Alex Ford
fa58c51810
Ruby: switch rb/sensitive-get-query back to using local flow
2022-10-05 15:58:05 +01:00
Asger F
decd4c93c7
Ruby: update type tracking test
2022-10-05 15:15:52 +02:00
Alex Ford
f01670f663
Ruby: add a note to a test case
2022-10-05 13:06:49 +01:00
Alex Ford
d64f8c73be
Merge branch 'main' into rb/sensitive-get-query
2022-10-05 12:59:35 +01:00
Alex Ford
977e8a8a6f
Ruby: add a test case for sensitive data from cookies for rb/sensitive-get-query (should not be flagged)
2022-10-05 12:57:07 +01:00
Arthur Baars
6509c19aad
Merge pull request #10692 from aibaars/fix-splats
...
Ruby: fix CFG and toString for anonymous '*' and '**'
2022-10-05 13:25:29 +02:00
Alex Ford
880fb2b14a
Ruby: split out rb/sensitive-get-query using query/customizations pattern
2022-10-05 11:59:40 +01:00
Tom Hvitved
e51c20bfc7
Data flow: Take conjunctive With(out)Contents into account in prohibitsUseUseFlow
2022-10-05 12:58:29 +02:00
Arthur Baars
a080f498be
Ruby: fix CFG and toString for anonymous '*' and '**'
2022-10-05 11:50:37 +02:00
Tom Hvitved
9d23742ed6
Ruby: Add test that illustrates issue with conjunctive WithoutContents
2022-10-05 11:26:23 +02:00
Asger F
f664a77a02
Ruby: ensure Hash flow works again
2022-10-05 11:07:55 +02:00
Arthur Baars
4ff85d5275
Ruby: add test case
2022-10-05 10:57:53 +02:00
Nick Rolfe
525fe12671
Merge pull request #10585 from github/nickrolfe/libxml-xxe
...
Ruby: detect uses of LibXML with entity substitution enabled by default
2022-10-05 09:51:39 +01:00
Asger F
6f74a52542
Merge branch 'main' into rb/summarize-more
2022-10-05 09:55:23 +02:00
Asger F
8b7ec20573
Merge branch 'main' into rb/summarize-more
2022-10-05 09:43:52 +02:00
Tom Hvitved
1496c4f0e2
Merge pull request #10686 from hvitved/ruby/remove-value-pair-content
...
Ruby: Remove `PairValueContent`
2022-10-05 09:41:14 +02:00
Arthur Baars
c1c16e44ee
Merge pull request #10559 from aibaars/cve-2019-3881
...
Ruby: some improvements
2022-10-04 21:24:14 +02:00
Tom Hvitved
aae9a58ca3
Ruby: Remove ValuePairContent
2022-10-04 20:10:51 +02:00
Nick Rolfe
d69a658e06
Merge pull request #10673 from github/nickrolfe/no_abstract
...
Ruby: remove public abstract classes for Action{View,Controller}
2022-10-04 17:49:59 +01:00
Nick Rolfe
227100d883
Ruby: make old class names available as deprecated aliases
2022-10-04 16:11:43 +01:00
Alex Ford
703829c647
Ruby: use taint tracking for rb/sensitive-get-query
2022-10-04 15:04:41 +01:00
erik-krogh
dedbe66619
update expected output
2022-10-04 14:16:07 +02:00
erik-krogh
bf74481f65
add a link to the source in the alert-message for rb/kernel-open
2022-10-04 13:41:50 +02:00
Tom Hvitved
9d7d6c29f9
Review comments
2022-10-04 12:58:50 +02:00
Tom Hvitved
77c47bc856
Ruby: Add another call graph test
2022-10-04 12:58:49 +02:00
Arthur Baars
44cc6f7350
Ruby: improve tracking of regular expressions
...
There are two flavours of `match?`. If the receiver of `match?` has type String
then the argument to `match?` is a regular expression. However, if the receiver of
`match?` has type Regexp then the argument is the text.
The role of receiver and argument flips depending on the type of the receiver, this
caused a lot of false positives when looking for string-like literals that are
used as a regular expression.
This commit attempts to improve things by trying to determine whether the type of the
receiver is known to be of type Regexp. In such cases we know that the argument
is unlikely to be regular expression.
2022-10-04 12:58:49 +02:00
Arthur Baars
0160c374e4
Ruby: add flow summaries for Object#dup and Kernel#tap
2022-10-04 12:58:49 +02:00
Arthur Baars
c2b98a4761
Ruby: add support for 'extend' method
2022-10-04 12:58:49 +02:00
Arthur Baars
09bc78eafc
Ruby: local dataflow step for || and &&
2022-10-04 12:58:49 +02:00
Arthur Baars
e95b5468d9
Ruby: use Dataflow for Pathname instead of TypeTracking
2022-10-04 12:58:49 +02:00
Nick Rolfe
a738f1d5cf
Ruby: remove public abstract classes for Action{View,Controller}
2022-10-04 10:53:41 +01:00
Asger F
948594043d
Ruby: share type-tracking test with array test
2022-10-04 11:15:13 +02:00
Asger F
b6231e82ec
Ruby: do not treat WithoutElement[0..!] as a type filter
2022-10-04 11:14:31 +02:00
Asger F
6e7aea85ef
Ruby: update benign test output
...
API graph tests only report the shortest path, and a new shortest path has appeared, but the old path is still there, so this is not a regression.
2022-10-04 11:14:31 +02:00
Asger F
00e52ad109
Ruby: add type-tracking variant of hash-flow test
...
Ruby: fixup type-tracking hash flow test
Fixup! type-tracking hash flow test result
2022-10-04 11:14:30 +02:00
Asger F
c06743afb5
Ruby: update benign test updates
2022-10-04 11:08:46 +02:00
Asger F
f75f27d30e
Ruby: update test
2022-10-04 11:08:46 +02:00
Asger F
1c484d80aa
Ruby: add some calls to .each in call graph test
2022-10-04 11:06:44 +02:00
Asger F
ab672ded6a
Ruby: strip trailing whitespace in calls.rb test
2022-10-04 11:06:44 +02:00
Harry Maclean
42a97b26bb
Merge pull request #10316 from hmac/hmac/actionview
...
Ruby: Model ActionView
2022-10-04 08:16:16 +13:00
Tom Hvitved
d52d3d7b75
Merge pull request #10644 from hvitved/ruby/prevent-reevaluation
...
Ruby: Prevent reevaluation of expensive predicates
2022-10-03 13:10:39 +02:00
Asger F
47e5623b90
Merge pull request #10639 from hvitved/ruby/dataflow/known-element-no-floats-complexs
...
Ruby: Do not attempt to track precise hash indices for floats and complex numbers
2022-10-03 09:23:33 +02:00
Harry Maclean
eaf6eb009b
Update tests
2022-10-03 17:17:58 +13:00
Harry Maclean
a5998fbe4d
Ruby: Model ActionController::Parameters
...
Add flow summaries for methods on ActionController::Parameters,
which mostly propagate taint from receiver to return value.
2022-10-03 09:45:59 +13:00
Harry Maclean
ba83b7c6c7
Merge pull request #10599 from hmac/hmac/actioncontroller-datastreaming
...
Ruby: Model send_file
2022-10-03 09:44:05 +13:00
Alex Ford
5c32c8badf
Merge pull request #10560 from alexrford/ruby/yaml-load_file
...
Ruby: treat `Psych` and `YAML` as aliases for rb/unsafe-deserialization
2022-10-02 20:19:10 +01:00
Tom Hvitved
292bc67125
Merge pull request #10620 from hvitved/ruby/call-graph-protected-methods
...
Ruby: Account for `protected` methods in call graph
2022-09-30 19:31:36 +02:00
Tom Hvitved
dd7458acc8
Ruby: Add more call graph tests for protected methods
2022-09-30 16:24:34 +02:00
Tom Hvitved
3ec43dbd16
Ruby: Do not attempt to track precise hash indices for floats and complex numbers
2022-09-30 14:57:50 +02:00
Tom Hvitved
299339f817
Ruby: Expose relevant predicates from internal/Module.qll and make sure they are cached
2022-09-30 14:56:55 +02:00
