Tom Hvitved
e9c8f979f9
Data flow: Sync files
2022-05-03 11:46:51 +02:00
Nick Rolfe
00bf352b50
Ruby: fix some flow summary join orders
...
The flow summaries that are implemented with an abstract base class
restricting the method name, and child classes using that method name,
had unfortunate join orders:
r1 = JOIN Call::MethodCall::getMethodName#dispred#f0820431#ff WITH Call::MethodCall::getMethodName#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.0, (Lhs.1 ++ "_arg"), Rhs.1
2022-05-03 09:58:40 +01:00
Arthur Baars
19e4d34581
Update ruby/ql/lib/change-notes/2022-04-30-update-grammar.md
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-05-03 10:08:29 +02:00
Erik Krogh Kristensen
f87312d4ba
have ApiGraphModelsSpecific.qll mention all the required predicates/types
2022-04-30 20:29:44 +02:00
Arthur Baars
cf4325c86f
Add change note
2022-04-29 16:19:11 +02:00
Tom Hvitved
8d2bf2228b
Merge pull request #7914 from hvitved/ruby/generalize-element-content
...
Ruby: Generalize `ArrayElementContent` to `ElementContent`
2022-04-28 14:23:08 +02:00
Jeroen Ketema
4a648f3c89
Fix change note items
2022-04-28 14:14:19 +02:00
github-actions[bot]
8e4cf190e9
Release preparation for version 2.9.1
2022-04-28 11:59:05 +00:00
Tom Hvitved
f7669815ce
Address review comments
2022-04-28 13:50:26 +02:00
Arthur Baars
ccc18640db
Ruby: add upgrade and downgrade scripts
2022-04-28 13:47:14 +02:00
Arthur Baars
20a3e3a8ae
Update library
2022-04-28 13:00:02 +02:00
Arthur Baars
65989ae564
Update dbscheme stats
2022-04-28 13:00:02 +02:00
Arthur Baars
a848929069
Regenerate QLL library
2022-04-28 13:00:02 +02:00
Harry Maclean
ba1d43dd42
Merge pull request #8658 from hmac/hmac/insecure-download
...
Ruby: Add InsecureDownload query
2022-04-28 11:07:35 +12:00
Harry Maclean
f4453f4da2
Merge pull request #8573 from hmac/hmac/missing-regexp-anchor
...
Ruby: Add MissingRegExpAnchor query
2022-04-28 11:06:33 +12:00
Erik Krogh Kristensen
e1c7d369be
Merge pull request #8796 from erik-krogh/redundantImport
...
Remove redundant imports
2022-04-27 12:39:51 +02:00
Tom Hvitved
790d97714f
Ruby: Replace Element with Element[any]
...
To make it look more like `Argument` tokens.
2022-04-27 11:53:25 +02:00
Tom Hvitved
d1c9d68e14
Ruby: Generalize ArrayElementContent to ElementContent
2022-04-27 11:53:21 +02:00
Tom Hvitved
3b7fe06858
Ruby: Simplify flow summary for fetch
2022-04-27 08:26:24 +02:00
Harry Maclean
992cc517a8
Ruby: Minor changes to InsecureDownload
2022-04-27 18:04:21 +12:00
Harry Maclean
a85811ad69
Remove unused field
2022-04-27 12:47:09 +12:00
Harry Maclean
bb3fb0325b
Ruby: Add InsecureDownload query
...
This query finds cases where a potentially unsafe file is downloaded
over an unsecured connection.
2022-04-27 12:47:09 +12:00
Harry Maclean
ce7675ef43
Ruby: Identify domain in Net::HTTP requests
2022-04-27 12:47:09 +12:00
Harry Maclean
3f8b27c0cd
Ruby: Add RegExpNonWordBoundary to RegExpTreeView
2022-04-27 10:12:33 +12:00
Harry Maclean
debc57b417
Ruby: Add RegExpAnchor to RegExpTreeView
2022-04-27 10:12:33 +12:00
Harry Maclean
d95f533d19
Ruby: Add getLastChild to RegExpParent
2022-04-27 10:12:33 +12:00
Nick Rolfe
649d7dd022
Merge pull request #8607 from github/nickrolfe/incomplete_sanitization
...
Ruby: port of `js/incomplete-sanitization`
2022-04-26 17:10:24 +01:00
Erik Krogh Kristensen
d389012b75
Merge branch 'main' into redundantImport
2022-04-26 14:24:51 +02:00
Anders Schack-Mulligen
59aedc2872
Merge pull request #8853 from aschackmull/dataflow/fix-join
...
Dataflow: Fix join-on-config producing a CP.
2022-04-26 09:52:50 +02:00
Mathias Vorreiter Pedersen
aca4c8727f
Merge pull request #8802 from github/post-release-prep/codeql-cli-2.9.0
...
Post-release preparation for codeql-cli-2.9.0
2022-04-25 22:52:55 +01:00
Anders Schack-Mulligen
c06efa1f42
Dataflow: Sync.
2022-04-25 13:11:04 +02:00
Anders Schack-Mulligen
40a16325a9
Minor clean-up in AccessPathSyntax.
2022-04-25 12:27:48 +02:00
Alex Ford
b956616a56
Ruby: fix alert
2022-04-25 11:25:57 +01:00
Tom Hvitved
bffa8fa7cb
Merge pull request #8641 from hvitved/dataflow/interpret-read-store
...
Data flow: Introduce `ContentSet`
2022-04-25 12:17:34 +02:00
Tom Hvitved
2466288656
Data flow: Simplify revFlowStore
2022-04-25 10:11:54 +02:00
Tom Hvitved
cf0a1e748a
Add change notes
2022-04-25 09:17:40 +02:00
Alex Ford
e03ce8f9f2
Ruby: add experimental library to support RBI files
2022-04-24 22:48:52 +01:00
Alex Ford
e3e02c98ea
Ruby: Add ExprNodes::CallableCfgNode and ExprNodes::MethodBaseCfgNode
2022-04-24 22:27:20 +01:00
Jeroen Ketema
79164056d1
Replace help.semmle.com links by codeql.github.com links
2022-04-22 20:42:11 +02:00
Tom Hvitved
bc6ee10583
Data flow: Sync files
2022-04-22 15:10:00 +02:00
Tom Hvitved
488a4ede94
Data flow: Inline getAStoreContent up-front
2022-04-22 15:09:59 +02:00
Tom Hvitved
b033f107df
Merge remote-tracking branch 'upstream/main' into dataflow/interpret-read-store
2022-04-22 14:35:02 +02:00
Erik Krogh Kristensen
ff73dbc35c
delete redundant imports
2022-04-22 12:55:28 +02:00
Erik Krogh Kristensen
a96489b23d
delete duplicate imports
2022-04-22 12:41:30 +02:00
Erik Krogh Kristensen
c015ef6ef4
Merge pull request #8810 from erik-krogh/rubyPathgraph
...
Ruby: dont import the PathGraph module from Query.qll files
2022-04-22 12:02:59 +02:00
Tom Hvitved
093a3879be
Merge pull request #8794 from hvitved/ruby/capture-barrier-guards
...
Ruby: Handle captured variables in `BarrierGuard::getAGuardedNode()`
2022-04-22 11:47:36 +02:00
Erik Krogh Kristensen
a737350f27
RB: dont import the PathGraph module from Query.qll files
2022-04-22 11:46:06 +02:00
Tom Hvitved
be5363ea53
Merge pull request #8801 from hvitved/ruby/exclude-splat-in-taint-tracking
...
Ruby: Exclude `SplatExpr` from taint tracking
2022-04-22 11:12:05 +02:00
github-actions[bot]
1aecfc67c2
Post-release preparation for codeql-cli-2.9.0
2022-04-21 19:22:19 +00:00
Tom Hvitved
c20ce62767
Ruby: Exclude SplatExpr from taint tracking
...
`SplatExpr`s are modelled using flow summaries, so there is no need to include them
explicitly in `defaultAdditionalTaintStep`.
2022-04-21 20:27:04 +02:00
