Nick Rolfe
50b10be2db
Ruby: StackTraceExposure: add test for a specific rescue type
2022-11-24 14:08:34 +00:00
Nick Rolfe
1c407a28cd
Apply suggestions from code review
...
Co-authored-by: Harry Maclean <hmac@github.com >
2022-11-24 14:02:32 +00:00
Nick Rolfe
c660ea100b
Ruby: add changenote for rb/stack-trace-exposure
2022-11-14 12:26:40 +00:00
Nick Rolfe
b39e2ef71c
Ruby: add stacktrace exposure query
2022-11-14 12:26:40 +00:00
Rasmus Wriedt Larsen
ddbcdcb4ba
Merge pull request #11160 from RasmusWL/dataflow-consistency-read-store
...
DataFlow: Add read/store stepIsLocal consistency checks
2022-11-11 14:51:45 +01:00
Nick Rolfe
e3ebf1c668
Merge pull request #11187 from github/nickrolfe/actioncable
...
Ruby: add ActionCable channel RPC params as remote flow sources
2022-11-11 11:32:13 +00:00
Erik Krogh Kristensen
90382c4d1c
Merge pull request #11178 from erik-krogh/passcode
...
JS/RB/PY: Recognize `passcode` as sensitive
2022-11-10 17:58:34 +01:00
Tom Hvitved
bda4b52395
Merge pull request #11206 from hvitved/ruby/self-toplevel-def
...
Ruby: Fix SSA entry definitions for `self` in top-level
2022-11-10 17:01:59 +01:00
Nick Rolfe
20f76e50c3
Ruby: actually call the isPublic() predicate I added
2022-11-10 15:53:04 +00:00
Tom Hvitved
e18442069b
Ruby: Fix SSA entry definitions for self in top-level
2022-11-10 15:08:17 +01:00
Erik Krogh Kristensen
5d2ab8adfb
Merge pull request #11191 from erik-krogh/arrJoin
...
RB: add join(" ") calls as a sink for rb/shell-command-constructed-from-input
2022-11-10 14:20:42 +01:00
Michael Nebel
9c6875ec0f
Merge pull request #10777 from michaelnebel/csharp/generatedataextensions
...
C#: Generate data extension files
2022-11-10 13:08:31 +01:00
Nick Rolfe
2b5e2ed282
Ruby: factor out some code into a helper predicate
2022-11-10 11:41:52 +00:00
erik-krogh
88de299e12
add join(" ") calls as a sink for rb/shell-command-constructed-from-input
2022-11-09 21:46:25 +01:00
Nick Rolfe
eb2a487433
Ruby: update expected test output
2022-11-09 17:38:33 +00:00
Nick Rolfe
0d9aa0cdac
Ruby: fix clashing method names from merge conflict
2022-11-09 17:06:43 +00:00
Nick Rolfe
c8c53cb424
Merge remote-tracking branch 'origin/main' into nickrolfe/active_support_flow_summaries
2022-11-09 17:02:05 +00:00
Nick Rolfe
cfde7e9edc
Ruby: more accurate modeling of which ActionCable channel methods become endpoints
2022-11-09 16:14:11 +00:00
Nick Rolfe
611ed93e39
Ruby: add is{Public,Protected,Private} to DataFlow::MethodNode
2022-11-09 15:18:16 +00:00
Nick Rolfe
199b3f4d71
Ruby: add change note for ActionCable channel remote flow sources
2022-11-09 14:18:44 +00:00
Nick Rolfe
db20e7d143
Ruby: add ActionCable channel RPC params as remote-flow sources
2022-11-09 14:16:04 +00:00
Asger F
859dc7beb7
Merge pull request #11024 from asgerf/rb/data-flow-layer-capture2
...
Ruby: expand DataFlow API
2022-11-09 15:06:03 +01:00
Nick Rolfe
97e939ae2b
Ruby: refine summaries for Hash#reverse_merge etc.
...
- revert the changes to the taint summaries specific to ActionController
params
- make the general flow summaries value-preserving and use
WithElement[any]
2022-11-09 11:56:07 +00:00
erik-krogh
c8b7eccc6f
sync files
2022-11-09 11:31:13 +01:00
Asger F
f4b2af730d
Update ruby/ql/lib/codeql/ruby/dataflow/internal/TaintTrackingPrivate.qll
...
Co-authored-by: Tom Hvitved <hvitved@github.com >
2022-11-09 09:28:07 +01:00
Asger F
43769ad464
Ruby: update test output
2022-11-08 19:20:57 +01:00
Nick Rolfe
a9ff0bdbbf
Ruby: accept changed test output
2022-11-08 17:36:31 +00:00
Nick Rolfe
865d0ca64a
Ruby: add changenote for ActiveSupport Hash extension summaries
2022-11-08 15:52:21 +00:00
Nick Rolfe
04575674db
Ruby: generalise summaries for ActiveSupport Hash extensions
2022-11-08 15:48:20 +00:00
Asger F
271de66f01
Ruby: rename getConst -> getConstant
2022-11-08 16:41:04 +01:00
Asger F
a60f510c85
Ruby: handle knownOrUnkown in default taint step
2022-11-08 16:11:55 +01:00
Tom Hvitved
f0554fcdee
Merge pull request #11155 from hvitved/ruby/avoid-stage-recomputation
...
Ruby: Avoid stage recomputation
2022-11-08 13:46:53 +01:00
Tom Hvitved
edde3defed
Merge pull request #11153 from hvitved/ruby/basic-block-at-conditions
...
Ruby: Split basic blocks around constant conditionals
2022-11-08 13:35:52 +01:00
Rasmus Wriedt Larsen
4895daba85
DataFlow: Add read/store stepIsLocal consistency checks
2022-11-08 13:32:49 +01:00
Tom Hvitved
f0b9ca4bf9
Ruby: Add more guards tests
2022-11-08 11:09:54 +01:00
Asger F
a75c50620c
Ruby: update more SSA test output
2022-11-08 11:03:24 +01:00
Tom Hvitved
37a69b4569
Ruby: Avoid stage recomputation
2022-11-08 10:51:30 +01:00
Erik Krogh Kristensen
c82410fd16
Merge pull request #10680 from erik-krogh/unsafeRbCmd
...
RB: add an unsafe-shell-command-construction query
2022-11-08 09:22:33 +01:00
Tom Hvitved
7ba0682297
Ruby: Split basic blocks around constant conditionals
2022-11-08 09:07:23 +01:00
Tom Hvitved
c86f597153
Ruby: Add test for disjunctive guard
2022-11-08 09:01:22 +01:00
Harry Maclean
03aa8df8e2
Ruby: Cosmetic change
2022-11-08 10:24:21 +13:00
Harry Maclean
d392cdaab6
Merge pull request #11022 from hmac/try-code-injection
...
Ruby: try/try! as code execution
2022-11-08 09:42:52 +13:00
Erik Krogh Kristensen
3f871a08e2
apply suggestions from doc review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2022-11-07 16:29:10 +01:00
Asger F
edc5d8d644
Ruby: update test output
2022-11-07 14:17:50 +01:00
Asger F
a213e9e55d
Merge pull request #1 from hvitved/rb/data-flow-layer-capture2
...
Ruby: Make sure to always generate SSA definitions for namespace self-variables
2022-11-07 14:12:48 +01:00
Erik Krogh Kristensen
d67235b3c1
Merge pull request #11071 from erik-krogh/fixCanon
...
ReDoS: fix canonicalization in NfaUtils
2022-11-07 14:10:50 +01:00
Asger F
f991991474
Ruby: fix incomplete renaming of getCanonicalEnclosing/Nested module
2022-11-07 14:04:10 +01:00
Tom Hvitved
2737255705
Ruby: Make sure to always generate SSA definitions for namespace self-variables
2022-11-07 14:02:09 +01:00
Asger F
a39cefe40f
Ruby: fix broken test
2022-11-07 14:01:11 +01:00
Asger F
334d5b1b17
Ruby: fix stale qldoc
2022-11-07 11:23:40 +01:00
