thiggy1342
b078430faf
add Zip::File.new query to tests
2022-06-16 00:51:50 +00:00
thiggy1342
e317392336
add Zip::File.new to framework
2022-06-16 00:22:15 +00:00
thiggy1342
1bdaf529d9
fix qlformat errors
2022-06-15 01:49:48 +00:00
thiggy1342
df226ee610
remove standalone archive api query
2022-06-15 01:39:47 +00:00
thiggy1342
0832e299f2
move archive api path traversal tests to cwe-022
2022-06-15 01:39:47 +00:00
thiggy1342
a0f1c86031
add framework test
2022-06-15 01:39:47 +00:00
thiggy1342
af6fbd439c
Merge branch 'main' into experimental-archive-api
2022-06-14 20:09:02 -04:00
Alex Ford
8d195e3188
Merge pull request #9157 from alexrford/crypto-op-block-mode
...
Ruby/Python: Add a `BlockMode` concept for `CryptographicOperations`
2022-06-13 21:32:36 +02:00
thiggy1342
c7e67eb2e2
expand test coverage for sanitizers
2022-06-10 21:30:41 +00:00
thiggy1342
074583eab8
add archive api file open query and test
2022-06-06 21:09:57 +00:00
Alex Ford
5d4473bb2a
Merge pull request #8845 from alexrford/ruby/rbi-lib
...
Ruby: Add partial support for working with RBI (Ruby Interface) files
2022-05-27 11:43:44 +01:00
Alex Ford
919555d168
Merge pull request #9341 from alexrford/ruby/activerecordinstance-public
...
Ruby: Make `ActiveRecordInstance` public and fix some misidentifications
2022-05-27 11:21:58 +01:00
Arthur Baars
e3ef258b0e
Merge pull request #9287 from aibaars/instance-variable-flow-2
...
Ruby: flow through getters/setters
2022-05-27 10:49:20 +02:00
Alex Ford
4e0e4f9b5b
Ruby: make ActiveRecordInstance public
2022-05-26 17:54:02 +01:00
Alex Ford
fd8f1dc88f
Ruby: fix some misidentification of ActiveRecordModelInstantiations
2022-05-26 17:54:01 +01:00
Tom Hvitved
b3ce2d4a2b
Ruby: Data flow for hash-splat expressions in hash literals
2022-05-25 19:55:28 +02:00
Arthur Baars
033df767ef
Ruby: allow fields in flow summaries
2022-05-25 16:01:04 +02:00
Arthur Baars
b0a97f9b01
Ruby: flow through getters/setters
2022-05-25 16:01:04 +02:00
Tom Hvitved
ce4959287a
Ruby: Flow through hash-splat expressions
2022-05-25 15:40:08 +02:00
Tom Hvitved
a7b39ebeca
Ruby: Flow through hash-splat parameters
2022-05-25 12:37:22 +02:00
Tom Hvitved
faf24a4f18
Ruby: Data-flow through hashes
2022-05-24 14:27:55 +02:00
Arthur Baars
cf2eb0d3a1
Merge branch 'main' into instance-variable-flow
2022-05-23 18:48:51 +02:00
Arthur Baars
7ed60b19a2
Ruby: improve test case
2022-05-23 11:59:12 +02:00
Arthur Baars
29ea1b2f24
Ruby: rename getSelfVariableAccess to getReceiver
2022-05-23 11:30:29 +02:00
Arthur Baars
68aeb2ba85
Update test output
2022-05-20 16:30:58 +02:00
Arthur Baars
d9c2b78aa2
Ruby: flow through instance variables
2022-05-20 16:30:58 +02:00
Tom Hvitved
a18aef23f9
Data flow: Do not discard call context when computing reverse lambda flow through jumps
2022-05-19 15:19:41 +02:00
Tom Hvitved
ea703bc49a
Ruby: Add test that illustrates false negative lambda flow
2022-05-19 15:19:34 +02:00
Alex Ford
c620fceb82
Ruby: remove unnecessary line from test
2022-05-17 14:57:11 +01:00
Alex Ford
6b496c78ef
Ruby: failing crypto op test
2022-05-17 14:57:11 +01:00
Nick Rolfe
c518150b49
Merge pull request #9132 from github/nickrolfe/misspelling
...
QL for QL: generalise non-US spelling query
2022-05-16 16:03:36 +01:00
Alex Ford
0cc0494586
codeql format
2022-05-16 15:54:31 +01:00
Tom Hvitved
a9f6d203cd
Merge pull request #8971 from aibaars/safe-nagivation
...
Ruby: add safe navigation operator
2022-05-16 10:53:56 +02:00
Alex Ford
03e34e071a
ruby: inline expectations tests for CryptographicOperation concept
2022-05-13 16:32:36 +01:00
Alex Ford
4752c45fe5
ruby: update rb/weak-cryptographic-algorithm to specify the block mode if appropriate
2022-05-13 16:32:30 +01:00
Nick Rolfe
8caad12011
Ruby: fix typos in comments
2022-05-12 16:02:20 +01:00
Tom Hvitved
0a7892797e
Merge pull request #8938 from hvitved/ruby/with-without-mad-tokens
...
Ruby: Introduce `With(out)Element` MaD input tokens
2022-05-12 11:49:51 +02:00
Harry Maclean
e8972b814f
Merge pull request #8635 from hmac/hmac/io-popen
...
Ruby: Model IO.popen
2022-05-12 21:17:55 +12:00
Alex Ford
196c68b0bd
Merge remote-tracking branch 'origin/main' into ruby/rbi-lib
2022-05-11 16:31:39 +01:00
Tom Hvitved
884d3b2ff4
Ruby: Introduce With(out)Element MaD input tokens
2022-05-11 15:17:27 +02:00
Arthur Baars
e1e13b599a
Fix CFG
2022-05-11 12:09:17 +02:00
Arthur Baars
dbd9c1859d
Add more test cases for &. operator
2022-05-11 12:06:08 +02:00
Arthur Baars
76f806159c
Ruby: desugar safe navigation calls
2022-05-11 12:06:08 +02:00
Arthur Baars
c9f7568ca3
Ruby: add Call::isSafeNavigation
2022-05-11 12:06:08 +02:00
Arthur Baars
a47e429945
Merge pull request #8909 from aibaars/tree-sitter-update
...
Tree sitter update
2022-05-11 12:02:14 +02:00
Arthur Baars
907c3db5ca
Address comments
...
Co-authored-by: Nick Rolfe <nickrolfe@github.com >
2022-05-11 09:59:42 +02:00
Harry Maclean
7b63493fa9
Ruby: Fix identification IO.open args
2022-05-10 17:32:00 +12:00
Harry Maclean
79c6dc1af0
Refactor IO/File modelling
...
The main goal here is to get rid of the duplicate definitions of module
`IO`, which currently exist in both `frameworks/core/IO.qll` and
`frameworks/Files.qll`.
We do this by moving the classes inside `Files::IO` to `core/IO.qll`,
but moving most of the actual definitions of those classes to an
internal module `core.internal.FileOrIO`. This means both `Files.qll`
and `IO.qll` can depend on them without leaking them to end users.
2022-05-10 17:32:00 +12:00
Harry Maclean
2d12ad6238
Ruby: Model IO.popen
...
This method is very similar to `Kernel.system`: it executes its
arguments as a system command in various ways.
2022-05-10 17:32:00 +12:00
Alex Ford
4844e4f454
ruby: replace the dataflow layer RBI library with the AST layer version
2022-05-05 18:40:12 +01:00
