778 Commits

Author	SHA1	Message	Date
Alex Ford	594812640e	Merge pull request #10746 from alexrford/ruby/activejob-deserialize ... Ruby: Add `ActiveJob::Serializers.deserialize` as a code execution sink	2022-10-13 15:36:45 +01:00
Erik Krogh Kristensen	3a1a94b8af	Merge pull request #10798 from erik-krogh/matchCaseReg ... Rb: add case-when expressions as a sink to rb/polynomial-redos	2022-10-13 13:55:42 +02:00
Alex Ford	a65850e922	Merge pull request #10784 from alexrford/ruby/pathname-existence ... Ruby: model `Pathname#existence` extension from `ActiveSupport`	2022-10-13 11:38:22 +01:00
erik-krogh	3a3a5aa17c	add case-in as a sink for polynomial-redos	2022-10-13 12:36:07 +02:00
erik-krogh	66b3fe3425	add case-when expressions as a sink to rb/polynomial-redos	2022-10-12 19:57:01 +02:00
Alex Ford	0536d4b540	Merge branch 'main' into ruby/activejob-deserialize	2022-10-12 15:04:12 +01:00
Asger F	83464d48a9	Merge pull request #10773 from asgerf/rb/bugfix-singleton-class-resolution ... Ruby: bugfix in type-tracking singleton class resolution	2022-10-12 13:45:16 +02:00
Nick Rolfe	39107047bf	Merge pull request #10735 from github/nickrolfe/actionmailer ... Ruby: add `ActionMailer#params` as a `RemoteFlowSource`	2022-10-12 10:21:11 +01:00
Alex Ford	d3c8ce3f48	Ruby: ActiveSupport extends Pathname with an existence method that may return itself	2022-10-11 21:35:58 +01:00
Asger F	ed165c6194	Ruby: bugfix in self-resolution in type-tracking	2022-10-11 18:53:20 +02:00
Asger F	a64286b664	Ruby: add test for singleton class instance field ... incorrect test output	2022-10-11 18:53:20 +02:00
Alex Ford	3d08a2954d	Ruby: add rb/unsafe-deserialization sinks for const_get args	2022-10-11 15:45:51 +01:00
Alex Ford	a3f096a6bc	Ruby: rb/unsafe-deserialization test realignment	2022-10-11 15:44:00 +01:00
Asger F	02656b16c3	Merge pull request #10685 from asgerf/rb/splat-and-local-field-step ... Ruby: summarize unary splat operators and add local field step	2022-10-11 13:28:58 +02:00
erik-krogh	42e1735f2a	update expected output	2022-10-11 11:37:26 +02:00
erik-krogh	8779da8c0b	reintroduce Psych	2022-10-11 11:14:52 +02:00
erik-krogh	9a9d2a6fe1	Merge branch 'main' into rb-last-msg	2022-10-11 10:43:39 +02:00
Asger F	6daa1c432b	Ruby: update test output	2022-10-11 09:03:51 +02:00
Asger F	d55925d8d4	Ruby: support splat type-tracking step	2022-10-11 09:03:51 +02:00
Nick Rolfe	d61f0559a0	Ruby: add ActionMailer#params as a RemoteFlowSource	2022-10-10 10:23:48 +01:00
Alex Ford	ee77404006	Ruby: Add ActiveJob::Serializers.deserialize as a code execution sink	2022-10-09 22:28:22 +01:00
Alex Ford	4a39e4aac0	Ruby: Add new test case for rb/code-injection	2022-10-09 22:26:29 +01:00
Alex Ford	c4baf0b8fa	Ruby: add space for test case	2022-10-09 22:16:23 +01:00
Nick Rolfe	a6674a5313	Ruby: fix uses of deprecated class name	2022-10-07 13:17:05 +01:00
Tom Hvitved	b065d2d3ab	Merge pull request #10705 from hvitved/ruby/singleton-overrides ... Ruby: Take overrides into account for singleton methods defined on modules	2022-10-07 13:33:59 +02:00
erik-krogh	a0725fba71	fix some more style-guide violations in the alert-messages	2022-10-07 12:01:03 +02:00
Harry Maclean	75cb0efecb	Merge pull request #10538 from hmac/hmac/actioncontroller-parameters ... Ruby: Model flow through ActionController::Parameters	2022-10-07 22:21:40 +13:00
Tom Hvitved	48bdf13c89	Ruby: Take overrides into account for singleton methods defined on modules	2022-10-06 11:56:26 +02:00
Tom Hvitved	7608276397	Ruby: Add more call graph tests	2022-10-06 10:38:02 +02:00
Tom Hvitved	0e6735b804	Merge pull request #10691 from hvitved/dataflow/conjunctive-clears ... Data flow: Take conjunctive `With(out)Contents` into account in `prohibitsUseUseFlow`	2022-10-06 09:03:30 +02:00
Asger F	387e57546b	Merge pull request #10650 from asgerf/rb/summarize-more ... Ruby: more type-tracking steps	2022-10-05 19:16:56 +02:00
Asger F	decd4c93c7	Ruby: update type tracking test	2022-10-05 15:15:52 +02:00
Arthur Baars	6509c19aad	Merge pull request #10692 from aibaars/fix-splats ... Ruby: fix CFG and toString for anonymous '*' and '**'	2022-10-05 13:25:29 +02:00
Tom Hvitved	e51c20bfc7	Data flow: Take conjunctive With(out)Contents into account in prohibitsUseUseFlow	2022-10-05 12:58:29 +02:00
Arthur Baars	a080f498be	Ruby: fix CFG and toString for anonymous '*' and '**'	2022-10-05 11:50:37 +02:00
Tom Hvitved	9d23742ed6	Ruby: Add test that illustrates issue with conjunctive WithoutContents	2022-10-05 11:26:23 +02:00
Asger F	f664a77a02	Ruby: ensure Hash flow works again	2022-10-05 11:07:55 +02:00
Arthur Baars	4ff85d5275	Ruby: add test case	2022-10-05 10:57:53 +02:00
Nick Rolfe	525fe12671	Merge pull request #10585 from github/nickrolfe/libxml-xxe ... Ruby: detect uses of LibXML with entity substitution enabled by default	2022-10-05 09:51:39 +01:00
Asger F	6f74a52542	Merge branch 'main' into rb/summarize-more	2022-10-05 09:55:23 +02:00
Asger F	8b7ec20573	Merge branch 'main' into rb/summarize-more	2022-10-05 09:43:52 +02:00
Tom Hvitved	1496c4f0e2	Merge pull request #10686 from hvitved/ruby/remove-value-pair-content ... Ruby: Remove `PairValueContent`	2022-10-05 09:41:14 +02:00
Arthur Baars	c1c16e44ee	Merge pull request #10559 from aibaars/cve-2019-3881 ... Ruby: some improvements	2022-10-04 21:24:14 +02:00
Tom Hvitved	aae9a58ca3	Ruby: Remove ValuePairContent	2022-10-04 20:10:51 +02:00
Nick Rolfe	d69a658e06	Merge pull request #10673 from github/nickrolfe/no_abstract ... Ruby: remove public abstract classes for Action{View,Controller}	2022-10-04 17:49:59 +01:00
Nick Rolfe	227100d883	Ruby: make old class names available as deprecated aliases	2022-10-04 16:11:43 +01:00
erik-krogh	dedbe66619	update expected output	2022-10-04 14:16:07 +02:00
erik-krogh	bf74481f65	add a link to the source in the alert-message for rb/kernel-open	2022-10-04 13:41:50 +02:00
Tom Hvitved	9d7d6c29f9	Review comments	2022-10-04 12:58:50 +02:00
Tom Hvitved	77c47bc856	Ruby: Add another call graph test	2022-10-04 12:58:49 +02:00