Arthur Baars
06e91c1182
Merge pull request #322 from github/request-without-validation
...
rb/request-without-cert-validation
2021-10-12 20:19:11 +02:00
Nick Rolfe
ceef9762a7
Fix comment typo
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2021-10-12 17:45:34 +01:00
Arthur Baars
398ed4c0c9
Merge pull request #338 from github/aibaars/update-grammar
...
Update tree-sitter-ruby
2021-10-12 18:39:34 +02:00
Arthur Baars
8c9d3b88df
Update dbscheme stats
2021-10-12 17:48:59 +02:00
Arthur Baars
e44064cda7
Add forward parameter/arguments to AST
2021-10-12 17:31:31 +02:00
Nick Rolfe
ecc9f07c50
Merge pull request #311 from github/nickrolfe/oj
...
Consider Oj.load a sink for unsafe deserialization
2021-10-12 16:17:08 +01:00
Arthur Baars
2a7f3fbfaf
Add upgrade script
2021-10-12 11:36:10 +02:00
Nick Rolfe
8e14b6582d
Remove unused predicate
2021-10-11 18:15:41 +01:00
Arthur Baars
fac4df203a
Update tree-sitter-ruby
2021-10-11 12:53:16 +02:00
Nick Rolfe
f500e5b2d7
Use Expr::getValueText
2021-10-08 16:41:06 +01:00
Alex Ford
16ab4da812
Update ql/lib/codeql/ruby/security/XSS.qll
...
Co-authored-by: Harry Maclean <hmac@github.com >
2021-10-07 20:03:07 +01:00
Nick Rolfe
eafe22ef93
Merge remote-tracking branch 'origin/main' into nickrolfe/oj
2021-10-07 16:40:36 +01:00
Alex Ford
168e67dd6d
deduplicate string constantQualifiedName(ConstantWriteAccess) as string ConstantWriteAccess#getQualifiedName
2021-10-07 15:30:36 +01:00
Alex Ford
5b38e06765
Rename ActiveRecordModelClass#methodMayAccessField() as ActiveRecordModelClass#getAPotentialFieldAccessMethod()
2021-10-07 15:30:36 +01:00
Alex Ford
3bdc680434
Drop a comment that is no longer relevant
2021-10-07 15:30:36 +01:00
Alex Ford
8262247ed7
Minor simplification of finderMethodName predicate
2021-10-07 15:30:36 +01:00
Alex Ford
eb8c48d10f
Remove some unused predicates
2021-10-07 15:30:36 +01:00
Alex Ford
c9edbd98d5
Update ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
...
Co-authored-by: Harry Maclean <hmac@github.com >
2021-10-07 15:30:36 +01:00
Alex Ford
e4fe1d5c13
check for superclass method definitions in ActiveRecordModelClass#methodMayAccessField
2021-10-07 15:30:36 +01:00
Alex Ford
fb5cfcc9b0
OrmTracking goes through or expressions
2021-10-07 15:30:36 +01:00
Alex Ford
955080234b
partial support for rails layouts
2021-10-07 15:30:36 +01:00
Alex Ford
1929a95e89
format
2021-10-07 15:30:36 +01:00
Alex Ford
6065e29aba
Fix performance issues related to a x-product between ActiveRecordModelInstantiation and MethodCall
2021-10-07 15:30:36 +01:00
Alex Ford
43a49689d7
reorganize ActiveRecord field access heuristics
2021-10-07 15:30:36 +01:00
Alex Ford
b2434950d3
abstract away some ActiveRecord specific parts of XSS.qll
2021-10-07 15:30:36 +01:00
Alex Ford
6dc3ce335b
make rb/stored-xss track ActiveRecord db accesses
2021-10-07 15:30:36 +01:00
Alex Ford
f6dd6bb00c
expand ActiveRecord modelling to cover how to access fields
2021-10-07 15:30:36 +01:00
Alex Ford
eb5f26ce06
duplicate DataFlow implementation
2021-10-07 15:30:36 +01:00
Alex Ford
a2084f813e
rb/stored-xss structure and initial implementation (FileSystemReadAccess sources)
2021-10-07 15:30:36 +01:00
Tom Hvitved
1c08592637
Merge pull request #329 from github/hvitved/dataflow/synth-return
...
Data flow: Add a synthetic return node
2021-10-07 13:06:39 +02:00
Nick Rolfe
ffda527da9
Tidy up
2021-10-06 18:07:29 +01:00
Tom Hvitved
953821c443
Avoid potential tuple explosion in reverse type tracking
2021-10-06 15:21:43 +02:00
Tom Hvitved
fdf1cd38fd
Data flow: Add a synthetic return node
2021-10-06 15:21:43 +02:00
Nick Rolfe
1ce458fa33
Add query to find HTTP requests that disable SSL validation
2021-10-06 14:06:09 +01:00
Harry Maclean
c50a6c180f
Merge pull request #318 from github/hmac-open-query
...
Add a query for uses of `Kernel.open` and `IO.read`
2021-10-06 10:05:43 +01:00
Tom Hvitved
1d1215923c
Merge pull request #323 from github/hvitved/get-value-text
...
Introduce `Expr::getValueText`
2021-10-05 14:26:25 +02:00
Harry Maclean
7bf818fdf5
Refactor KernelMethodCall modelling
...
By extending `DataFlow::CallNode` instead of `MethodCall`, we get rid of
a lot of `.asExpr().getExpr()` calls.
2021-10-05 12:26:59 +01:00
Harry Maclean
e419fc9599
Make Code execution query more specific
...
Only the first argument to eval, instance_eval, send, class_send and
module_send is interpreted as Ruby code.
2021-10-05 10:28:34 +01:00
Arthur Baars
2f462771bb
Merge pull request #286 from github/aibaars/xxe
...
XXE query
2021-10-01 16:14:41 +02:00
Arthur Baars
5a454bb9f2
Add comment
2021-10-01 12:13:19 +02:00
Arthur Baars
c78d02d00d
Fix module of Parser::Options
2021-10-01 11:18:03 +02:00
Tom Hvitved
08225181c8
Introduce Expr::getValueText
2021-10-01 11:03:46 +02:00
Harry Maclean
8c0c08e887
Identify more instance of code injection
...
`class_eval` and `module_eval` both take a string as argument and
execute it as Ruby code.
2021-09-30 14:19:24 +01:00
Harry Maclean
7f103b9450
Merge pull request #319 from github/hmac-activerecord-updates
...
Add some more vulnerable ActiveRecord methods
2021-09-30 12:09:09 +01:00
Arthur Baars
0419d28ba0
XXE: overapproximate feature flag values for & and | operators
2021-09-30 11:20:23 +02:00
Arthur Baars
089f9d87d4
Address comments
2021-09-30 11:20:23 +02:00
Arthur Baars
2b077595ae
Also track DTDLOAD and NONET
2021-09-30 11:20:23 +02:00
Arthur Baars
4268d9c565
XXE query
2021-09-30 11:20:17 +02:00
Harry Maclean
7191e1c007
Re-add delete_all and destroy_all methods
...
These methods don't take any arguments in Rails versions > 3, but
there's no harm in checking for them anyway, and some people might be
using very old Rails versions.
2021-09-30 09:39:58 +01:00
Harry Maclean
0ea228e86f
Merge pull request #315 from github/hmac-outgoing-http
...
Model more HTTP clients
2021-09-29 14:26:56 +01:00
