hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-18 16:03:45 +01:00
Code Issues Packages Projects Releases Wiki Activity
41,129 Commits 1,692 Branches 160 Tags
301914d80c41db9f662740171755a391228ea448
Commit Graph

956 Commits

Author SHA1 Message Date
Harry Maclean
706d1d2eee Ruby: Make StringArrayInclusion more sensitive 
We now recognise the following pattern as a barrier guard for `x`:

    values = ["foo", "bar"]

    if values.include? x
      sink x
    end
 2022-07-13 18:20:12 +12:00
Nick Rolfe
6632dfaf88 Ruby: fix another SystemCommandExecution::isShellInterpreted implementation 2022-07-11 16:53:30 +01:00
Nick Rolfe
348ad95fc0 Ruby: fix defining every dataflow node as a command execution sink 2022-07-11 15:06:27 +01:00
Brandon Stewart
5888325549 Merge branch 'main' into patch-1 2022-06-29 08:42:24 -04:00
Jeroen Ketema
55e052af26 Merge pull request #9686 from aschackmull/dataflow/no-node-scan 
Dataflow performance: Avoid node scans
 2022-06-29 10:38:56 +02:00
Brandon Stewart
33d1aae92a Update ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll 
Co-authored-by: Harry Maclean <hmac@github.com>
 2022-06-28 08:51:01 -04:00
Brandon Stewart
1dc26a0ca3 Update ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll 
Co-authored-by: Harry Maclean <hmac@github.com>
 2022-06-28 08:50:54 -04:00
Brandon Stewart
99ae1b3f0d Merge branch 'main' into patch-1 2022-06-27 10:12:26 -04:00
Brandon Stewart
52290fd4ae run codeql query format 2022-06-27 10:01:40 -04:00
Asger F
09476d1c13 Ruby: fix deprecation warning 2022-06-27 10:01:37 +02:00
Harry Maclean
101111bd2f Merge pull request #9574 from hmac/hmac/action-cable-logger 
Ruby: More Rails modeling
 2022-06-27 19:56:54 +12:00
Asger F
d6fd43fe12 Merge pull request #9364 from asgerf/ruby/api-graph-api 
Ruby: API graph renaming an documentation
 2022-06-27 08:54:24 +02:00
Brandon Stewart
29e73e1a04 Update ActiveRecord.qll 2022-06-24 15:35:36 -04:00
Brandon Stewart
463c096d4c Update ActiveRecord.qll 2022-06-24 15:33:02 -04:00
Brandon Stewart
2047954013 Merge branch 'main' into patch-1 2022-06-24 15:30:11 -04:00
Brandon Stewart
ff9a7244c2 Update ActiveRecord.qll 2022-06-24 15:28:09 -04:00
Brandon Stewart
caeef68bde Update ActiveRecord.qll 2022-06-23 12:31:05 -04:00
Brandon Stewart
173bea2579 Update ActiveRecord.qll 2022-06-23 12:18:26 -04:00
Brandon Stewart
fa622f551a Update ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll 
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com>
 2022-06-23 12:16:50 -04:00
Anders Schack-Mulligen
dc517a758e Autoformat 2022-06-23 14:44:40 +02:00
Anders Schack-Mulligen
4a317a25d3 Dataflow: Sync. 2022-06-23 14:34:52 +02:00
Rasmus Wriedt Larsen
3248f7b423 Merge pull request #9649 from RasmusWL/certificate-modeling 
Python/JS/Ruby: Ignore common words (like certain) as sensitive data source
 2022-06-23 12:04:58 +02:00
Rasmus Wriedt Larsen
2ce4b7b9fc SensitiveDataHeuristics: sync 2022-06-22 11:05:14 +02:00
Anders Schack-Mulligen
df6d68b215 Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class 
Dataflow: Deprecate BarrierGuard class
 2022-06-22 10:44:08 +02:00
Michael Nebel
24ba5cc06e Merge pull request #9025 from michaelnebel/csharp/generatedrefactor 
C#: Provenance column in Models as Data CSV format.
 2022-06-22 10:34:31 +02:00
Brandon Stewart
a2e2dcdfd5 Make ActiveRecordInstanceMethodCall Public 2022-06-21 14:44:52 -04:00
Asger F
a1af9c3d7d Ruby: update predicate docs 2022-06-21 12:44:16 +02:00
Asger F
d15b90e21a Ruby: Add deprecation 2022-06-21 12:44:16 +02:00
Asger F
9838e2e101 Ruby: Rename getAValueReachingRhs -> getAValueReachingSink 2022-06-21 12:44:16 +02:00
Asger F
7c877c7861 Ruby: Rename getARhs -> asSink 2022-06-21 12:44:16 +02:00
Asger F
2f8086bb57 Ruby: Rename getAUse -> getAValueReachableFromSource 2022-06-21 12:44:16 +02:00
Asger F
573c5c5efe Ruby: Rename getAnImmediateUse -> asSource 2022-06-21 12:44:16 +02:00
Asger F
f2403e2610 Ruby: port API graph doc comment 2022-06-21 12:44:16 +02:00
Arthur Baars
c5d3df087d Update tree-sitter-embeded-template 2022-06-20 17:04:27 +02:00
Michael Nebel
649757c27f Java/Ruby: Sync files. 2022-06-20 16:20:01 +02:00
Anders Schack-Mulligen
1b13790a36 Ruby: Deprecate and replace BarrierGuard class. 2022-06-20 15:46:38 +02:00
Harry Maclean
e1dcc207b4 Ruby: Model methods in Rails::Generators::Actions 
These methods are sinks for command injection.
 2022-06-20 13:36:09 +12:00
Harry Maclean
20ff4c4299 Ruby: Model ActiveRecord::Relation#touch_all 2022-06-20 13:36:02 +12:00
Harry Maclean
7dfab371f6 Ruby: Model redirect_back and redirect_back_or_to 
These are ActionController methods that redirect to the HTTP Referer,
falling back to the given location if there is no Referer.
 2022-06-20 13:36:02 +12:00
Harry Maclean
a298f5eb5e Ruby: Recognise File.atomic_write as a file writer 
This method is an ActiveSupport extension, but there's no harm in
recognising it universally as any identically-named method is likely to
also be a file writer.
 2022-06-20 13:36:02 +12:00
Harry Maclean
0ce14fc4e5 Ruby: Recognise ActionCable logger class 2022-06-20 13:36:02 +12:00
Harry Maclean
4ecd595b73 Remove duplicate import 2022-06-20 13:36:02 +12:00
Alex Ford
5923eb4962 Merge pull request #9566 from alexrford/ruby/activerecord-findby-dynamic 
Ruby: recognize ActiveRecord `find_by_x` methods
 2022-06-17 09:39:46 +01:00
Harry Maclean
230192df3b Merge pull request #9267 from hmac/hmac/improper-memoization 
Ruby: Add Improper Memoization query
 2022-06-17 16:31:55 +12:00
Arthur Baars
e95194ce67 Merge pull request #9477 from thiggy1342/experimental-archive-api 
RB: Adding experimental query for detecting path traversal in Archive libraries
 2022-06-16 17:45:18 +02:00
Rasmus Wriedt Larsen
45af148f05 Merge pull request #9215 from RasmusWL/ruby-mad-argument-self 
Ruby: Fixes for `Argument[any,any-named]` in MaD
 2022-06-16 17:38:32 +02:00
Anders Schack-Mulligen
6518a01ded Dataflow: Sync. 2022-06-16 11:25:28 +02:00
Rasmus Wriedt Larsen
24750dcc17 Ruby: Sync comment for self API graph label 2022-06-16 11:03:07 +02:00
Rasmus Wriedt Larsen
2ad4921a76 Ruby: Apply suggestions from code review 
Co-authored-by: Asger F <asgerf@github.com>
 2022-06-16 11:01:14 +02:00
thiggy1342
ef9442d377 Merge branch 'main' into experimental-archive-api 2022-06-15 21:46:23 -04:00