Harry Maclean
c00d0d302d
Ruby: fix wording in rb/request-without-cert-validation
2024-05-01 17:25:58 +01:00
Erik Krogh Kristensen
7e839792da
Merge pull request #16330 from erik-krogh/del-deps-apr-2024
...
All: delete outdated deprecations
2024-04-30 10:43:39 +02:00
Harry Maclean
8b23f6db10
Ruby: Add URI.open example to rb/kernel-open qhelp
2024-04-27 09:53:54 +01:00
erik-krogh
baa31e1469
delete outdated deprecations
2024-04-25 22:19:28 +02:00
Joe Farebrother
5cebcadc56
Merge pull request #15987 from joefarebrother/ruby-mass-reassignment
...
Ruby: Add query for insecure mass assignment
2024-04-12 10:18:41 +01:00
Erik Krogh Kristensen
c00e2075a4
Merge pull request #16111 from erik-krogh/rb-url
...
RB: Improve QHelp for `rb/url-redirect`, and fix an FP.
2024-04-11 13:03:35 +02:00
erik-krogh
4ae25c2d34
don't mention arrays in the qhelp for rb/shell-command-constructed-from-input, because there are no array
2024-04-10 14:26:00 +02:00
erik-krogh
59c72b683c
update the url-redirect QHelp
2024-04-08 12:00:27 +02:00
Erik Krogh Kristensen
0cfac605bd
Merge pull request #16100 from erik-krogh/fix-js-rb-typo
...
RB: fix language specifier typo in qhelp for rb/multi-char-san
2024-04-04 15:42:45 +02:00
erik-krogh
ec32bdce63
fix unsanitized -> sanitized typo, and don't add a new variable just to remove newlines
2024-04-03 09:19:18 +02:00
erik-krogh
572d3ba542
fix language specifier typo in qhelp for rb/multi-char-san
2024-04-02 19:40:46 +02:00
Harry Maclean
409f46ef7b
Merge pull request #14308 from hmac/hmac-rb-csrf-not-enabled
...
Ruby: Add a query for CSRF protection not enabled
2024-04-02 11:30:36 +01:00
Joe Farebrother
fb19288981
Address review comments - Fix docs typo and add a reference
2024-03-25 15:46:45 +00:00
Joe Farebrother
a6ee19ca2d
Fix query id
2024-03-22 14:36:47 +00:00
Joe Farebrother
01f712476b
Add change note and update severity
2024-03-22 14:07:11 +00:00
Joe Farebrother
a8aac318d0
Add qhelp
2024-03-22 14:04:52 +00:00
Joe Farebrother
0f45a53adc
Add mass assignment query
2024-03-22 14:04:52 +00:00
Henry Mercer
a76832f4e0
Mark LOC queries as debug instead
2024-03-20 21:18:55 +00:00
Henry Mercer
c325ff8a23
Mark lines of code queries as telemetry queries
...
The new file coverage metrics are available in all supported GHES
versions. This PR tags lines of code queries as telemetry queries. Lines
of code information will still be available in the SARIF file, but it
will no longer be displayed in the logging output of the CLI.
The one exception is the metric queries for Java/Kotlin that provides
separate lines of code information for Java and Kotlin. I've kept these
since separate file coverage information for languages like Java and
Kotlin is only available for GHES 3.12 and later.
2024-03-11 16:40:31 +00:00
Harry Maclean
081c1201ed
Ruby: Make csrf query more specific
...
CSRF protection only needs to be explicitly enabled on Rails
applications < 5.2 _or_ those that don't include a `load_defaults` call
with a version >= 5.2.
2024-02-23 11:13:17 +00:00
Harry Maclean
32b775fdc3
Ruby: reduce duplicate alerts for csrf query
...
Only generate an alert on the top-most vulnerable Rails controller in
the controller tree.
2024-02-23 11:13:17 +00:00
Harry Maclean
0597b2ed1b
Ruby: recognise csrf_meta_tag
...
csrf_meta_tag is an alias for csrf_meta_tags, retained for backwards
compatibility.
2024-02-23 11:13:16 +00:00
Harry Maclean
3c69ab10f2
Ruby: Restrict rb/csrf-protection-not-enabled
...
This query only applies to codebases using Ruby on Rails < 5.2, or where
there is no call to `csrf_meta_tags` in the base ERb template.
2024-02-23 11:13:15 +00:00
Harry Maclean
6d6f8ba512
Ruby: Make CSRF query more sensitive
...
Generate an alert for every controller class that doesn't have or
inherity a `protect_from_forgery` setting.
2024-02-23 11:13:15 +00:00
Harry Maclean
49d826f667
Ruby: Add a query for CSRF protection not enabled
...
Specifically in Rails apps, we look for root ActionController classes
without a call to `protect_from_forgery`.
2024-02-23 11:13:14 +00:00
Koen Vlaswinkel
817fd8c097
Ruby: Move TestFile to modeling Util module
...
The TestFile class in the ModelEditor module is more accurate than the
existing RelevantFile class in the Util module, so this moves the
TestFile class to Util and redefines RelevantFile in terms of the
TestFile.
2024-01-31 11:53:30 +01:00
Koen Vlaswinkel
b51379b533
Ruby: Only model relevant files for type models
2024-01-31 11:30:16 +01:00
Harry Maclean
a298a395e6
Merge pull request #15473 from github/koesie10/ruby-model-only-public-methods
...
Ruby: Only generate models for public methods
2024-01-31 09:27:27 +00:00
Arthur Baars
4591560692
Merge pull request #14544 from p-/p--oj-ox-unsafe-deser
...
Ruby: additional unsafe deserialization sinks for ox and one for oj
2024-01-30 19:28:32 +01:00
Koen Vlaswinkel
0442631c68
Ruby: Only generate models for public methods
2024-01-30 16:07:34 +01:00
Peter Stöckli
1947dee46a
Merge branch 'main' into p--oj-ox-unsafe-deser
2024-01-30 15:33:39 +01:00
Sid Shankar
b1d7a635f5
Renames diagnostic query files and tests
...
This commit renames the files relating to the diagnostic query that produces information on the number of files extracted. The files have been renamed from "SuccessfullExtractedFiles.*" to "ExtractedFiles.*". All related tests and test files have been renamed too.
The `@tags` and `@id` attributes of the queries have been left untouched, consistent with the `@tags` and `@id` for similar queries in other languages.
2024-01-29 20:19:20 +00:00
Sid Shankar
b26fef816a
Rb: Report any extracted file as successfully extracted
2024-01-08 22:21:30 +00:00
Harry Maclean
944fbeb34c
Ruby: Update comment
...
We don't actually generate type models for `extend` relationships yet,
because they are more complex than `include`.
2023-12-08 14:54:21 +00:00
Harry Maclean
c1c258f567
Ruby: Include ancestors in type model generation
2023-12-08 14:16:49 +00:00
Harry Maclean
9b998a39b4
Ruby: Add tags to GenerateModel query
...
This allows the model editor to find this query in a more robust way
than by file path.
2023-11-27 09:18:00 +00:00
Rasmus Wriedt Larsen
43d9d2ceb7
Merge pull request #14603 from github/max-schaefer/broken-crypto-algorithm-link
...
JavaScript/Python/Ruby: Improve alert message for `*/weak-cryptographic-algorithm`.
2023-11-08 14:29:24 +01:00
Geoffrey White
e8a466a02c
Update dead link.
2023-11-07 09:26:07 +00:00
Alex Ford
f6ac63b259
Ruby: modgen - use FeatureEqualSourceSinkCallContext feature rather than late filtering for method context
2023-10-27 14:48:50 +01:00
Alex Ford
0818354ad7
Ruby: modgen - fix unbound variable
2023-10-27 11:46:09 +01:00
Max Schaefer
104700f6d3
Address review comment.
2023-10-27 10:19:28 +01:00
Alex Ford
5a1a3f0727
Ruby: modgen - deduplicate getAnyParameter logic
2023-10-26 17:45:47 +01:00
Alex Ford
86ba75cadf
Ruby: modgen - support self arguments
2023-10-26 17:42:46 +01:00
Alex Ford
6203887645
fixup
2023-10-26 17:38:43 +01:00
Alex Ford
24946c0dfd
Ruby: modgen - restrict flow summaries to public methods
2023-10-26 17:05:31 +01:00
Alex Ford
fef2932f56
Apply suggestions from code review
...
Co-authored-by: Harry Maclean <hmac@github.com >
2023-10-26 17:04:51 +01:00
Max Schaefer
08cc8b8e80
Autoformat.
2023-10-26 15:36:06 +01:00
Max Schaefer
f42bd28ca9
Port changes to Ruby.
2023-10-26 15:06:45 +01:00
Alex Ford
16c5edd3ca
Ruby: add a query and script for autogenerating typeModel and summaryModel data extensions entries
2023-10-25 15:52:02 +01:00
Peter Stöckli
09cf76a880
Ruby: additional unsafe deserialization sinks for ox, oj
2023-10-19 14:04:48 +02:00
