Nick Rolfe
348ad95fc0
Ruby: fix defining every dataflow node as a command execution sink
2022-07-11 15:06:27 +01:00
thiggy1342
e8e8da1b31
fix lib test expect for ActionController
2022-07-08 19:01:01 +00:00
thiggy1342
5d3232c614
refactor to use data flow
2022-07-08 18:53:24 +00:00
thiggy1342
96e66c4a50
move tests
2022-07-08 18:39:04 +00:00
thiggy1342
0435105d16
Merge remote-tracking branch 'upstream/main' into experimental-strong-params
2022-07-08 18:36:09 +00:00
thiggy1342
6aab970a9e
refactor query to use cfg and dataflow
2022-07-08 18:32:54 +00:00
thiggy1342
940254d251
update framework tests
2022-07-07 19:39:59 +00:00
thiggy1342
b4869158f2
expand query tests for cwe-089
2022-07-07 19:23:57 +00:00
thiggy1342
2f1cfa816f
Add annotate arguments as sqli sink
2022-07-07 19:23:06 +00:00
Nick Rolfe
02dd933e5f
Ruby: move Pathname from core to stdlib
2022-06-30 10:08:25 +01:00
Nick Rolfe
c1302a90e0
Ruby: use MaD for more precise Pathname flow summaries
2022-06-29 13:16:18 +01:00
Erik Krogh Kristensen
2e295e4a04
filter out potential misparses from rb/suspicious-regexp-range
2022-06-29 13:16:28 +02:00
Erik Krogh Kristensen
a343ceaf8b
add suspicious-regexp-range query
2022-06-28 09:49:27 +02:00
Nick Rolfe
280c959dc8
Merge branch 'main' into nickrolfe/pathname
2022-06-27 11:11:17 +01:00
Harry Maclean
101111bd2f
Merge pull request #9574 from hmac/hmac/action-cable-logger
...
Ruby: More Rails modeling
2022-06-27 19:56:54 +12:00
Asger F
d6fd43fe12
Merge pull request #9364 from asgerf/ruby/api-graph-api
...
Ruby: API graph renaming an documentation
2022-06-27 08:54:24 +02:00
Nick Rolfe
c1515db09c
Ruby: modeling of some file-related concepts for the Pathname class
2022-06-24 14:14:07 +01:00
Nick Rolfe
03d0f66247
Ruby: add flow summaries for Pathname class
2022-06-24 14:14:06 +01:00
thiggy1342
cf36333082
forgot to finish this test
2022-06-24 02:18:48 +00:00
Erik Krogh Kristensen
7fb3d81d2f
add further normalization of char classses
2022-06-23 14:36:25 +02:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
thiggy1342
83b720d730
first draft of weak params query
2022-06-21 19:28:53 +00:00
Asger F
7c877c7861
Ruby: Rename getARhs -> asSink
2022-06-21 12:44:16 +02:00
Asger F
2f8086bb57
Ruby: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:16 +02:00
Anders Schack-Mulligen
736372ffd6
Ruby: Remove test.
2022-06-21 11:18:36 +02:00
thiggy1342
c5bf1b8aab
update test expectation
2022-06-20 17:27:33 +00:00
thiggy1342
973013ff9c
Merge branch 'main' into experimental-decompression-api
2022-06-20 11:37:38 -04:00
thiggy1342
7932d3e4ab
Update ruby/ql/test/query-tests/security/decompression-api/DecompressionApi.expected
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 11:05:56 -04:00
Arthur Baars
c5d3df087d
Update tree-sitter-embeded-template
2022-06-20 17:04:27 +02:00
thiggy1342
b4c893d857
Update ruby/ql/test/query-tests/security/decompression-api/decompression_api.rb
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 09:50:12 -04:00
thiggy1342
2f505c527b
Merge branch 'main' into experimental-decompression-api
2022-06-20 09:48:21 -04:00
Rasmus Wriedt Larsen
ae44a941f9
Merge pull request #9421 from RasmusWL/inline-brackets
...
Inline Expectation Tests: Allow `tag[foo bar]`
2022-06-20 10:01:19 +02:00
Harry Maclean
e1dcc207b4
Ruby: Model methods in Rails::Generators::Actions
...
These methods are sinks for command injection.
2022-06-20 13:36:09 +12:00
Harry Maclean
20ff4c4299
Ruby: Model ActiveRecord::Relation#touch_all
2022-06-20 13:36:02 +12:00
Harry Maclean
7dfab371f6
Ruby: Model redirect_back and redirect_back_or_to
...
These are ActionController methods that redirect to the HTTP Referer,
falling back to the given location if there is no Referer.
2022-06-20 13:36:02 +12:00
Harry Maclean
a298f5eb5e
Ruby: Recognise File.atomic_write as a file writer
...
This method is an ActiveSupport extension, but there's no harm in
recognising it universally as any identically-named method is likely to
also be a file writer.
2022-06-20 13:36:02 +12:00
Harry Maclean
0ce14fc4e5
Ruby: Recognise ActionCable logger class
2022-06-20 13:36:02 +12:00
thiggy1342
0456870136
Merge branch 'main' into experimental-manually-check-request-verb
2022-06-18 15:21:53 -04:00
thiggy1342
059c4d38ad
refine query to use appropriate types
2022-06-18 18:26:45 +00:00
thiggy1342
b171883cd0
Merge branch 'main' into experimental-decompression-api
2022-06-17 12:30:38 -04:00
Rasmus Wriedt Larsen
b65a10d1ef
Inline Expectation Tests: sync
2022-06-17 17:38:19 +02:00
Alex Ford
5923eb4962
Merge pull request #9566 from alexrford/ruby/activerecord-findby-dynamic
...
Ruby: recognize ActiveRecord `find_by_x` methods
2022-06-17 09:39:46 +01:00
Harry Maclean
230192df3b
Merge pull request #9267 from hmac/hmac/improper-memoization
...
Ruby: Add Improper Memoization query
2022-06-17 16:31:55 +12:00
thiggy1342
7c2b19baad
tweaks and add Zip::File.open_buffer to query
2022-06-17 02:43:54 +00:00
thiggy1342
01cb408393
Merge branch 'main' into experimental-decompression-api
2022-06-16 17:23:55 -04:00
Arthur Baars
e95194ce67
Merge pull request #9477 from thiggy1342/experimental-archive-api
...
RB: Adding experimental query for detecting path traversal in Archive libraries
2022-06-16 17:45:18 +02:00
Rasmus Wriedt Larsen
45af148f05
Merge pull request #9215 from RasmusWL/ruby-mad-argument-self
...
Ruby: Fixes for `Argument[any,any-named]` in MaD
2022-06-16 17:38:32 +02:00
Alex Ford
c44a68613a
Ruby: add a test case for ActiveRecord dynamic finder methods
2022-06-16 11:29:56 +01:00
Alex Ford
56bf977498
Ruby: trim some SQLi related comments from ActiveRecord.rb
2022-06-16 11:29:56 +01:00
Alex Ford
de486baf4a
Ruby: rename ActiveRecord.rb test case file
2022-06-16 11:29:56 +01:00
