Harry Maclean
|
e419fc9599
|
Make Code execution query more specific
Only the first argument to eval, instance_eval, send, class_send and
module_send is interpreted as Ruby code.
|
2021-10-05 10:28:34 +01:00 |
|
Harry Maclean
|
95e50cedad
|
Add query for Code Injection
This query finds cases where user input flows to an argument to `eval`
or `send`, which can execute arbitrary Ruby code.
|
2021-09-20 11:35:45 +01:00 |
|
Harry Maclean
|
d046fb0591
|
Separate open3 pipeline methods
These have a slightly different structure than the other open3 methods.
|
2021-09-17 17:02:17 +01:00 |
|
Harry Maclean
|
fb23a2e3bf
|
Add SubshellHeredocExecution
This is a form of command execution:
result = <<`EOF`
echo foo bar #{baz}
EOF
|
2021-09-17 17:02:17 +01:00 |
|
Harry Maclean
|
a8f0bce1d1
|
Add SystemCommandExecution concept
A SystemCommandExecution is a method call or builtin that executes a
system command, either directly or via a subshell.
|
2021-09-17 17:02:17 +01:00 |
|