6 Commits

Author	SHA1	Message	Date
erik-krogh	f09e3bd3ac	add String#% as a printf like call	2022-10-17 13:51:43 +02:00
erik-krogh	063c76b6d1	apply suggestions from review	2022-09-13 10:52:23 +02:00
erik-krogh	79a048968e	make the alert messages of taint-tracking queries more consistent	2022-09-07 12:22:50 +02:00
Harry Maclean	5a6da827d0	Ruby: Avoid FP in TaintedFormatString query ... Kernel#printf supports two call signatures: printf(String, *args) printf(IO, String, *args) We want to identify the String argument, which is the format string. Previously we would return the 0th and 1st arguments, which gives some FPs when the 1st arg is not a format string. We now try to rule out the trivial case by checking if arg 0 has a string value, and then assuming it is the format string. Otherwise we fall back to returning both arguments. This still has some false positive potential, but less than previously.	2022-03-21 12:51:47 +13:00
Harry Maclean	4249e30824	Ruby: Test tainted interpolated format arg	2022-03-21 12:51:18 +13:00
Harry Maclean	f6215d4c7e	Ruby: Add rb/tainted-format-string query	2022-03-21 12:51:18 +13:00