erik-krogh
80c92dc3e6
add support for array pushes
2022-11-25 10:32:05 +01:00
erik-krogh
3461404bbb
add basic support for arrays
2022-11-25 10:31:35 +01:00
erik-krogh
0f2a48f461
fix QL-for-QL warnings
2022-11-25 10:26:24 +01:00
erik-krogh
2033dd2dcc
remove parameters named "code" as source
2022-11-25 10:25:31 +01:00
erik-krogh
e7c6571f52
remove the "send(..)" and similar from unsafe-code-construction
2022-11-25 10:25:31 +01:00
erik-krogh
f1668801d3
add a rb/unsafe-code-construction query
...
rebase
2022-11-25 10:25:30 +01:00
erik-krogh
5f6cb1684b
move the code-injection tests into a subfolder
2022-11-24 17:23:25 +01:00
Erik Krogh Kristensen
03737543d4
Merge pull request #11403 from erik-krogh/additional
...
ReDoS: add missing additional keywords
2022-11-24 15:53:51 +01:00
erik-krogh
95f35196e4
add missing additional keywords
2022-11-23 20:45:51 +01:00
erik-krogh
33216f3867
cleanup imports
2022-11-23 15:22:19 +01:00
erik-krogh
19b5f64a11
use instanceof instead of extends on DataFlow::CallNode in some case
2022-11-23 14:58:17 +01:00
Edoardo Pirovano
6c33ddcd47
Merge pull request #11349 from github/edoardo/2.11.4-mergeback
...
Merge `rc/3.8` into `main`
2022-11-21 18:08:27 +00:00
Erik Krogh Kristensen
b4661f4a59
Merge pull request #11245 from erik-krogh/rb-redosMod
...
Ruby: use the shared regex pack
2022-11-21 15:34:20 +01:00
Tom Hvitved
2fac505221
Ruby: Update expected test output
2022-11-21 12:52:27 +01:00
Tom Hvitved
e7ed056b6f
Sync files
2022-11-21 12:00:36 +01:00
github-actions[bot]
5b14ebf22a
Post-release preparation for codeql-cli-2.11.4
2022-11-18 11:26:00 +00:00
github-actions[bot]
e105c13e77
Release preparation for version 2.11.4
2022-11-17 16:40:45 +00:00
Harry Maclean
a6f6936719
Merge pull request #11058 from hmac/actioncontroller-logger
...
Ruby: Model various ActionController methods
2022-11-17 08:21:00 +13:00
Tom Hvitved
67b6a82cf1
Merge pull request #11198 from hvitved/ssa/expose-phi-reads
...
SSA: Expose phi-read nodes
2022-11-16 15:11:58 +01:00
Anders Schack-Mulligen
94bca4399a
Merge pull request #11183 from aschackmull/dataflow/groupflow
...
Dataflow: Introduce support for src/sink grouping in path results.
2022-11-16 12:59:01 +01:00
Erik Krogh Kristensen
7d4ea47611
Merge pull request #10855 from erik-krogh/formatTaint
...
Ruby: taint-steps for printf calls - and add a `AdditionalTaintStep` class
2022-11-16 12:08:45 +01:00
Harry Maclean
ed3270fb04
Ruby: Update for upstream changes
2022-11-16 14:06:32 +13:00
Harry Maclean
2e2fcd49bf
Ruby: Consider Object#inspect a log sanitizer
...
The behaviour of `Object#inspect` depends on whether it has been
overridden by a subclass, but it will typically produce output on a
single line. Calling `inspect` on a String will replace newlines with
`\n`, which is then safe for interpolation into a log line.
2022-11-16 13:46:51 +13:00
Harry Maclean
762ebad66e
Ruby: Add change note
2022-11-16 13:46:51 +13:00
Harry Maclean
d0521f15f1
Ruby: Update tests
2022-11-16 13:46:51 +13:00
Harry Maclean
d2c0250b41
Ruby: Model ActionDispatch::Request#body_stream
2022-11-16 13:46:51 +13:00
Harry Maclean
9f357837fa
Ruby: Model send_data as an HTTP response
2022-11-16 13:46:51 +13:00
Harry Maclean
5cfc494e16
Ruby: Test render inside redirect_to
...
This test shows that we correctly identify redirect_to and render calls
inside respond_to blocks.
2022-11-16 13:46:51 +13:00
Harry Maclean
155b64d3fc
Ruby: Add test for render calls
2022-11-16 13:46:51 +13:00
Harry Maclean
b7e14311be
Ruby: Model ActionController logger
2022-11-16 13:46:50 +13:00
Harry Maclean
27681ac987
Ruby: Move ActionController tests to own directory
2022-11-16 13:46:49 +13:00
erik-krogh
f6255e497b
Merge branch 'main' into rb-redosMod
2022-11-15 17:14:19 +01:00
Tom Hvitved
67f31ffdf0
Ruby: Add tests for phi reads
2022-11-15 11:45:32 +01:00
Tom Hvitved
32f60fd112
Ruby: Add more local flow tests for use-use flow
2022-11-15 11:45:31 +01:00
Nick Rolfe
8d854e0a6b
Merge pull request #11252 from github/nickrolfe/active_support_enumerable
...
Ruby: add flow summary for Enumerable#index_by
2022-11-15 10:40:42 +00:00
erik-krogh
10fff4e2ef
Merge branch 'main' into rb-redosMod
2022-11-14 21:31:10 +01:00
Tom Hvitved
b242bd6468
Merge pull request #11080 from github/revert-11074-revert-10576-ssa/consistency-queries
...
Revert "Revert "SSA: Turn consistency predicates into `query` predicates""
2022-11-14 14:43:58 +01:00
Nick Rolfe
c80fbff648
Ruby: add changenote for Enumerable#index_by flow summary
2022-11-14 12:47:50 +00:00
Nick Rolfe
83b3312467
Merge pull request #11207 from github/nickrolfe/arel-sql
...
Ruby: add `SqlConstruction` concept, and implement it for calls to `Arel.sql`
2022-11-14 10:21:37 +00:00
Nick Rolfe
0dadf0bbb4
Ruby: add flow summary for Enumerable#index_by
2022-11-14 10:01:24 +00:00
Rasmus Wriedt Larsen
ddbcdcb4ba
Merge pull request #11160 from RasmusWL/dataflow-consistency-read-store
...
DataFlow: Add read/store stepIsLocal consistency checks
2022-11-11 14:51:45 +01:00
Nick Rolfe
be60a871a3
Ruby: tweak comment
2022-11-11 12:01:23 +00:00
Nick Rolfe
e3ebf1c668
Merge pull request #11187 from github/nickrolfe/actioncable
...
Ruby: add ActionCable channel RPC params as remote flow sources
2022-11-11 11:32:13 +00:00
Erik Krogh Kristensen
90382c4d1c
Merge pull request #11178 from erik-krogh/passcode
...
JS/RB/PY: Recognize `passcode` as sensitive
2022-11-10 17:58:34 +01:00
Tom Hvitved
bda4b52395
Merge pull request #11206 from hvitved/ruby/self-toplevel-def
...
Ruby: Fix SSA entry definitions for `self` in top-level
2022-11-10 17:01:59 +01:00
Nick Rolfe
20f76e50c3
Ruby: actually call the isPublic() predicate I added
2022-11-10 15:53:04 +00:00
Nick Rolfe
b91b3148a4
Ruby: add missing qldoc comments for SQL injection query
2022-11-10 15:26:42 +00:00
Nick Rolfe
511fb97273
Ruby: remove redundant import
2022-11-10 14:30:06 +00:00
Nick Rolfe
0337ccb93a
Ruby: add change notes for Arel.sql / SqlConstruction changes
2022-11-10 14:11:14 +00:00
Nick Rolfe
5a15558355
Ruby: treat an Arel.sql call as a SqlConstruction
2022-11-10 14:11:14 +00:00
