Asger F
6b2ebcce3a
Merge pull request #10276 from asgerf/mad-typedef-entry-points
...
Add TypeModel hook for adding MaD type-defs from CodeQL
2022-09-07 14:14:48 +02:00
erik-krogh
79a048968e
make the alert messages of taint-tracking queries more consistent
2022-09-07 12:22:50 +02:00
Rasmus Wriedt Larsen
a9e1e72196
Merge branch 'main' into shared-http-client-request
2022-09-06 10:52:27 +02:00
Tom Hvitved
b197eff23e
Ruby: Add missing edges to the call graph for singleton methods
2022-09-05 14:11:04 +02:00
Tom Hvitved
ab22f932a5
Ruby: Add more tests for singleton methods
2022-09-05 14:09:59 +02:00
Asger F
62383fb3c9
Ruby: add TypeModel hook for adding type-defs from CodeQL
2022-09-03 13:51:02 +02:00
Asger F
55fdf84d15
Ruby+JS: change LabelEntryPoint.toString()
...
fixup Ruby entry point tests
2022-09-03 13:24:45 +02:00
Asger F
c9ba6f171b
Ruby: rename EntryPoint.getAUse,getARhs -> getASource,getASink
2022-09-03 13:13:32 +02:00
Harry Maclean
6fff02817d
Ruby: Fix bug in disablesCertificateValidation
2022-09-02 13:15:02 +12:00
Harry Maclean
570a03a08f
Ruby: Test disablesCertificateValidation
2022-09-02 13:00:29 +12:00
Tom Hvitved
4d485163a6
Ruby: Exclude top-level self accesses from trackModule
2022-09-01 11:05:53 +02:00
erik-krogh
7fd426e748
print a correct range for ranges that doesn't contain any alpha-numeric chars
2022-08-30 13:57:11 +02:00
Harry Maclean
aa6edb0edb
Ruby: Model ActiveResource
2022-08-29 14:24:37 +12:00
Nick Rolfe
898689f550
Merge pull request #9896 from github/nickrolfe/hardcoded_code
...
Ruby: port js/hardcoded-data-interpreted-as-code
2022-08-26 13:49:25 +01:00
Nick Rolfe
95bf18fdc9
Ruby: make hex-escaped strings ("\xCD\xEF" etc.) sources of hardcoded data
2022-08-26 09:33:03 +01:00
Arthur Baars
f77c2ac3d0
Update tests
2022-08-25 17:40:52 +02:00
Arthur Baars
59773eb743
Ruby: update tree-sitter grammar
2022-08-25 17:21:29 +02:00
Nick Rolfe
acf5b11139
Merge remote-tracking branch 'origin/main' into nickrolfe/hardcoded_code
2022-08-25 11:44:55 +01:00
erik-krogh
1c0f2251e2
Merge branch 'main' into msgConsis
2022-08-24 14:38:57 +02:00
erik-krogh
94ec0b8a52
update expected output of tests
2022-08-23 07:19:37 +02:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
Rasmus Wriedt Larsen
61bf2154cd
Merge branch 'main' into shared-http-client-request
2022-08-22 12:05:37 +02:00
Chris Smowton
8d20b9cf52
Use hasLocationInfo to match several Location fields at once
2022-08-19 19:03:17 +01:00
Chris Smowton
1ea7caf559
Fix join ordering in inline-expectations test
2022-08-19 18:17:22 +01:00
Rasmus Wriedt Larsen
10968bf115
Ruby: Fix alert-msg logic for RequestWithoutValidation.ql
...
This really surprised me, but as shown on the results, it does actually
make a difference in the alert-message.
2022-08-19 15:50:09 +02:00
Rasmus Wriedt Larsen
0ac3624342
Ruby: Implement new disablesCertificateValidation for all HTTP client models
...
Sadly most alert text changed, but the two important changes are:
1. The request on RestClient.rb:19 now has an expanded alert text,
highlighting where the origin of the value that disables certificate
validation comes from. (in this case, it's trivial since it's the
line right above)
2. We handle passing `false`/`OpenSSL::SSL::VERIFY_NONE` the same in the
argument passing examples in Faraday.rb
2022-08-19 15:46:22 +02:00
Rasmus Wriedt Larsen
1f028ac206
Ruby: Implement new disablesCertificateValidation for RestClient
2022-08-19 15:43:19 +02:00
Rasmus Wriedt Larsen
07d95918f2
Ruby: Add more RequestWithoutValidation.ql tests
...
Added:
- one where the value is not directly used when disabling certificate
validation.
- one with argument passing, Faraday, where it is only the passing of
`OpenSSL::SSL::VERIFY_NONE` that is recognized.
2022-08-19 15:42:50 +02:00
Rasmus Wriedt Larsen
47c9c5bddd
Ruby: Update RequestWithoutValidation.ql to match Python version
...
No library modeling currently has support for the new disablesCertificateValidation/2, so only the alert text has changed
(removed an import from Python so the queries would ACTUALLY match)
2022-08-18 14:32:41 +02:00
Rasmus Wriedt Larsen
4a82025087
Ruby: Base HTTP::Client::Request on shared concept
...
Fixing up deprecation errors in next commit
2022-08-18 13:42:53 +02:00
Rasmus Wriedt Larsen
9d96b73b8b
Ruby: Fixup test annotation
2022-08-18 13:42:49 +02:00
Tom Hvitved
08a5b5dc73
Merge pull request #10089 from hvitved/ruby/local-source-nodes
...
Ruby: Reduce size of `isLocalSourceNode`
2022-08-18 12:02:35 +02:00
Nick Rolfe
a46e2b3f2f
Merge pull request #10056 from hmac/hmac/action-controller-response-body
...
Ruby: Recognise Rails render calls as HTTP responses
2022-08-18 10:02:17 +01:00
Harry Maclean
70ec70940a
Merge pull request #8142 from github/hmac/incomplete-multi-char-sanitization
2022-08-18 10:02:39 +12:00
Tom Hvitved
ed2ec1acc0
Ruby: Reduce size of isLocalSourceNode
2022-08-17 17:19:30 +02:00
Alex Ford
d4d6657cb7
Merge pull request #10008 from alexrford/rb/log-injection
...
Ruby: Add `rb/log-injection` query
2022-08-17 15:01:22 +01:00
Nick Rolfe
94a51142d0
Ruby: fix typo in internal predicate name
2022-08-17 11:05:39 +01:00
Harry Maclean
f1a546c4d6
Rename IncompleteMultiCharacterSanitization[Query]
2022-08-17 16:03:49 +12:00
Harry Maclean
f2384a6a8f
Ruby: Share more code with JS
2022-08-17 16:03:49 +12:00
Harry Maclean
025e34d8e1
Ruby: Simplify imports
2022-08-17 16:03:48 +12:00
Harry Maclean
b7d9bf4066
Share IncompleteMultiCharacterSanitization JS/Ruby
...
Most of the classes and predicates in this query can be shared between
the two languages. There's just a few language-specific things that we
place in IncompleteMultiCharacterSanitizationSpecific.
2022-08-17 16:03:46 +12:00
Harry Maclean
c234bd94d1
Ruby: IncompleteMultiCharacterSanitization Query
...
This query is similar to IncompleteSanitization but for multi-character
sequences.
2022-08-17 16:02:48 +12:00
Tom Hvitved
aa93986d1a
Ruby: Add tests that demonstrate missing flow through positional arguments
2022-08-16 10:36:40 +02:00
Erik Krogh Kristensen
f106e064fa
Merge pull request #9422 from erik-krogh/refacReDoS
...
Refactorizations of the ReDoS libraries
2022-08-16 09:32:08 +02:00
Harry Maclean
7ef6ffbc54
Ruby: Recognise Rails render calls as HTTP responses
2022-08-16 14:03:26 +12:00
Erik Krogh Kristensen
0adb588fe8
Merge pull request #9712 from erik-krogh/badRange
...
JS/RB/PY/Java: add suspicious range query
2022-08-15 13:55:44 +02:00
erik-krogh
b54f037424
Merge branch 'main' into refacReDoS
2022-08-12 20:28:30 +02:00
Alex Ford
44c4b9ba5c
Ruby: add rb/log-injection test cases
2022-08-10 16:17:37 +01:00
Tom Hvitved
19043bdf38
Merge pull request #9976 from hvitved/ruby/hash-literal-summary-simplification
...
Ruby: Simplify flow summaries for hash literals
2022-08-10 08:57:33 +02:00
