Asger F
b4b34cc994
Ruby: port part of ActionController model
2022-10-31 13:33:41 +01:00
Josh Soref
8078f91b28
spelling: mapping
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 10:56:41 -04:00
Tom Hvitved
a9f2e5272f
Merge pull request #10376 from hvitved/ruby/no-ast-by-default
...
Ruby: Do not expose AST layer through `ruby.qll`
2022-09-21 13:15:30 +02:00
Tom Hvitved
007ab2b7ce
Ruby: Do not expose AST layer through ruby.qll
2022-09-13 19:59:56 +02:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
Harry Maclean
cb3ebeedf9
Merge pull request #9696 from thiggy1342/experimental-strong-params
...
RB: Experimental strong params query
2022-07-25 12:08:55 +12:00
thiggy1342
0c0ba925a7
this one should have no tag
2022-07-22 18:44:03 +00:00
thiggy1342
f39ca1aad2
correct cwe tagged
2022-07-22 18:36:25 +00:00
thiggy1342
486a394a7f
Update ruby/ql/src/experimental/weak-params/WeakParams.ql
...
Co-authored-by: Harry Maclean <hmac@github.com >
2022-07-21 17:26:09 -04:00
thiggy1342
cc958dc171
Update ruby/ql/src/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.ql
...
Co-authored-by: Harry Maclean <hmac@github.com >
2022-07-21 17:19:33 -04:00
thiggy1342
9586259706
style tweak for checking multiple method names
2022-07-19 00:29:30 +00:00
thiggy1342
304203ad2f
fix path problem output
2022-07-19 00:25:50 +00:00
thiggy1342
3dd61cadf4
formatting query
2022-07-14 00:19:36 +00:00
thiggy1342
ee79834cc8
formatting in qhelp
2022-07-14 00:15:39 +00:00
thiggy1342
ae634367c9
add qhelp file
2022-07-14 00:11:52 +00:00
thiggy1342
2cc703387b
use taint config for data flow
2022-07-14 00:11:52 +00:00
thiggy1342
7129002573
tweak tests more
2022-07-13 00:33:58 +00:00
thiggy1342
7facc63699
remove predicate
2022-07-12 22:59:48 +00:00
thiggy1342
ad7c3e7217
Merge branch 'main' into experimental-manually-check-request-verb
2022-07-11 10:20:07 -04:00
thiggy1342
5d3232c614
refactor to use data flow
2022-07-08 18:53:24 +00:00
thiggy1342
6aab970a9e
refactor query to use cfg and dataflow
2022-07-08 18:32:54 +00:00
thiggy1342
6ea1aad5fc
more style fixes
2022-06-23 22:57:51 -04:00
thiggy1342
ce2edd4b28
style tweaks
2022-06-24 02:46:48 +00:00
thiggy1342
ca074e2275
add qhelp file
2022-06-24 02:19:06 +00:00
thiggy1342
45dd38df6e
polish up dataflow query
2022-06-24 01:50:20 +00:00
thiggy1342
e838b83f5f
attempt to introduce dataflow tracking
2022-06-23 02:21:47 +00:00
thiggy1342
995f365568
just check string literal
2022-06-22 02:17:01 +00:00
thiggy1342
c767f241ad
narrow query scope
2022-06-22 02:12:23 +00:00
thiggy1342
f6c4b5c44b
Merge branch 'experimental-manually-check-request-verb' of https://github.com/thiggy1342/codeql into experimental-manually-check-request-verb
2022-06-21 21:27:39 +00:00
thiggy1342
990747cd22
Limit findings to just those called in Controllers
2022-06-21 21:27:18 +00:00
thiggy1342
53729f99c5
restrict findings to just controller classes
2022-06-21 20:28:29 +00:00
thiggy1342
83b720d730
first draft of weak params query
2022-06-21 19:28:53 +00:00
thiggy1342
db46a1d807
Update ruby/ql/src/experimental/decompression-api/DecompressionApi.ql
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 11:05:16 -04:00
thiggy1342
633ddf46fb
fix comments
2022-06-20 13:53:56 +00:00
thiggy1342
9c9ac919b7
Update ruby/ql/src/experimental/decompression-api/DecompressionApi.ql
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 09:49:52 -04:00
thiggy1342
3949e04797
Update ruby/ql/src/experimental/decompression-api/DecompressionApi.ql
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-20 09:49:11 -04:00
thiggy1342
0456870136
Merge branch 'main' into experimental-manually-check-request-verb
2022-06-18 15:21:53 -04:00
thiggy1342
ecb2114b7b
replace duplicate post with put
2022-06-18 19:21:17 +00:00
thiggy1342
8b36191023
drop precision to low for now
2022-06-18 18:38:58 +00:00
thiggy1342
059c4d38ad
refine query to use appropriate types
2022-06-18 18:26:45 +00:00
thiggy1342
8aa2602d9e
trying to hone in on eq comparison and include?
2022-06-18 03:09:04 +00:00
thiggy1342
78f5186e6a
remove barrierguards import
2022-06-18 00:43:01 +00:00
thiggy1342
b171883cd0
Merge branch 'main' into experimental-decompression-api
2022-06-17 12:30:38 -04:00
thiggy1342
4163ae1ca3
Update ruby/ql/src/experimental/decompression-api/DecompressionApi.qhelp
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-17 12:30:22 -04:00
thiggy1342
3b87c1d040
add qlhelp file and example
2022-06-17 16:03:40 +00:00
thiggy1342
7c2b19baad
tweaks and add Zip::File.open_buffer to query
2022-06-17 02:43:54 +00:00
thiggy1342
6416b8ddb9
Update ruby/ql/src/experimental/decompression-api/DecompressionApi.ql
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-06-16 10:20:17 -04:00
Harry Maclean
ef6f0e5b30
Ruby: Add Improper Memoization query
...
This query finds cases where a method memoizes its result but fails to
include one or more of its parameters in the memoization key (or doesn't
use memoization keys at all). This can lead to the method returning
incorrect results when subsequently called with different arguments.
2022-06-16 12:44:33 +12:00
thiggy1342
0281dbd532
remove Zip::Entry.extract from query
2022-06-16 00:04:31 +00:00
thiggy1342
c012c235c6
rough draft of check request verb query
2022-06-14 01:45:02 +00:00
