5 Commits

Author	SHA1	Message	Date
Harry Maclean	8e40899dfd	Merge pull request #7419 from github/hmac/const-get	2022-01-22 07:01:09 +13:00
Jeff Gran	47697f59c1	Ruby: Add classes for detecting user input from graphql-ruby	2022-01-18 09:13:58 -07:00
Harry Maclean	43ddc54f2b	Ruby: Add Module#const_get as a code execution ... Module#const_get takes a single string argument and interprets it as the name of a constant. It then looks up the constant and returns its value. Object.const_get("Math::PI") # => 3.141592653589793 By itself, this method is not as dangerous as e.g. eval, but if the value returned is a class that is then instantiated, this can allow an attacker to instantiate arbitrary Ruby classes. As a result, I think it's safe to say that any remote input flowing into this call is a potential vulnerability. A real-world example of this is https://github.com/advisories/GHSA-52p9-v744-mwjj.	2022-01-06 13:03:41 +13:00
Alex Ford	5fa6ecc5f1	Ruby: Model what is written to the log from stdlib Logger methods	2021-12-14 17:39:12 +00:00
Arthur Baars	976daddd36	Move files to ruby subfolder	2021-10-15 11:47:28 +02:00