Commit Graph

969 Commits

Author SHA1 Message Date
Alex Ford
a45366e426 remove unnecessary ExprNodes prefix 2021-06-24 18:12:26 +01:00
Alex Ford
b27891b14e update ActiveRecord test output 2021-06-24 18:12:26 +01:00
Alex Ford
1f5a5181b9 StringInterpolationComponentCfgNode extends ExprNodes::StmtSequenceCfgNode 2021-06-24 18:12:26 +01:00
Alex Ford
a4a8f17a54 Update ql/src/codeql_ruby/dataflow/BarrierGuards.qll
Co-authored-by: Tom Hvitved <hvitved@github.com>
2021-06-24 18:12:26 +01:00
Alex Ford
9883a9b606 update SqlInjection tests 2021-06-24 18:12:26 +01:00
Alex Ford
d62f4f5bd4 Address review comments 2021-06-24 18:12:26 +01:00
Alex Ford
bc5a1b86ff Fix handling of arrays passed to ActiveRecord SQL methods 2021-06-24 18:12:26 +01:00
Alex Ford
fc8db88b66 Apply suggestions from code review
Co-authored-by: Tom Hvitved <hvitved@github.com>
2021-06-24 18:12:25 +01:00
Alex Ford
7415503772 update ActiveRecord test output 2021-06-24 18:12:25 +01:00
Alex Ford
12e4c9ee90 update SqlInjection tests 2021-06-24 18:12:25 +01:00
Alex Ford
734fe01867 Support named :conditions parameter to some SQL executing ActiveRecord calls 2021-06-24 18:12:25 +01:00
Alex Ford
91bde8d85d Support ActiveRecord SQL executing calls where there is a self receiver (implicit or explicit) 2021-06-24 18:12:25 +01:00
Alex Ford
5386c776b3 Implement rb/sql-injection 2021-06-24 18:12:25 +01:00
Alex Ford
957b29b5af Add more defaultAdditionalTaintSteps 2021-06-24 18:12:25 +01:00
Alex Ford
6e5665da8c Make ActiveRecord model flag more potentially dangerous SQL executions 2021-06-24 18:12:25 +01:00
Alex Ford
8761873cd1 Implement two common barrier guards 2021-06-24 18:12:25 +01:00
Alex Ford
98313d0a56 Convenience classes for wrapping some Exprs as ExprCfgNodes 2021-06-24 18:12:25 +01:00
Alex Ford
ad1d8420f3 Make BarrierGuard abstract 2021-06-24 18:12:25 +01:00
Alex Ford
adf32e973a Create Frameworks.qll to act as a container for all framework models 2021-06-24 18:12:25 +01:00
Arthur Baars
f69c5dc19b Merge pull request #221 from github/package-depend-on-compile-queries
make the package job depend on compile-queries
2021-06-24 19:03:44 +02:00
Alex Ford
58e9b69ea4 make the package job depend on compile-queries 2021-06-24 16:52:22 +01:00
Arthur Baars
7574d1cad7 Merge pull request #220 from github/aibaars/update-build-yml
Update build.yml
2021-06-24 16:38:26 +02:00
Arthur Baars
dfc96de4cc Update build.yml 2021-06-24 16:09:45 +02:00
Tom Hvitved
9438885776 Merge pull request #216 from github/hvitved/synthesis-location
AST synthesis: Move location information into a separate predicate
2021-06-23 16:50:17 +02:00
Alex Ford
e5f0206c6d Merge pull request #208 from github/action-controller-1
Model accesses to `ActionController` parameters via `params` method
2021-06-23 14:21:55 +01:00
Alex Ford
0238c19085 remove TODO 2021-06-23 14:11:38 +01:00
Alex Ford
5941eb2be4 model some ActionController user input sources (params) 2021-06-23 14:11:38 +01:00
Alex Ford
9227f3a0c3 Add RemoteFlowSources.qll 2021-06-23 14:11:38 +01:00
Alex Ford
5163514d43 Merge pull request #218 from github/build-yml-debug
Fix `compile-queries` job
2021-06-23 14:04:33 +01:00
Alex Ford
8e1f2e6237 try fixing build.yml 2021-06-23 13:41:51 +01:00
Tom Hvitved
1dde5b8ef9 AST synthesis: Move location information into a separate predicate 2021-06-23 08:46:07 +02:00
Alex Ford
dbf1805c8b Merge pull request #196 from github/active-record-1
Start modelling some potential SQL fragment sinks in ActiveRecord
2021-06-22 16:05:26 +01:00
Arthur Baars
bedd790d33 Merge pull request #217 from github/aibaars-patch-2
Remove ad-hoc entries from query suite
2021-06-22 15:48:22 +02:00
Arthur Baars
f7eee915da Remove ad-hoc queries 2021-06-22 15:35:30 +02:00
Arthur Baars
33c5312842 Merge pull request #215 from github/bump-codeql
Bump `codeql` submodule
2021-06-21 16:18:04 +02:00
Tom Hvitved
992d8faa06 Bump codeql submodule 2021-06-21 16:06:45 +02:00
Tom Hvitved
abe5e3d953 Merge pull request #210 from github/hvitved/dataflow/consistency
Data flow: Add consistency queries
2021-06-21 14:42:55 +02:00
Nick Rolfe
35eb4a3af4 Merge pull request #214 from github/regexp_naming
Use RegExp prefix instead of Regex, for consistency with other languages.
2021-06-21 11:06:19 +01:00
Tom Hvitved
b820f3f20d Merge pull request #212 from github/hvitved/ssa/assigns-pred
Add `Ssa::WriteDefinition::assigns/1` predicate
2021-06-21 10:46:48 +02:00
Nick Rolfe
65aa97c07c Use RegExp prefix instead of Regex, for consistency with other languages. 2021-06-18 15:56:19 +01:00
Tom Hvitved
7cc02e6d00 Add Ssa::WriteDefinition::assigns/1 predicate 2021-06-18 10:42:32 +02:00
Nick Rolfe
78db1bf045 Merge pull request #211 from github/smaller_trap
Tweaks to reduce size of TRAP output
2021-06-17 17:09:14 +01:00
Nick Rolfe
ab72b4e9e7 Use hexadecimal encoding for TRAP labels 2021-06-17 16:16:32 +01:00
Nick Rolfe
ed93233917 Remove unnecessary spaces in TRAP output 2021-06-17 16:16:06 +01:00
Alex Ford
7439ab5635 remove recvCls field from ActiveRecordModelClassMethodCall 2021-06-17 14:42:42 +01:00
Alex Ford
214532516b try to avoid a future merge conflict 2021-06-17 14:41:51 +01:00
Alex Ford
762656ee60 Add QLDoc to ActiveRecord.qll 2021-06-17 14:41:51 +01:00
Alex Ford
12a0af1d28 Tidy up PotentiallyUnsafeSqlExecutingMethodCall characteristic predicate
Co-authored-by: Nick Rolfe <nickrolfe@github.com>
2021-06-17 14:39:40 +01:00
Tom Hvitved
41ed9f3e1b Data flow: Fix inconsistencies 2021-06-17 10:48:32 +02:00
Tom Hvitved
00e544189e Data flow: Add consistency queries 2021-06-17 10:26:56 +02:00