erik-krogh
3a3a5aa17c
add case-in as a sink for polynomial-redos
2022-10-13 12:36:07 +02:00
Anders Schack-Mulligen
036724ce8d
Dataflow: Sync.
2022-10-13 11:03:30 +02:00
Harry Maclean
a3c14f7f46
Update test
2022-10-13 13:57:28 +13:00
Harry Maclean
8e55e62b15
Ruby: Add change note
2022-10-13 13:24:16 +13:00
Harry Maclean
4686718630
Ruby: Add kind to Http::Server::RequestInputAccess
...
Like in JS, this describes whether the input came from the request URL,
body, parameters, headers or cookie. Only some of these are relevant for
UrlRedirect and ReflectedXSS queries.
2022-10-13 13:24:16 +13:00
Harry Maclean
9eff4936cf
Ruby: Restrict request methods to user-controlled
2022-10-13 13:24:16 +13:00
Harry Maclean
ad464abde2
Ruby: Model more params accesses
2022-10-13 13:24:16 +13:00
Erik Krogh Kristensen
10aab81f42
Merge pull request #10799 from jsoref/spelling-nfautils
...
ReDoS: Spelling nfautils
2022-10-12 23:09:06 +02:00
Josh Soref
09c8a98761
spelling: representation
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:20:26 -04:00
Josh Soref
bb1ce8973a
spelling: repeatable
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:20:24 -04:00
Josh Soref
adb8860b9b
spelling: pattern
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:20:24 -04:00
Asger F
d28b9af8bd
Merge pull request #10791 from asgerf/rb/rails-render-file
...
Ruby: treat render 'file:' argument as a file system access
2022-10-12 21:18:32 +02:00
Josh Soref
98b317d1a5
spelling: escape
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:02:00 -04:00
Josh Soref
370da943dc
spelling: abcdefghijklmnopqrstuvwxyz
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:02:00 -04:00
erik-krogh
66b3fe3425
add case-when expressions as a sink to rb/polynomial-redos
2022-10-12 19:57:01 +02:00
Alex Ford
0536d4b540
Merge branch 'main' into ruby/activejob-deserialize
2022-10-12 15:04:12 +01:00
Asger F
7bfb3497eb
Ruby: change note
2022-10-12 14:29:34 +02:00
Asger F
83464d48a9
Merge pull request #10773 from asgerf/rb/bugfix-singleton-class-resolution
...
Ruby: bugfix in type-tracking singleton class resolution
2022-10-12 13:45:16 +02:00
Jeroen Ketema
d389a183f0
Merge pull request #10743 from jsoref/spelling
...
Spelling
2022-10-12 12:48:22 +02:00
Tom Hvitved
9bd25220d4
Merge pull request #10760 from hvitved/ruby/regex-taint-flow-restrict
...
Ruby: Restrict regexp taint flow to `String` summaries
2022-10-12 11:59:08 +02:00
Nick Rolfe
39107047bf
Merge pull request #10735 from github/nickrolfe/actionmailer
...
Ruby: add `ActionMailer#params` as a `RemoteFlowSource`
2022-10-12 10:21:11 +01:00
Asger F
e55be83645
Ruby: add 'render file:' as file system access
2022-10-12 09:47:04 +02:00
Alex Ford
bf4dac78c5
Ruby: remove some singleton set literals
2022-10-11 21:44:52 +01:00
Alex Ford
d3c8ce3f48
Ruby: ActiveSupport extends Pathname with an existence method that may return itself
2022-10-11 21:35:58 +01:00
Asger F
ed165c6194
Ruby: bugfix in self-resolution in type-tracking
2022-10-11 18:53:20 +02:00
Asger F
a64286b664
Ruby: add test for singleton class instance field
...
incorrect test output
2022-10-11 18:53:20 +02:00
Alex Ford
3d08a2954d
Ruby: add rb/unsafe-deserialization sinks for const_get args
2022-10-11 15:45:51 +01:00
Alex Ford
a3f096a6bc
Ruby: rb/unsafe-deserialization test realignment
2022-10-11 15:44:00 +01:00
Nick Rolfe
078c3e9d28
Ruby: create top-level module for ActionMailer
2022-10-11 15:22:42 +01:00
Tom Hvitved
2e8f46ddd9
Type tracking: Split up levelStep into levelStepNoCall and levelStepCall
...
To reduce non-linear recursion during call graph construction.
2022-10-11 13:58:46 +02:00
Asger F
02656b16c3
Merge pull request #10685 from asgerf/rb/splat-and-local-field-step
...
Ruby: summarize unary splat operators and add local field step
2022-10-11 13:28:58 +02:00
Erik Krogh Kristensen
01bc5f7226
Merge pull request #10731 from erik-krogh/rb-last-msg
...
Ruby: fix some more style-guide violations in the alert-messages
2022-10-11 12:16:52 +02:00
Tom Hvitved
878654e0ff
Merge pull request #10763 from hvitved/ruby/move-summarized-callable-from-model
...
Ruby: Move `SummarizedCallableFromModel` into `ModelsAsData.qll`
2022-10-11 11:47:38 +02:00
Tom Hvitved
2b75562037
Ruby: Use DataFlow::Configuration in RegExpConfiguration.qll
2022-10-11 11:39:45 +02:00
erik-krogh
42e1735f2a
update expected output
2022-10-11 11:37:26 +02:00
erik-krogh
8779da8c0b
reintroduce Psych
2022-10-11 11:14:52 +02:00
Erik Krogh Kristensen
7d282c3d75
fix casing in alert-message
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-10-11 11:12:59 +02:00
Tom Hvitved
d6df69d481
Merge pull request #10754 from hvitved/dataflow/non-hidden-succ-fast-tc
...
Data flow: Improve `fastTC` bound in `PathNodeImpl::getANonHiddenSuccessor`
2022-10-11 11:12:58 +02:00
Tom Hvitved
53abdb3fb5
Ruby: Move SummarizedCallableFromModel into ModelsAsData.qll
2022-10-11 11:06:35 +02:00
erik-krogh
9a9d2a6fe1
Merge branch 'main' into rb-last-msg
2022-10-11 10:43:39 +02:00
erik-krogh
9fe18e5d73
changes based on review
2022-10-11 09:30:18 +02:00
erik-krogh
186205bd4b
add a test for explicit shell invocations using Kernel.open
2022-10-11 09:23:29 +02:00
erik-krogh
de3b15ebe9
add a query flagging uses of Kernel.open that are not with a constant string
2022-10-11 09:23:29 +02:00
erik-krogh
708f6b51f3
move cwe-078 tests into subfolders
2022-10-11 09:23:29 +02:00
Asger F
b6e07c0cd5
Ruby: block API graph nodes from tracking through self-argument passing
2022-10-11 09:03:52 +02:00
Asger F
125761755a
Ruby: do not generate API graph edges from Attribute contents
...
Models should use Method[x] edges, not attribute edges
2022-10-11 09:03:52 +02:00
Asger F
6daa1c432b
Ruby: update test output
2022-10-11 09:03:51 +02:00
Asger F
38a3476d37
Ruby: add local field step to type tracking
...
fixup local field steps
2022-10-11 09:03:51 +02:00
Asger F
d55925d8d4
Ruby: support splat type-tracking step
2022-10-11 09:03:51 +02:00
Josh Soref
b5bed9cbf5
spelling: explicitly
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:36 -04:00
