Asger F
6e1914ad01
Merge pull request #10375 from asgerf/rb/summarize-loads-v2
...
Ruby: type-tracking and API edges through simple library callables
2022-09-30 14:25:17 +02:00
Nick Rolfe
ef8ec0878a
Merge pull request #10641 from github/nickrolfe/a_an
...
JS/Python/Ruby: s/a HTML/an HTML/
2022-09-30 12:17:15 +01:00
Nick Rolfe
ed74e0aad1
JS/Python/Ruby: s/a HTML/an HTML/
2022-09-30 10:37:52 +01:00
Michael Nebel
82294c1349
Merge pull request #10622 from michaelnebel/ruby/postupdateassignexpr
...
Ruby: Postupdate notes for assignment expressions.
2022-09-30 10:00:02 +02:00
Harry Maclean
4a39bc8f47
Merge pull request #10598 from hmac/hmac/actioncontroller-metal
...
Ruby: Identify ActionController::Metal controllers
2022-09-30 13:07:03 +13:00
Asger F
ae60b0ae6d
Ruby: ensure pruning works with startInContent
2022-09-29 15:54:51 +02:00
Michael Nebel
dd0f19d0b0
Ruby: Update expected test output.
2022-09-29 14:12:20 +02:00
Michael Nebel
af4db77046
Ruby: Update expected test output.
2022-09-29 13:54:59 +02:00
Michael Nebel
9ee831a378
Ruby: Add (failing) test case for flow out via assignment expression.
2022-09-29 13:54:32 +02:00
Asger F
dc03557aea
Merge branch 'main' into rb/summarize-loads-v2
2022-09-29 12:07:30 +02:00
Tom Hvitved
e9b96c19b8
Ruby: Account for protected methods in call graph
2022-09-29 11:58:04 +02:00
Asger F
296c0a7925
Merge pull request #10603 from asgerf/type-model-api-node
...
Add TypeModel.getAnApiNode
2022-09-29 11:39:09 +02:00
Tom Hvitved
58b7556bdf
Ruby: Add call graph tests for protected methods
2022-09-29 11:37:35 +02:00
Harry Maclean
4217a50900
Treat ActiveRecord.create as a model instantiation
2022-09-29 09:24:42 +13:00
Harry Maclean
424f31a24a
Add test for AR Model.create instantiations
...
These currently aren't recognised.
2022-09-29 09:24:42 +13:00
Harry Maclean
63309150e0
Make some space
2022-09-29 09:24:37 +13:00
Harry Maclean
e7d19e849f
Merge pull request #10090 from hmac/hmac/activestorage
...
Ruby: Model Activestorage
2022-09-29 09:16:25 +13:00
Harry Maclean
0ce0ada4df
Merge pull request #10002 from hmac/hmac/protected-methods
...
Ruby: Model protected methods
2022-09-29 08:39:29 +13:00
Asger F
65de5d014c
Ruby: add test case
2022-09-28 12:23:58 +02:00
Asger F
a48b893ed6
Merge pull request #10588 from asgerf/rb/rbi-instantiated-type
...
Ruby: add RbiInstantiatedType
2022-09-28 11:51:20 +02:00
Asger F
fea47c85f3
Ruby: expand on type-tracking test a bit
2022-09-28 11:40:55 +02:00
Asger F
971657245d
Ruby: update API graph inline test to match output
2022-09-28 11:17:13 +02:00
Asger F
ce1c258273
Ruby: Update TypeTracker.expected
2022-09-28 11:15:25 +02:00
Asger F
ee7dea1ab6
Merge branch 'main' into rb/summarize-loads-v2
...
This only fixes superficial conflicts with
https://github.com/github/codeql/pull/10574
semantic conflicts will be addressed in later commits
2022-09-28 11:11:44 +02:00
Asger F
14e384aaa2
Ruby: remove unneeded import
2022-09-28 10:49:34 +02:00
Asger F
85d0c63ec7
Ruby: store a ContentSet on type tracker instances
2022-09-28 10:49:34 +02:00
Asger F
a5ed3d791b
Ruby: expand test case to reveal mismatching forward/backward flow
2022-09-28 10:49:34 +02:00
Asger F
a51a540582
Ruby: add content edges to API graph
...
Fixes
2022-09-28 10:49:33 +02:00
Asger F
cd9cddf45a
Ruby: generate type-tracking steps from simple summary specs
2022-09-28 10:49:33 +02:00
Harry Maclean
24a10aa5ff
Recognise send_file as a FileSystemAccess
...
This method is available in ActionController actions, and sends the file
at the given path to the client.
2022-09-28 12:14:22 +13:00
Tom Hvitved
31806b84ba
Ruby: Add more flow summaries tests
...
The tests highlight the differences between `(With|Without)?Element[1]` and
`(With|Without)?Element[1!]`.
2022-09-27 20:16:31 +02:00
Tom Hvitved
2351c0288a
Ruby: Fix spurious flow through reverse stores
2022-09-27 20:16:31 +02:00
Harry Maclean
28a23209a5
Ruby: Identify ActionController::Metal controllers
...
Subclasses of `ActionController::Metal` are stripped-down controllers.
We want to recognise them as ActionController controllers.
There are some common ActionController methods that are not available in
Metal, but these are not likely to be used anyway as they would throw an
exception, so I don't think there's much harm in including them in the
modelling.
2022-09-28 07:10:09 +13:00
Tom Hvitved
fea1e47daa
Ruby: Add data-flow test for spurious flow through a reverse store
2022-09-27 20:05:35 +02:00
Asger F
52b6dd5bec
Ruby: update test expectation
2022-09-27 14:41:59 +02:00
Nick Rolfe
bfda08e69c
Ruby: detect uses of libxml with entity substitution enabled by default
...
Including uses of ActiveSupport::XmlMini with the libxml backend
2022-09-27 11:53:43 +01:00
Nick Rolfe
7c30d333ad
Ruby: move XXE tests to subdirectory
2022-09-27 11:53:43 +01:00
Harry Maclean
49572a5218
Remove redundant import
2022-09-27 10:35:39 +13:00
Harry Maclean
5cdaae7378
Update tests
2022-09-27 10:29:04 +13:00
Harry Maclean
4df7fd248e
Ruby: Ensure explicit modifiers take priority
...
In Ruby, "explicit" visibility modifiers override "implicit" ones. For
example, in the following:
```rb
class C
private
def m1
end
public m2
end
def m3
end
public :m3
end
```
`m1` is private whereas `m2` and `m3` are public.
2022-09-27 10:28:23 +13:00
Harry Maclean
bda4cfbe5d
Ruby: Update test
2022-09-27 10:22:53 +13:00
Harry Maclean
5e9196e51c
Ruby: Add test for protected methods
2022-09-27 10:21:04 +13:00
Harry Maclean
494fb4c966
Ruby: Make room for new test cases
2022-09-27 10:18:43 +13:00
Harry Maclean
1d728b234f
Ruby: Add test for protected method visibility
2022-09-27 10:16:09 +13:00
Harry Maclean
c5f36613da
Ruby: Refactor method visibility modeling
2022-09-27 10:13:21 +13:00
Harry Maclean
3beed54e35
Ruby: Fix imports in test
2022-09-27 10:09:26 +13:00
Harry Maclean
dea5036912
Ruby: Update for Http concept changes
2022-09-27 10:03:17 +13:00
Tom Hvitved
88baf0883a
Merge pull request #10358 from hvitved/ruby/dataflow/call-ctx
...
Ruby: Context sensitive instance method resolution
2022-09-26 19:55:10 +02:00
Alex Ford
b018706afd
Ruby: update rb/unsafe-deserialization tests
2022-09-26 11:28:24 +01:00
Tom Hvitved
257bcefaf9
Merge pull request #10548 from hvitved/ruby/call-graph-tests
...
Ruby: Add call graph tests for unsupported constructs
2022-09-26 10:47:23 +02:00
