Harry Maclean
6c18e1d7ac
Merge pull request #8272 from hmac/hmac/tainted-format-string
2022-03-22 08:37:47 +13:00
Alex Ford
c891c53835
Merge pull request #8395 from alexrford/ruby/clear-text-storage
...
Ruby: add `rb/clear-text-storage-sensitive-data` query
2022-03-21 10:05:39 +00:00
Harry Maclean
5a6da827d0
Ruby: Avoid FP in TaintedFormatString query
...
Kernel#printf supports two call signatures:
printf(String, *args)
printf(IO, String, *args)
We want to identify the String argument, which is the format string.
Previously we would return the 0th and 1st arguments, which gives some
FPs when the 1st arg is not a format string.
We now try to rule out the trivial case by checking if arg 0 has a
string value, and then assuming it is the format string. Otherwise we
fall back to returning both arguments.
This still has some false positive potential, but less than previously.
2022-03-21 12:51:47 +13:00
Harry Maclean
5dcf0ad759
Ruby: Make IOPrintfCall more sensitive
...
It will now identify cases like this:
file = File.open "foo.txt", "a"
file.printf(params[:format], arg)
2022-03-21 12:51:47 +13:00
Harry Maclean
c253bddbe0
Ruby: Make getFormatArgument 0-indexed
2022-03-21 12:51:47 +13:00
Harry Maclean
c73dc8ad0c
Ruby: Add change note for rb/tainted-format-string
2022-03-21 12:51:47 +13:00
Harry Maclean
10a411e5cc
Ruby: Remove duplicate CWE reference
2022-03-21 12:51:47 +13:00
Harry Maclean
d79a6ddcb2
Ruby: Improve qhelp for rb/tainted-format-string
2022-03-21 12:51:47 +13:00
Harry Maclean
0cfe37dff4
Share TaintedFormatString between Ruby and JS
2022-03-21 12:51:46 +13:00
Harry Maclean
4249e30824
Ruby: Test tainted interpolated format arg
2022-03-21 12:51:18 +13:00
Harry Maclean
63199024a2
Add missing QLDoc
2022-03-21 12:51:18 +13:00
Harry Maclean
f6215d4c7e
Ruby: Add rb/tainted-format-string query
2022-03-21 12:51:18 +13:00
Arthur Baars
beef8e29bc
Merge pull request #8332 from hvitved/ruby/regexp-taint-flow
...
Ruby: Use taint tracking instead of type tracking to define `regExpSource`
2022-03-18 18:24:02 +01:00
Tom Hvitved
1437aefe9d
Ruby: Use taint tracking instead of type tracking to define regExpSource
2022-03-18 14:48:12 +01:00
Tom Hvitved
d97eaba070
Ruby: Add dataflow/taintracking copies for use in libraries
2022-03-18 14:48:12 +01:00
Arthur Baars
4a27928728
Ruby/JS add missing ^ in qhelp
2022-03-18 14:00:10 +01:00
Arthur Baars
431b60506e
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-18 13:05:34 +01:00
Asger F
929419abba
Merge pull request #8254 from asgerf/ruby/mad-prototype
...
Ruby: initial prototype of models-as-data
2022-03-18 10:48:33 +01:00
Tom Hvitved
79ea2a3a9c
Data flow: Sync files
2022-03-17 14:03:58 +01:00
Tom Hvitved
4df12dc6e6
Data flow: State-changing taint steps should not be stepped over by the big step relation
2022-03-17 14:03:58 +01:00
Arthur Baars
1a51f0cf56
Ruby: regex: fix getGroupNumber
...
non-capture groups should not have a group number
2022-03-16 18:50:51 +01:00
Jeroen Ketema
7a9a9d833a
Merge pull request #8435 from jketema/all-the-barriers
...
Add flow state versions of isBarrierIn, isBarrierOut, and isBarrierGuard
2022-03-16 15:50:19 +01:00
Asger F
228570129e
Merge branch 'main' into ruby/mad-prototype
2022-03-16 13:50:31 +01:00
Asger Feldthaus
e168da4c5f
Shared: make a predicate private
2022-03-16 13:48:56 +01:00
Asger Feldthaus
8cef512234
Ruby: ensure ApiGraphs.qll imports its entry points
2022-03-16 13:40:14 +01:00
Asger Feldthaus
e3fbaf5d8f
Shared: prefer exists(var) instead of var = any(string s)
2022-03-16 13:37:08 +01:00
Asger Feldthaus
102540072e
Shared: remove documentation prone to falling out of date
2022-03-16 13:32:55 +01:00
Asger Feldthaus
2ca45ef9f9
Ruby: support BlockArgument in identifying access path
2022-03-16 12:51:14 +01:00
Nick Rolfe
94ce578ea4
Ruby: implement getComponent(n) for simple and hash-key symbols
2022-03-16 11:43:46 +00:00
Asger Feldthaus
c9355095e3
Ruby: Use Receiver instead of Argument[-1] in ActiveStorage
2022-03-16 12:37:21 +01:00
Asger Feldthaus
71f195d1e0
Ruby: add test for Receiver in summary
2022-03-16 12:37:21 +01:00
Arthur Baars
6b323eeda8
Update expected output
2022-03-16 12:34:03 +01:00
Arthur Baars
ab93b3784b
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-16 12:31:12 +01:00
Nick Rolfe
76918238f0
Ruby: test ExprCfgNode::getConstantValue()
2022-03-16 11:21:57 +00:00
Asger Feldthaus
2b02a173c1
Ruby: canonicalize callables based on package;type;path instead of input;output;kind
2022-03-16 12:04:41 +01:00
Nick Rolfe
82ef2a12f6
Merge pull request #8164 from github/nickrolfe/escape_sequences
...
Ruby: interpret string escape sequences in getConstantValue()
2022-03-16 10:45:39 +00:00
Nick Rolfe
1a850028e7
Ruby: update date in changenote filename
2022-03-16 10:32:43 +00:00
Erik Krogh Kristensen
cd9d61c1fc
Merge pull request #8450 from erik-krogh/importAs
...
disallow lowercase import-as aliases
2022-03-16 11:32:37 +01:00
Asger Feldthaus
33ca55770c
Ruby: EntryPoint.getNode -> getANode
2022-03-16 11:02:26 +01:00
Asger Feldthaus
ecf7073bf1
Shared: codeql -> ql in code blocks
2022-03-16 11:00:24 +01:00
Erik Krogh Kristensen
89af50f6d5
rename all lower-case import-as statements
2022-03-15 14:40:38 +01:00
Jeroen Ketema
157a36bc4f
Use node variable in all disjuncts
2022-03-15 11:55:35 +01:00
Jeroen Ketema
9a0e94f389
Add flow state versions of isBarrierIn, isBarrierOut, and isBarrierGuard
2022-03-15 11:55:34 +01:00
Asger Feldthaus
d628dc0b52
Ruby: sync ApiGraphModels.qll
2022-03-15 10:52:41 +01:00
Asger Feldthaus
7f8205684e
Ruby: verify tokens in identifying access path
2022-03-15 10:25:59 +01:00
Asger Feldthaus
65249dabd3
Ruby: add warning for wrong number of columns in CSV row
2022-03-15 09:28:21 +01:00
Erik Krogh Kristensen
c7509c4dd3
Merge branch 'main' into deadCode
2022-03-15 09:19:14 +01:00
Asger Feldthaus
f28acbf3dc
Ruby: autoformat
2022-03-15 08:15:18 +01:00
Arthur Baars
6a74e761c8
Merge pull request #8398 from github/post-release-prep/codeql-cli-2.8.3
...
Post-release preparation for codeql-cli-2.8.3
2022-03-14 21:05:09 +01:00
Asger Feldthaus
fee32d3480
Elaborate on qldoc for API::EntryPoint
2022-03-14 17:52:07 +01:00
