PI")
# => 3.141592653589793
By itself, this method is not as dangerous as e.g. eval, but if the
value returned is a class that is then instantiated, this can allow an
attacker to instantiate arbitrary Ruby classes.
As a result, I think it's safe to say that any remote input flowing into
this call is a potential vulnerability. A real-world example of this is
https://github.com/advisories/GHSA-52p9-v744-mwjj .
2022-01-06 13:03:41 +13:00
Alex Ford
5fa6ecc5f1
Ruby: Model what is written to the log from stdlib Logger methods
2021-12-14 17:39:12 +00:00
Harry Maclean
e1d290d4c0
Ruby: Don't count private methods as Rails actions
...
Private instance methods on ActionController classes aren't valid
request handlers. Routing to them will raise an exception.
2021-12-13 15:36:55 +13:00
Nick Rolfe
d46564caa6
Ruby: treat ActionController#cookies as a remote flow source
2021-12-09 12:13:17 +00:00
Nick Rolfe
f6a8b9a7e5
Ruby: add cookies call to frameworks test
2021-12-09 12:07:04 +00:00
Alex Ford
6adfea2365
Merge pull request #7163 from github/ruby/file-reader-extend
...
Ruby: Extend `FileSystemReadAccess` to include more potential sources of input from the filesystem
2021-12-05 23:32:43 +00:00
Harry Maclean
c297a68acf
Model more of the RestClient API
...
We now handle this form:
RestClient::Request.execute(url: "http://example.com ")
2021-11-19 11:28:09 +00:00
Harry Maclean
38ff584307
Model more Faraday behaviour
...
You can instantiate a Faraday connection by passing a URL as an keyword
argument:
conn = Faraday.new(url: "http://example.com ")
2021-11-19 11:28:09 +00:00
Harry Maclean
b6ce37b241
Add getURL to HTTP::Client::Request
...
This member predicate gets dataflow nodes which contribute to the URL of
the request.
Also consolidate the identical tests for each HTTP client.
2021-11-19 11:28:08 +00:00
Alex Ford
12a3251649
Ruby: extend FileSystemReadAccess and restructure some Files.qll classes
2021-11-17 23:01:18 +00:00
Arthur Baars
976daddd36
Move files to ruby subfolder
2021-10-15 11:47:28 +02:00
