Harry Maclean
07a7a213b3
Merge pull request #11871 from hmac/rack
2023-01-26 08:40:30 +13:00
Alex Ford
3dd9392f5e
Merge pull request #11869 from alexrford/rails/render_locals_shared
...
Ruby: Rails - generalize rails flow step for accessing render locals hash in view
2023-01-25 12:07:26 +00:00
erik-krogh
54b0350cac
add note in ReDoS qhelp that Ruby 3.2 has fixed ReDoS
2023-01-25 10:24:11 +01:00
Harry Maclean
e6e4e29bf8
Ruby: newline
2023-01-23 21:53:52 +00:00
Harry Maclean
224db456af
Ruby: Simplify isRackResponse
2023-01-23 21:53:09 +00:00
Harry Maclean
60f9635ada
Ruby: Move import
2023-01-23 21:51:27 +00:00
Harry Maclean
c1207e0938
Ruby: Fix rack response tracking
...
Use type tracking instead of getReturningNode, which seems to be faster
and works correctly for the cases I've tried.
2023-01-23 21:43:04 +00:00
Erik Krogh Kristensen
240248b9cf
Merge pull request #11453 from erik-krogh/unsafeHtmlConstruction
...
RB: add unsafe-html-construction query
2023-01-23 16:40:25 +01:00
Erik Krogh Kristensen
5be97f3761
Merge pull request #11909 from erik-krogh/concatCode
...
Rb: recognize string concatenations as sinks for unsafe-code-construction
2023-01-23 16:22:46 +01:00
erik-krogh
ae00518ddf
remove the isAdditionalTaintStep predicate from UnsafeHtmlConstructionQuery, as it was not needed
2023-01-23 15:27:19 +01:00
erik-krogh
7c6ee5f293
Merge branch 'main' into unsafeHtmlConstruction
2023-01-23 15:01:01 +01:00
Erik Krogh Kristensen
32c4cf5769
Apply suggestions from code review
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-01-23 14:58:04 +01:00
Alex Ford
3b10a2de11
Merge branch 'main' into rails/render_locals_shared
2023-01-23 10:00:22 +00:00
Alex Ford
55550e7980
Merge pull request #11941 from alexrford/summary-component-tostring-syntheticglobal
...
Add missing toString case for synthetic globals
2023-01-23 10:00:00 +00:00
Arthur Baars
99148244a4
Merge pull request #11856 from aibaars/update-grammars
...
Update grammars
2023-01-23 09:46:50 +01:00
Michael Nebel
69a42d8b1f
Merge pull request #11931 from michaelnebel/csharp/refactor
...
Remove the Csv postfix of some predicate names.
2023-01-23 09:09:48 +01:00
Harry Maclean
21ce9b448a
Ruby: Attempt to fix performance of AppCandidate
...
`DataFlow::MethodNode.getAReturningNode` is expensive to compute.
Instead we look for rack responses which flow to the `SynthReturnNode`.
Each method has only one of these (vs many "returning" nodes) so it is
a lot faster.
I'm not sure yet whether the results are the same.
2023-01-23 15:25:52 +13:00
github-actions[bot]
b62cb6ba84
Post-release preparation for codeql-cli-2.12.1
2023-01-20 19:49:56 +00:00
Alex Ford
8ae993185c
Ruby: fix missing docs
2023-01-20 13:40:19 +00:00
Alex Ford
c986ea1070
Ruby: scope local_assigns synthetic globals to both render call and template file
2023-01-20 13:40:19 +00:00
Alex Ford
14c896215c
Ruby: factor out some RenderCall methods into a helper module
2023-01-20 13:40:19 +00:00
Alex Ford
03070c9fd0
Ruby: restrict AccessLocalsKeySummary to method calls against self
2023-01-20 13:40:19 +00:00
Alex Ford
f6516db105
Ruby: correct preservesValue in AccessLocalsKeySummary
2023-01-20 13:40:19 +00:00
Alex Ford
ab72301a4c
Ruby: add a change note for rails render locals dataflow
2023-01-20 13:40:19 +00:00
Alex Ford
8fec4b804f
Ruby: StoredXSS test whitespace change
2023-01-20 13:40:19 +00:00
Alex Ford
fd8dd5e103
Ruby: update StoredXSS test output
2023-01-20 13:40:19 +00:00
Alex Ford
8845157d08
Ruby: slightly limit AccessLocalsKeySummary summarized callables
2023-01-20 13:40:19 +00:00
Alex Ford
b5cc1087fe
Ruby: add LocalAssignsHashSyntheticGlobal#getARenderCall predicate
2023-01-20 13:40:19 +00:00
Alex Ford
022171923c
Ruby: fix some ql for ql alerts
2023-01-20 13:40:19 +00:00
Alex Ford
bea110b598
Ruby: remove blank line in test file
2023-01-20 13:40:19 +00:00
Alex Ford
b78ae1608e
Ruby: remove a fixed TODO
2023-01-20 13:40:19 +00:00
Alex Ford
e5fbc92856
Ruby: generalize rails flow step for accessing render locals hash in view
2023-01-20 13:40:19 +00:00
Alex Ford
e4df1f5a6f
Ruby: add missing toString case for synthetic globals
2023-01-20 13:31:43 +00:00
github-actions[bot]
005b3e4a47
Release preparation for version 2.12.1
2023-01-20 12:03:19 +00:00
Harry Maclean
16baea22c0
Ruby: doc fix
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-01-20 22:06:29 +13:00
Michael Nebel
dc223cb82e
Sync files and make corresponding changes for other languages.
2023-01-19 15:14:06 +01:00
Erik Krogh Kristensen
ee9b01b5e6
Apply suggestions from code review
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-01-18 22:14:46 +01:00
erik-krogh
8251ad5e99
add unsafe-html-construction query
2023-01-17 15:35:17 +01:00
erik-krogh
8715790fe7
add explicit this
2023-01-17 15:17:48 +01:00
erik-krogh
a562568522
add string concat as a sink for command-construction
2023-01-17 14:48:09 +01:00
erik-krogh
9d9de18bc9
add a generalized AddExprRoot into Operation.qll
2023-01-17 14:48:08 +01:00
erik-krogh
8fc3b268e8
add string concat as a sink for code-construction
2023-01-17 14:48:06 +01:00
Rasmus Wriedt Larsen
a0b1c2ea79
DataFlow: Add uniqueParameterNodePositionExclude
2023-01-17 14:05:22 +01:00
Rasmus Wriedt Larsen
2b0a5fd5d1
DataFlow: Add uniqueParameterNodeAtPositionExclude
2023-01-17 14:05:17 +01:00
Erik Krogh Kristensen
59a8b21851
Merge pull request #10862 from erik-krogh/unsafeCodeConstruction
...
Rb: Add an `unsafe-code-construction` query
2023-01-16 13:22:58 +01:00
Arthur Baars
dc6f5f60d1
Ruby: update stats
2023-01-13 10:22:42 +01:00
Arthur Baars
28c9b52dce
Ruby: add change note
2023-01-13 10:22:42 +01:00
Arthur Baars
46063c7d04
Ruby: update expected output
2023-01-13 10:22:41 +01:00
Arthur Baars
c4ec674057
Ruby: support anonymous (hash)splat parameters/arguments
2023-01-13 10:22:41 +01:00
Arthur Baars
4d3e2bb814
Ruby: upgrade/downgrade scripts
2023-01-13 10:22:41 +01:00
