hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-11 01:54:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,393 Commits 1,740 Branches 164 Tags
7270fe0ee79395870837d968dd4c38efed317fbf
Commit Graph

1393 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Ford
7270fe0ee7 slightly limit viable template files from render calls 2021-10-11 17:12:08 +01:00
Alex Ford
cdfee1f27d better RenderCall#getTemplateFile performance and accuracy 2021-10-11 16:46:10 +01:00
Calum Grant
958fbc7992 Merge pull request #316 from github/calumgrant/readme 
Update README.md
 2021-10-08 10:36:07 +01:00
Alex Ford
9dedb0540e Merge pull request #312 from github/rb/stored-xss-1 
Implement `rb/stored-xss` query
 2021-10-08 10:33:11 +01:00
Alex Ford
16ab4da812 Update ql/lib/codeql/ruby/security/XSS.qll 
Co-authored-by: Harry Maclean <hmac@github.com>
 2021-10-07 20:03:07 +01:00
Arthur Baars
2a32b59840 Merge pull request #331 from github/aibaars/remove-unsafe 
Remove use of 'unsafe'
 2021-10-07 16:58:59 +02:00
Alex Ford
de01770612 update test output 2021-10-07 15:50:35 +01:00
Arthur Baars
439d873564 Remove use of 'unsafe' 2021-10-07 16:38:29 +02:00
Alex Ford
168e67dd6d deduplicate string constantQualifiedName(ConstantWriteAccess) as string ConstantWriteAccess#getQualifiedName 2021-10-07 15:30:36 +01:00
Alex Ford
5b38e06765 Rename ActiveRecordModelClass#methodMayAccessField() as ActiveRecordModelClass#getAPotentialFieldAccessMethod() 2021-10-07 15:30:36 +01:00
Alex Ford
3bdc680434 Drop a comment that is no longer relevant 2021-10-07 15:30:36 +01:00
Alex Ford
8262247ed7 Minor simplification of finderMethodName predicate 2021-10-07 15:30:36 +01:00
Alex Ford
eb8c48d10f Remove some unused predicates 2021-10-07 15:30:36 +01:00
Alex Ford
c9edbd98d5 Update ql/lib/codeql/ruby/frameworks/ActiveRecord.qll 
Co-authored-by: Harry Maclean <hmac@github.com>
 2021-10-07 15:30:36 +01:00
Alex Ford
e4fe1d5c13 check for superclass method definitions in ActiveRecordModelClass#methodMayAccessField 2021-10-07 15:30:36 +01:00
Alex Ford
fb5cfcc9b0 OrmTracking goes through or expressions 2021-10-07 15:30:36 +01:00
Alex Ford
be018cc97f update ActionController tests 2021-10-07 15:30:36 +01:00
Alex Ford
955080234b partial support for rails layouts 2021-10-07 15:30:36 +01:00
Alex Ford
8e1b48e607 StoredXSS.qhelp 2021-10-07 15:30:36 +01:00
Alex Ford
182a926eeb rename some example files 2021-10-07 15:30:36 +01:00
Alex Ford
1929a95e89 format 2021-10-07 15:30:36 +01:00
Alex Ford
6065e29aba Fix performance issues related to a x-product between ActiveRecordModelInstantiation and MethodCall 2021-10-07 15:30:36 +01:00
Alex Ford
43a49689d7 reorganize ActiveRecord field access heuristics 2021-10-07 15:30:36 +01:00
Alex Ford
8f81eaa79c format 2021-10-07 15:30:36 +01:00
Alex Ford
b2434950d3 abstract away some ActiveRecord specific parts of XSS.qll 2021-10-07 15:30:36 +01:00
Alex Ford
6a32c0cde0 update XSS tests 2021-10-07 15:30:36 +01:00
Alex Ford
6dc3ce335b make rb/stored-xss track ActiveRecord db accesses 2021-10-07 15:30:36 +01:00
Alex Ford
f6dd6bb00c expand ActiveRecord modelling to cover how to access fields 2021-10-07 15:30:36 +01:00
Alex Ford
eb5f26ce06 duplicate DataFlow implementation 2021-10-07 15:30:36 +01:00
Alex Ford
a2084f813e rb/stored-xss structure and initial implementation (FileSystemReadAccess sources) 2021-10-07 15:30:36 +01:00
Tom Hvitved
1c08592637 Merge pull request #329 from github/hvitved/dataflow/synth-return 
Data flow: Add a synthetic return node
 2021-10-07 13:06:39 +02:00
Tom Hvitved
c540615223 HardcodedCredentials: Add test for default parameter values 2021-10-07 11:57:57 +02:00
Tom Hvitved
953821c443 Avoid potential tuple explosion in reverse type tracking 2021-10-06 15:21:43 +02:00
Tom Hvitved
fdf1cd38fd Data flow: Add a synthetic return node 2021-10-06 15:21:43 +02:00
Harry Maclean
c50a6c180f Merge pull request #318 from github/hmac-open-query 
Add a query for uses of `Kernel.open` and `IO.read`
 2021-10-06 10:05:43 +01:00
Tom Hvitved
1d1215923c Merge pull request #323 from github/hvitved/get-value-text 
Introduce `Expr::getValueText`
 2021-10-05 14:26:25 +02:00
Harry Maclean
7bf818fdf5 Refactor KernelMethodCall modelling 
By extending `DataFlow::CallNode` instead of `MethodCall`, we get rid of
a lot of `.asExpr().getExpr()` calls.
 2021-10-05 12:26:59 +01:00
Harry Maclean
232fb9ad5b Add cwe-073 tag to KernelOpen query 
CWE-073 is External Control of File Name or Path, which applies here.
 2021-10-05 11:13:58 +01:00
Harry Maclean
6f293c7a5e Add a query for uses of Kernel.open and IO.read 2021-10-05 11:13:58 +01:00
Harry Maclean
0fcb079ba7 Merge pull request #326 from github/hmac/eval-fixes 
Make Code execution query more specific
 2021-10-05 10:57:54 +01:00
Calum Grant
a95b87dfcb Update CONTRIBUTING guidelines 2021-10-05 10:48:34 +01:00
Calum Grant
d8a19ecd6e Initial version of CONTRIBUTING from codeql-go 2021-10-05 10:30:22 +01:00
Calum Grant
d8209719e1 Moved developer information into its own doc 2021-10-05 10:28:40 +01:00
Harry Maclean
e419fc9599 Make Code execution query more specific 
Only the first argument to eval, instance_eval, send, class_send and
module_send is interpreted as Ruby code.
 2021-10-05 10:28:34 +01:00
Nick Rolfe
b955fdb58d Merge pull request #324 from github/clippy_fixes 
clippy fixes
 2021-10-04 13:35:26 +01:00
Nick Rolfe
46d1280d07 Fix clippy warnings in extractor 2021-10-04 12:07:49 +01:00
Nick Rolfe
a188e73f7b Fix clippy warnings in generator 2021-10-04 11:55:55 +01:00
Nick Rolfe
087958be2d Fix clippy warnings in node-types 2021-10-04 11:44:21 +01:00
Nick Rolfe
1e38c705b8 Fix clippy warnings in autobuilder 2021-10-04 11:44:14 +01:00
Arthur Baars
2f462771bb Merge pull request #286 from github/aibaars/xxe 
XXE query
 2021-10-01 16:14:41 +02:00