Alex Ford
|
a45366e426
|
remove unnecessary ExprNodes prefix
|
2021-06-24 18:12:26 +01:00 |
|
Alex Ford
|
b27891b14e
|
update ActiveRecord test output
|
2021-06-24 18:12:26 +01:00 |
|
Alex Ford
|
1f5a5181b9
|
StringInterpolationComponentCfgNode extends ExprNodes::StmtSequenceCfgNode
|
2021-06-24 18:12:26 +01:00 |
|
Alex Ford
|
a4a8f17a54
|
Update ql/src/codeql_ruby/dataflow/BarrierGuards.qll
Co-authored-by: Tom Hvitved <hvitved@github.com>
|
2021-06-24 18:12:26 +01:00 |
|
Alex Ford
|
9883a9b606
|
update SqlInjection tests
|
2021-06-24 18:12:26 +01:00 |
|
Alex Ford
|
d62f4f5bd4
|
Address review comments
|
2021-06-24 18:12:26 +01:00 |
|
Alex Ford
|
bc5a1b86ff
|
Fix handling of arrays passed to ActiveRecord SQL methods
|
2021-06-24 18:12:26 +01:00 |
|
Alex Ford
|
fc8db88b66
|
Apply suggestions from code review
Co-authored-by: Tom Hvitved <hvitved@github.com>
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
7415503772
|
update ActiveRecord test output
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
12e4c9ee90
|
update SqlInjection tests
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
734fe01867
|
Support named :conditions parameter to some SQL executing ActiveRecord calls
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
91bde8d85d
|
Support ActiveRecord SQL executing calls where there is a self receiver (implicit or explicit)
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
5386c776b3
|
Implement rb/sql-injection
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
957b29b5af
|
Add more defaultAdditionalTaintSteps
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
6e5665da8c
|
Make ActiveRecord model flag more potentially dangerous SQL executions
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
8761873cd1
|
Implement two common barrier guards
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
98313d0a56
|
Convenience classes for wrapping some Exprs as ExprCfgNodes
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
ad1d8420f3
|
Make BarrierGuard abstract
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
adf32e973a
|
Create Frameworks.qll to act as a container for all framework models
|
2021-06-24 18:12:25 +01:00 |
|
Arthur Baars
|
f69c5dc19b
|
Merge pull request #221 from github/package-depend-on-compile-queries
make the package job depend on compile-queries
|
2021-06-24 19:03:44 +02:00 |
|
Alex Ford
|
58e9b69ea4
|
make the package job depend on compile-queries
|
2021-06-24 16:52:22 +01:00 |
|
Arthur Baars
|
7574d1cad7
|
Merge pull request #220 from github/aibaars/update-build-yml
Update build.yml
|
2021-06-24 16:38:26 +02:00 |
|
Arthur Baars
|
dfc96de4cc
|
Update build.yml
|
2021-06-24 16:09:45 +02:00 |
|
Tom Hvitved
|
9438885776
|
Merge pull request #216 from github/hvitved/synthesis-location
AST synthesis: Move location information into a separate predicate
|
2021-06-23 16:50:17 +02:00 |
|
Alex Ford
|
e5f0206c6d
|
Merge pull request #208 from github/action-controller-1
Model accesses to `ActionController` parameters via `params` method
|
2021-06-23 14:21:55 +01:00 |
|
Alex Ford
|
0238c19085
|
remove TODO
|
2021-06-23 14:11:38 +01:00 |
|
Alex Ford
|
5941eb2be4
|
model some ActionController user input sources (params)
|
2021-06-23 14:11:38 +01:00 |
|
Alex Ford
|
9227f3a0c3
|
Add RemoteFlowSources.qll
|
2021-06-23 14:11:38 +01:00 |
|
Alex Ford
|
5163514d43
|
Merge pull request #218 from github/build-yml-debug
Fix `compile-queries` job
|
2021-06-23 14:04:33 +01:00 |
|
Alex Ford
|
8e1f2e6237
|
try fixing build.yml
|
2021-06-23 13:41:51 +01:00 |
|
Tom Hvitved
|
1dde5b8ef9
|
AST synthesis: Move location information into a separate predicate
|
2021-06-23 08:46:07 +02:00 |
|
Alex Ford
|
dbf1805c8b
|
Merge pull request #196 from github/active-record-1
Start modelling some potential SQL fragment sinks in ActiveRecord
|
2021-06-22 16:05:26 +01:00 |
|
Arthur Baars
|
bedd790d33
|
Merge pull request #217 from github/aibaars-patch-2
Remove ad-hoc entries from query suite
|
2021-06-22 15:48:22 +02:00 |
|
Arthur Baars
|
f7eee915da
|
Remove ad-hoc queries
|
2021-06-22 15:35:30 +02:00 |
|
Arthur Baars
|
33c5312842
|
Merge pull request #215 from github/bump-codeql
Bump `codeql` submodule
|
2021-06-21 16:18:04 +02:00 |
|
Tom Hvitved
|
992d8faa06
|
Bump codeql submodule
|
2021-06-21 16:06:45 +02:00 |
|
Tom Hvitved
|
abe5e3d953
|
Merge pull request #210 from github/hvitved/dataflow/consistency
Data flow: Add consistency queries
|
2021-06-21 14:42:55 +02:00 |
|
Nick Rolfe
|
35eb4a3af4
|
Merge pull request #214 from github/regexp_naming
Use RegExp prefix instead of Regex, for consistency with other languages.
|
2021-06-21 11:06:19 +01:00 |
|
Tom Hvitved
|
b820f3f20d
|
Merge pull request #212 from github/hvitved/ssa/assigns-pred
Add `Ssa::WriteDefinition::assigns/1` predicate
|
2021-06-21 10:46:48 +02:00 |
|
Nick Rolfe
|
65aa97c07c
|
Use RegExp prefix instead of Regex, for consistency with other languages.
|
2021-06-18 15:56:19 +01:00 |
|
Tom Hvitved
|
7cc02e6d00
|
Add Ssa::WriteDefinition::assigns/1 predicate
|
2021-06-18 10:42:32 +02:00 |
|
Nick Rolfe
|
78db1bf045
|
Merge pull request #211 from github/smaller_trap
Tweaks to reduce size of TRAP output
|
2021-06-17 17:09:14 +01:00 |
|
Nick Rolfe
|
ab72b4e9e7
|
Use hexadecimal encoding for TRAP labels
|
2021-06-17 16:16:32 +01:00 |
|
Nick Rolfe
|
ed93233917
|
Remove unnecessary spaces in TRAP output
|
2021-06-17 16:16:06 +01:00 |
|
Alex Ford
|
7439ab5635
|
remove recvCls field from ActiveRecordModelClassMethodCall
|
2021-06-17 14:42:42 +01:00 |
|
Alex Ford
|
214532516b
|
try to avoid a future merge conflict
|
2021-06-17 14:41:51 +01:00 |
|
Alex Ford
|
762656ee60
|
Add QLDoc to ActiveRecord.qll
|
2021-06-17 14:41:51 +01:00 |
|
Alex Ford
|
12a0af1d28
|
Tidy up PotentiallyUnsafeSqlExecutingMethodCall characteristic predicate
Co-authored-by: Nick Rolfe <nickrolfe@github.com>
|
2021-06-17 14:39:40 +01:00 |
|
Tom Hvitved
|
41ed9f3e1b
|
Data flow: Fix inconsistencies
|
2021-06-17 10:48:32 +02:00 |
|
Tom Hvitved
|
00e544189e
|
Data flow: Add consistency queries
|
2021-06-17 10:26:56 +02:00 |
|