Tom Hvitved
525ed65b0b
Rename getNode to getAstNode
2023-08-03 10:56:50 +02:00
Asger F
59c72836d3
Ruby: fix typo
2023-07-06 14:57:24 +02:00
Asger F
db58d32f7a
Ruby: Add a query ID
2023-07-06 14:57:24 +02:00
Asger F
d123e5ba63
Ruby: add performance diagnostic query
2023-07-06 14:57:24 +02:00
Jeroen Ketema
d82c3ce11a
Ruby: Rewrite InlineFlowTest as a parameterized module
2023-06-15 10:52:23 +02:00
Arthur Baars
7324d1705e
Merge branch 'main' into amammad-ruby-YAMLunsafeLoad
2023-06-06 12:09:06 +02:00
Erik Krogh Kristensen
96a720cfa0
Merge pull request #13285 from erik-krogh/redoshelp
...
ReDoS: fix whitespace in the samples in ReDoS.qhelp
2023-06-01 15:53:58 +02:00
Harry Maclean
e70e3e52dc
Ruby: fix typo in qhelp
2023-05-29 04:05:42 +00:00
Harry Maclean
ca1024e285
Ruby: Reword unsafe deserialization qhelp
2023-05-29 03:46:30 +00:00
Harry Maclean
e515981c81
Ruby: Remove unused examples
2023-05-27 12:01:00 +00:00
Harry Maclean
b8c3cba4ff
Ruby: Consolidate unsafe deserialization queries
...
Merge the experimental YAMLUnsafeDeserialization and
PlistUnsafeDeserialization queries into the generate
UnsafeDeserialization query in the default suite.
These queries look for some specific sinks that we now find in the
general query.
Also apply some small code and comment refactors.
2023-05-27 01:20:04 +00:00
amammad
40e24b6b94
v4.1 fix file names in qhelp
2023-05-27 01:15:29 +00:00
amammad
335441ce04
v4: make variable names camelCase, some inhancement, remove some duplicates
2023-05-27 01:15:29 +00:00
Asger F
1c7f6dc32e
Ruby: add meta-query for calls to summarized callables
2023-05-26 11:34:23 +02:00
erik-krogh
9f5bf8fb22
also fix the first code-block
2023-05-25 13:56:29 +02:00
erik-krogh
765076bcba
fix whitespace in the samples in ReDoS.qhelp
2023-05-25 13:28:39 +02:00
erik-krogh
710b309142
apply suggestions from doc review
2023-05-21 22:18:48 +02:00
erik-krogh
480e71fd69
avoid contractions
2023-05-17 08:42:45 +02:00
erik-krogh
83ca1495e0
trim the whitespace in the poly-redos examples
2023-05-15 16:47:24 +02:00
erik-krogh
d989359656
add another example to the qhelp in poly-redos, showing how to just limit the length of the input
2023-05-15 16:47:02 +02:00
Kasper Svendsen
6b8a7c2f6f
Ruby: Make implicit this receivers explicit
2023-05-10 13:03:39 +02:00
Asger F
f59c149bae
Ruby: add SQL injection sinks to meta query
2023-05-02 10:46:55 +02:00
Peter Stöckli
672cb92fbd
Ruby: improve non-constant-kernel-open, recursive step for freeze
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2023-04-19 10:50:59 +02:00
Peter Stöckli
2f268b309b
Ruby: improve non-constant-kernel-open, freeze called on constant
2023-04-18 11:24:01 +02:00
Peter Stöckli
0a6bb3f7ce
Ruby: improve non-constant-kernel-open, no FP's on open without arguments
2023-04-18 10:10:36 +02:00
Alex Ford
181e5d588d
Merge remote-tracking branch 'origin/rc/3.9' into main
2023-03-27 12:16:03 +01:00
Alex Ford
15c9e7666a
Ruby: convert rb/sensitive-get-query into a @kind problem
2023-03-27 09:42:10 +01:00
Anders Schack-Mulligen
d0b7ffda70
Python/Ruby/Swift: Rename references.
2023-03-23 13:06:19 +01:00
Tom Hvitved
1d0b3d4112
Ruby: Ssa::WriteDefinition::getWriteAccess should return a CFG node
2023-03-16 11:28:24 +01:00
Anders Schack-Mulligen
a5d229903d
Ruby: Autoformat
2023-03-10 09:41:20 +01:00
Tom Hvitved
b6a709df50
Ruby: Rewrite Stored XSS query to use new data flow interface
2023-03-07 07:23:27 +01:00
Erik Krogh Kristensen
2f404df17c
Merge pull request #10782 from erik-krogh/rbPoly
...
Ruby: add library input as a source for `rb/polynomial-redos`
2023-02-13 12:26:07 +01:00
erik-krogh
634087b417
Merge branch 'main' into rbPoly
2023-02-13 10:46:00 +01:00
erik-krogh
eb564760be
improve qhelp based on doc review
2023-02-08 11:00:54 +01:00
erik-krogh
3545bb0819
adjust qhelp based on review
2023-02-03 10:50:18 +01:00
erik-krogh
e01002368f
add query detecting validators that use badly anchored regular expressions on library/remote input
2023-01-30 16:34:20 +01:00
erik-krogh
54b0350cac
add note in ReDoS qhelp that Ruby 3.2 has fixed ReDoS
2023-01-25 10:24:11 +01:00
erik-krogh
a017b7500b
Merge branch 'main' into rbPoly
2023-01-24 20:51:36 +01:00
Erik Krogh Kristensen
32c4cf5769
Apply suggestions from code review
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-01-23 14:58:04 +01:00
erik-krogh
8251ad5e99
add unsafe-html-construction query
2023-01-17 15:35:17 +01:00
Erik Krogh Kristensen
59a8b21851
Merge pull request #10862 from erik-krogh/unsafeCodeConstruction
...
Rb: Add an `unsafe-code-construction` query
2023-01-16 13:22:58 +01:00
Tony Torralba
c9d1cd97fb
Ruby: Remove omittable exists variables
2023-01-10 13:39:49 +01:00
Erik Krogh Kristensen
f2658a0936
apply suggestions from doc review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2023-01-10 12:56:22 +01:00
erik-krogh
0e6028a7f3
add stdin as source for unsafe-deserialization
2023-01-06 09:04:36 +01:00
Erik Krogh Kristensen
d9176541c6
Apply suggestions from code review
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-01-05 20:02:54 +01:00
erik-krogh
3811eae679
simplify the qhelp for unsafe-code-construction
...
The `send()` example is not flagged by any current query, so it was weird talking about it as "vulnerable".
2023-01-02 13:33:56 +01:00
erik-krogh
3815a5a096
fix qhelp syntax
2023-01-02 10:19:05 +01:00
Harry Maclean
a6571a05ab
Ruby: Include send example in qhelp
2022-12-28 11:34:55 +13:00
Harry Maclean
d3812f5906
Ruby: Add another code injection example to qhelp
2022-12-28 11:20:56 +13:00
Erik Krogh Kristensen
f136651384
Merge pull request #11575 from erik-krogh/kernelLoad
...
Rb: add Kernel methods as sinks to path-injection
2022-12-19 15:09:21 +01:00
