Nick Rolfe
eebba36b18
Merge pull request #9708 from github/nickrolfe/pathname
...
Ruby: model the standard library's `Pathname` class
2022-07-18 11:29:30 +01:00
Harry Maclean
ea95e2e1d0
Ruby: Use InclusionTests library in barrier guards
2022-07-13 18:20:27 +12:00
Harry Maclean
b9fc82a741
Ruby: Test both old and new-style barrier guards
2022-07-13 18:20:25 +12:00
Harry Maclean
301914d80c
Ruby: Add an extra barrier guard test
2022-07-13 18:20:14 +12:00
Harry Maclean
706d1d2eee
Ruby: Make StringArrayInclusion more sensitive
...
We now recognise the following pattern as a barrier guard for `x`:
values = ["foo", "bar"]
if values.include? x
sink x
end
2022-07-13 18:20:12 +12:00
Nick Rolfe
c1302a90e0
Ruby: use MaD for more precise Pathname flow summaries
2022-06-29 13:16:18 +01:00
Nick Rolfe
280c959dc8
Merge branch 'main' into nickrolfe/pathname
2022-06-27 11:11:17 +01:00
Asger F
d6fd43fe12
Merge pull request #9364 from asgerf/ruby/api-graph-api
...
Ruby: API graph renaming an documentation
2022-06-27 08:54:24 +02:00
Nick Rolfe
03d0f66247
Ruby: add flow summaries for Pathname class
2022-06-24 14:14:06 +01:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
Asger F
7c877c7861
Ruby: Rename getARhs -> asSink
2022-06-21 12:44:16 +02:00
Asger F
2f8086bb57
Ruby: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:16 +02:00
Anders Schack-Mulligen
736372ffd6
Ruby: Remove test.
2022-06-21 11:18:36 +02:00
Rasmus Wriedt Larsen
bb0435aba6
Merge branch 'main' into ruby-mad-argument-self
2022-06-08 14:19:29 +02:00
Arthur Baars
e3ef258b0e
Merge pull request #9287 from aibaars/instance-variable-flow-2
...
Ruby: flow through getters/setters
2022-05-27 10:49:20 +02:00
Tom Hvitved
b3ce2d4a2b
Ruby: Data flow for hash-splat expressions in hash literals
2022-05-25 19:55:28 +02:00
Arthur Baars
033df767ef
Ruby: allow fields in flow summaries
2022-05-25 16:01:04 +02:00
Arthur Baars
b0a97f9b01
Ruby: flow through getters/setters
2022-05-25 16:01:04 +02:00
Tom Hvitved
ce4959287a
Ruby: Flow through hash-splat expressions
2022-05-25 15:40:08 +02:00
Tom Hvitved
a7b39ebeca
Ruby: Flow through hash-splat parameters
2022-05-25 12:37:22 +02:00
Rasmus Wriedt Larsen
ae65af2c07
Ruby: Fix Argument[any] in Hash.qll
...
With this PR, `self` have to be explicitly added. A few edges were
removed, and I don't know why. It doesn't seem to affect results, so I
did not worry too much.
2022-05-24 18:09:52 +02:00
Rasmus Wriedt Larsen
04ac466189
Merge branch 'main' into ruby-mad-argument-self
2022-05-24 18:04:02 +02:00
Tom Hvitved
faf24a4f18
Ruby: Data-flow through hashes
2022-05-24 14:27:55 +02:00
Arthur Baars
cf2eb0d3a1
Merge branch 'main' into instance-variable-flow
2022-05-23 18:48:51 +02:00
Arthur Baars
7ed60b19a2
Ruby: improve test case
2022-05-23 11:59:12 +02:00
Arthur Baars
68aeb2ba85
Update test output
2022-05-20 16:30:58 +02:00
Arthur Baars
d9c2b78aa2
Ruby: flow through instance variables
2022-05-20 16:30:58 +02:00
Rasmus Wriedt Larsen
5d6fbcec64
Ruby: Autoformat
2022-05-19 16:30:12 +02:00
Rasmus Wriedt Larsen
e810ba4ef6
Ruby: Expand flowToAnyArg test
2022-05-19 16:27:04 +02:00
Rasmus Wriedt Larsen
0879b6ae12
Ruby: Fix Argument[any,any-named] handling for path component in MaD
2022-05-19 15:51:30 +02:00
Rasmus Wriedt Larsen
7784b9f879
Ruby: WIP: Make Argument[any] and any-named work
...
It's not fully working I think the problem is that the code below ties
up `Argument[x]` with parameter positions, and `Parameter[x]` with
argument positions. This flip might be correct for flow-summaries, but
it does NOT seem to be correct for the `path` component in MaD.
Specifically, quick-eval for ParameterPosition does NOT include `keyword key` while
quick-eval for ArgumentPosition DOES include `keyword key`!
For the test `Foo.sinkAnyNamedArg(key: tainted) # $ MISSING: hasValueFlow=tainted`
c8be8d30b3/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsSpecific.qll (L130-L133)
2022-05-19 15:51:25 +02:00
Rasmus Wriedt Larsen
df83a51e1e
Ruby: Add anyNamedArg summary test
2022-05-19 15:42:41 +02:00
Rasmus Wriedt Larsen
cb6e5c24fc
Ruby: Prepare for anyNamedArg summary test
2022-05-19 15:42:41 +02:00
Rasmus Wriedt Larsen
a7f627af0c
Ruby: Add test for Argument[any] and any-named
2022-05-19 15:42:41 +02:00
Rasmus Wriedt Larsen
cb5ad8b775
Ruby: Don't include Argument[self] in Argument[any]
...
For flow-sumamries
2022-05-19 15:42:41 +02:00
Tom Hvitved
a18aef23f9
Data flow: Do not discard call context when computing reverse lambda flow through jumps
2022-05-19 15:19:41 +02:00
Tom Hvitved
ea703bc49a
Ruby: Add test that illustrates false negative lambda flow
2022-05-19 15:19:34 +02:00
Rasmus Wriedt Larsen
051754cf7e
Ruby: Add test of what Argument[any] for input/output includes
...
and an explicit test of what `Argument[self]` includes.
2022-05-19 14:02:22 +02:00
Tom Hvitved
884d3b2ff4
Ruby: Introduce With(out)Element MaD input tokens
2022-05-11 15:17:27 +02:00
Rasmus Wriedt Larsen
a7b43f7356
Ruby: Accept changes to TypeTracker tests
...
Since this is not using inline-expectation-tests, I'm not entirely sure
whether these changes are OK or not, so hope to get someone else to
signoff on that.
2022-05-03 14:59:06 +02:00
Tom Hvitved
3fd93b460f
Merge pull request #8935 from hvitved/ruby/typetracker-kw-test
2022-04-28 18:22:51 +02:00
Tom Hvitved
29f1c533a9
Ruby: Add type tracker tests for flow through keyword/positional parameters
2022-04-28 11:34:12 +02:00
Tom Hvitved
d1c9d68e14
Ruby: Generalize ArrayElementContent to ElementContent
2022-04-27 11:53:21 +02:00
Tom Hvitved
3b7fe06858
Ruby: Simplify flow summary for fetch
2022-04-27 08:26:24 +02:00
Tom Hvitved
b033f107df
Merge remote-tracking branch 'upstream/main' into dataflow/interpret-read-store
2022-04-22 14:35:02 +02:00
Tom Hvitved
093a3879be
Merge pull request #8794 from hvitved/ruby/capture-barrier-guards
...
Ruby: Handle captured variables in `BarrierGuard::getAGuardedNode()`
2022-04-22 11:47:36 +02:00
Tom Hvitved
be5363ea53
Merge pull request #8801 from hvitved/ruby/exclude-splat-in-taint-tracking
...
Ruby: Exclude `SplatExpr` from taint tracking
2022-04-22 11:12:05 +02:00
Tom Hvitved
c20ce62767
Ruby: Exclude SplatExpr from taint tracking
...
`SplatExpr`s are modelled using flow summaries, so there is no need to include them
explicitly in `defaultAdditionalTaintStep`.
2022-04-21 20:27:04 +02:00
Tom Hvitved
addb92f13b
Ruby: Handle captured variables in BarrierGuard::getAGuardedNode()
2022-04-21 13:25:47 +02:00
Tom Hvitved
325b451288
Ruby: Add barrier guards test involving captured variables
2022-04-21 13:25:40 +02:00
