Anders Schack-Mulligen
ae24d68b5d
C/C++/C#/Java/Python/Ruby/Swift: Adjust expected output.
2023-07-19 11:41:15 +02:00
Alex Ford
d89c10dd85
Merge pull request #13130 from maikypedia/maikypedia/xpath-injection
...
Ruby : XPath Injection Query (CWE-643)
2023-07-14 14:10:09 +01:00
Asger F
86b5f0adc7
Revert "Merge pull request #13620 from github/revert-13496-rb/tracking-on-demand"
...
This reverts commit 133de56ac228a8e48351
2023-07-07 09:42:34 +02:00
Asger F
5d1a437e9c
Revert "Ruby: overhaul API graphs"
2023-06-29 15:39:19 +02:00
Asger F
0039cb141e
Merge branch 'main' into rb/tracking-on-demand
2023-06-23 12:55:54 +02:00
Asger F
f392af220b
Ruby: benign changes to SQLi tests (fixed FNs)
2023-06-19 12:15:57 +02:00
Asger F
ce0073b30c
Ruby: update StoredXSS test results
...
These results were previously flagged for the wrong reason.
Calls to a user-define method were seen as ORM calls. The real source is inside the user-defined method, but we miss that due to lack of 'self' handling in ORM tracking.
2023-06-19 12:15:57 +02:00
Jeroen Ketema
d82c3ce11a
Ruby: Rewrite InlineFlowTest as a parameterized module
2023-06-15 10:52:23 +02:00
Jeroen Ketema
c3ba206b6a
Merge pull request #13346 from jketema/inline-2
...
Update inline expectation tests to use parameterized module
2023-06-13 10:10:55 +02:00
Jeroen Ketema
4485560f43
Ruby: Rewrite inline expectation tests to use parameterized module
2023-06-09 10:43:05 +02:00
Arthur Baars
7324d1705e
Merge branch 'main' into amammad-ruby-YAMLunsafeLoad
2023-06-06 12:09:06 +02:00
Erik Krogh Kristensen
219ec9d05d
Merge pull request #13127 from erik-krogh/polReDoS
...
ReDoS: revert new superlinear algorithm.
2023-06-02 16:10:24 +02:00
Harry Maclean
b8c3cba4ff
Ruby: Consolidate unsafe deserialization queries
...
Merge the experimental YAMLUnsafeDeserialization and
PlistUnsafeDeserialization queries into the generate
UnsafeDeserialization query in the default suite.
These queries look for some specific sinks that we now find in the
general query.
Also apply some small code and comment refactors.
2023-05-27 01:20:04 +00:00
amammad
b9296d3df8
v2.1 fix file names
2023-05-27 01:14:36 +00:00
amammad
4360a56b45
v2 add plist.parse_xml as a dangerous sink and enhancements on documents
2023-05-27 01:14:36 +00:00
amammad
0521ffe175
v1.4 correct dirs uppercase issue
2023-05-27 01:14:36 +00:00
amammad
0e343e5a12
v1.3
2023-05-27 01:14:36 +00:00
amammad
486a5ac96f
v1
2023-05-27 01:14:36 +00:00
Arthur Baars
e0466900ad
Merge pull request #12992 from Sim4n6/ruby-UBV
...
[Ruby] Add Unicode Bypass Validation query, test and help file
2023-05-26 13:00:21 +02:00
Maiky
8dca585207
Expected
2023-05-23 20:04:34 +02:00
Maiky
ad5355a04a
Pg Library, change note and Frameworks.qll
2023-05-23 19:49:03 +02:00
Sim4n6
90c174de4e
Updated the .expected file accordingly
2023-05-23 17:36:50 +01:00
erik-krogh
c7e21ee9ae
add really long regex as a test-case
2023-05-23 09:56:06 +02:00
Sim4n6
f7f0564e36
added one more test
2023-05-20 18:00:27 +01:00
Sim4n6
d11cb9195c
Use of CGI.escapeHTML() in test samples
2023-05-20 12:57:50 +01:00
Maiky
071a77cedc
Ruby : XPath Injection Query (CWE-643)
2023-05-11 15:29:54 +02:00
Sim4n6
1247403d43
Updated expected results file
2023-05-04 08:56:45 +01:00
Alex Ford
82c025020d
Merge remote-tracking branch 'origin/main' into maikypedia/ruby-ssti
2023-05-02 16:18:41 +01:00
Alex Ford
a571bc64ac
ruby: regenerate TemplateInjection.expected
2023-05-02 16:14:20 +01:00
Sim4n6
019b85beb6
Add Unicode Bypass Validation query, test and help file
2023-05-02 15:36:39 +01:00
Maiky
5d15ec99c8
Change expected file to new
2023-05-02 09:26:41 +02:00
Anders Schack-Mulligen
09d4fe21e8
Ruby: Update more expected output.
2023-04-26 13:37:07 +02:00
Anders Schack-Mulligen
90f84bb516
Ruby: Update expected output.
2023-04-26 13:08:16 +02:00
Peter Stöckli
2f268b309b
Ruby: improve non-constant-kernel-open, freeze called on constant
2023-04-18 11:24:01 +02:00
Peter Stöckli
0a6bb3f7ce
Ruby: improve non-constant-kernel-open, no FP's on open without arguments
2023-04-18 10:10:36 +02:00
Maiky
820db43945
Add ERB Template Injection Sink
2023-04-13 17:21:31 +02:00
Arthur Baars
cd53c77e23
Merge pull request #12670 from alexrford/mergeback-rc/3.9
...
Merge `rc/3.9` back into `main`
2023-03-28 10:49:08 +02:00
Erik Krogh Kristensen
d3c3f2dc90
Merge pull request #12628 from erik-krogh/betterReDoS
...
ReDoS: better super-linear algorithm
2023-03-27 15:26:49 +02:00
Alex Ford
181e5d588d
Merge remote-tracking branch 'origin/rc/3.9' into main
2023-03-27 12:16:03 +01:00
Alex Ford
24aa16c919
Ruby: update rb/sensitive-get-query test output
2023-03-27 09:44:55 +01:00
Tom Hvitved
b816c79248
Ruby: Include all assignments in data flow paths
2023-03-24 10:09:30 +01:00
erik-krogh
b071d3557e
JS/PY/RB: add a worst-case test, that now performs OK
2023-03-22 10:13:18 +01:00
Alex Ford
4b1171ce64
Merge branch 'main' into maikypedia/ruby-ssti
2023-03-20 09:55:53 +00:00
Erik Krogh Kristensen
af98ceb3c3
Merge pull request #11478 from erik-krogh/more-shell-taint
...
Rb: more taint-steps for shell-command-construction
2023-03-20 08:41:22 +01:00
Alex Ford
e84b08409c
Ruby: test fixes
2023-03-17 12:08:38 +00:00
Alex Ford
60f313863a
Merge branch 'main' into maikypedia/ruby-ssti
2023-03-17 11:31:49 +00:00
Tom Hvitved
9d3863eccc
Ruby: Rely on built-in hash-flow in clear text storage query
2023-03-16 14:55:06 +01:00
Tom Hvitved
ae10e6e08f
Ruby: Add a test that shows FP/FN for clear text logging query
2023-03-16 14:38:45 +01:00
erik-krogh
2133d1a5ab
Merge branch 'main' into more-shell-taint
2023-03-15 10:54:30 +01:00
erik-krogh
25a6d496d9
Merge branch 'main' into HEAD
2023-03-13 17:33:06 +01:00
