Arthur Baars
fad73d71e5
Merge pull request #13307 from hmac/amammad-ruby-YAMLunsafeLoad
...
Ruby: Add YAML unsafe deserialization sinks
2023-06-12 10:43:37 +02:00
Alex Ford
22b9ab43c6
Merge pull request #13259 from alexrford/rb/actiondispatch-refactor
...
Ruby: Refactor and slightly expand `ActionDispatch` modelling
2023-06-08 11:08:36 +01:00
Tom Hvitved
cee70883f0
Merge pull request #12964 from hvitved/ruby/remove-synth-returns
...
Ruby: Remove canonical return nodes
2023-06-08 10:07:48 +02:00
Arthur Baars
7324d1705e
Merge branch 'main' into amammad-ruby-YAMLunsafeLoad
2023-06-06 12:09:06 +02:00
Alex Ford
c95cf5ad6f
Merge pull request #13062 from maikypedia/maikypedia/sqli-sink
...
Ruby: Add MySQL as SQL Injection Sink
2023-06-02 17:06:35 +01:00
Erik Krogh Kristensen
219ec9d05d
Merge pull request #13127 from erik-krogh/polReDoS
...
ReDoS: revert new superlinear algorithm.
2023-06-02 16:10:24 +02:00
Jeroen Ketema
5f64354a70
Merge pull request #13353 from jketema/expecation
...
Fix typo in spelling of expectation
2023-06-02 12:29:49 +02:00
Jeroen Ketema
7b17b92aca
Fix typo in spelling of expectation
2023-06-02 10:36:11 +02:00
Alex Ford
6fa9e13a2e
Ruby: update TaintStep output
2023-06-01 16:27:20 +01:00
Alex Ford
d09f6d318c
Merge branch 'main' into maikypedia/sqli-sink
2023-06-01 15:02:44 +01:00
Alex Ford
7d943c7621
Ruby: update test output
2023-06-01 13:50:32 +01:00
Alex Ford
4794066d3c
Merge branch 'main' into maikypedia/sqli-sink-2
2023-06-01 13:04:54 +01:00
Harry Maclean
b8c3cba4ff
Ruby: Consolidate unsafe deserialization queries
...
Merge the experimental YAMLUnsafeDeserialization and
PlistUnsafeDeserialization queries into the generate
UnsafeDeserialization query in the default suite.
These queries look for some specific sinks that we now find in the
general query.
Also apply some small code and comment refactors.
2023-05-27 01:20:04 +00:00
amammad
b9296d3df8
v2.1 fix file names
2023-05-27 01:14:36 +00:00
amammad
4360a56b45
v2 add plist.parse_xml as a dangerous sink and enhancements on documents
2023-05-27 01:14:36 +00:00
amammad
0521ffe175
v1.4 correct dirs uppercase issue
2023-05-27 01:14:36 +00:00
amammad
0e343e5a12
v1.3
2023-05-27 01:14:36 +00:00
amammad
486a5ac96f
v1
2023-05-27 01:14:36 +00:00
Arthur Baars
e0466900ad
Merge pull request #12992 from Sim4n6/ruby-UBV
...
[Ruby] Add Unicode Bypass Validation query, test and help file
2023-05-26 13:00:21 +02:00
Alex Ford
baabd2d1fa
Merge pull request #12832 from maikypedia/maikypedia/pg-sqli
...
Ruby: Add SQL Injection Sinks
2023-05-26 11:36:17 +01:00
Alex Ford
609319da20
ruby: update TaintStep.ql test output
2023-05-25 17:53:01 +01:00
Tom Hvitved
13ada1e6ad
Ruby: Remove canonical return nodes
2023-05-24 11:11:50 +02:00
Asger F
6d1a4451fb
Ruby: update a test expectation
2023-05-24 10:15:51 +02:00
Maiky
8dca585207
Expected
2023-05-23 20:04:34 +02:00
Maiky
ad5355a04a
Pg Library, change note and Frameworks.qll
2023-05-23 19:49:03 +02:00
Sim4n6
90c174de4e
Updated the .expected file accordingly
2023-05-23 17:36:50 +01:00
Alex Ford
9f5c73cf63
Ruby: add a test case for instantiating ActionDispatch::Request directly
2023-05-23 15:18:32 +01:00
Alex Ford
1c9e4c0f0b
Ruby: test for RequestInputAccess instances in ActionDispatch
2023-05-23 15:17:38 +01:00
erik-krogh
c7e21ee9ae
add really long regex as a test-case
2023-05-23 09:56:06 +02:00
Sim4n6
f7f0564e36
added one more test
2023-05-20 18:00:27 +01:00
Sim4n6
d11cb9195c
Use of CGI.escapeHTML() in test samples
2023-05-20 12:57:50 +01:00
Tom Hvitved
826b6219a0
Ruby: Include self parameters in type tracking flow-through logic
2023-05-15 16:02:33 +02:00
Tom Hvitved
3cdb27725a
Ruby: Add more call graph tests
2023-05-15 16:02:33 +02:00
Kasper Svendsen
e6ca3fe272
Ruby: Enable implicit this warnings
2023-05-10 13:03:39 +02:00
Kasper Svendsen
6b8a7c2f6f
Ruby: Make implicit this receivers explicit
2023-05-10 13:03:39 +02:00
Tom Hvitved
2f95af8ef2
Ruby: Remove self edges
2023-05-08 10:26:01 +02:00
Maiky
3960853af0
CWE-089 Add Sequel SQL Injection Sink
2023-05-07 23:56:56 +02:00
Maiky
6a3d995b35
Add Mysql2 as SQL Injection Sink
2023-05-06 12:25:25 +02:00
Mathias Vorreiter Pedersen
09ba9a74ce
Merge pull request #12959 from MathiasVP/identity-consistency-check
...
DataFlow: Add an "identity-step" consistency check
2023-05-05 10:03:20 +01:00
Sim4n6
1247403d43
Updated expected results file
2023-05-04 08:56:45 +01:00
Mathias Vorreiter Pedersen
77001a070b
Merge branch 'main' into identity-consistency-check
2023-05-03 22:01:06 +01:00
Mathias Vorreiter Pedersen
924854c6dc
Ruby: Accept consistency changes.
2023-05-03 20:32:33 +01:00
Alex Ford
e7213e92cf
Merge remote-tracking branch 'origin/main' into rb/sqlite3
2023-05-03 15:18:07 +01:00
Alex Ford
6e6eee2dab
Ruby: add test case for instance variable flow with sqlite3
2023-05-03 15:16:16 +01:00
Alex Ford
82c025020d
Merge remote-tracking branch 'origin/main' into maikypedia/ruby-ssti
2023-05-02 16:18:41 +01:00
Alex Ford
a571bc64ac
ruby: regenerate TemplateInjection.expected
2023-05-02 16:14:20 +01:00
Sim4n6
019b85beb6
Add Unicode Bypass Validation query, test and help file
2023-05-02 15:36:39 +01:00
Maiky
5d15ec99c8
Change expected file to new
2023-05-02 09:26:41 +02:00
Anders Schack-Mulligen
09d4fe21e8
Ruby: Update more expected output.
2023-04-26 13:37:07 +02:00
Anders Schack-Mulligen
90f84bb516
Ruby: Update expected output.
2023-04-26 13:08:16 +02:00
