Rasmus Lerchedahl Petersen
2daa9577bb
ruby/python: implement shared module
...
ruby:
- create new shared file `SummaryTypeTracker.qll`
- move much logic into the module
- instantiate the module
- remove old logic, now provided by module
python:
- clone shared file
- instantiate module
- use (some of the) steps provided by the module
2023-05-30 13:31:24 +02:00
Maiky
03b7c5e5e8
naming error
2023-05-29 16:34:40 +02:00
Harry Maclean
e70e3e52dc
Ruby: fix typo in qhelp
2023-05-29 04:05:42 +00:00
Harry Maclean
ca1024e285
Ruby: Reword unsafe deserialization qhelp
2023-05-29 03:46:30 +00:00
Harry Maclean
e515981c81
Ruby: Remove unused examples
2023-05-27 12:01:00 +00:00
Harry Maclean
562065f29e
Ruby: Add change note
2023-05-27 01:20:09 +00:00
Harry Maclean
b8c3cba4ff
Ruby: Consolidate unsafe deserialization queries
...
Merge the experimental YAMLUnsafeDeserialization and
PlistUnsafeDeserialization queries into the generate
UnsafeDeserialization query in the default suite.
These queries look for some specific sinks that we now find in the
general query.
Also apply some small code and comment refactors.
2023-05-27 01:20:04 +00:00
amammad
d727d573d5
v4.2 write exact version of yaml.load default loader change
2023-05-27 01:15:29 +00:00
amammad
40e24b6b94
v4.1 fix file names in qhelp
2023-05-27 01:15:29 +00:00
amammad
335441ce04
v4: make variable names camelCase, some inhancement, remove some duplicates
2023-05-27 01:15:29 +00:00
amammad
e76ed9454a
v3 add global taint steps for to_ruby of YAML/Psych
2023-05-27 01:15:24 +00:00
amammad
ad7e107ff5
add the new YAML/PLIST sinks into the existing rb/unsafe-deserialization query
2023-05-27 01:14:36 +00:00
amammad
b9296d3df8
v2.1 fix file names
2023-05-27 01:14:36 +00:00
amammad
4360a56b45
v2 add plist.parse_xml as a dangerous sink and enhancements on documents
2023-05-27 01:14:36 +00:00
amammad
0521ffe175
v1.4 correct dirs uppercase issue
2023-05-27 01:14:36 +00:00
amammad
0e343e5a12
v1.3
2023-05-27 01:14:36 +00:00
amammad
d96153a05e
v1.2 change to PascalCase
2023-05-27 01:14:36 +00:00
amammad
e4b8a0e06d
v1.1
2023-05-27 01:14:36 +00:00
amammad
486a5ac96f
v1
2023-05-27 01:14:36 +00:00
Asger F
3831dc7785
Merge pull request #13288 from asgerf/rb/super-and-flow-through
...
Ruby: two bug fixes
2023-05-26 15:04:52 +02:00
Asger F
cfaa27ab5d
Ruby: change note
2023-05-26 14:44:00 +02:00
yoff
af1f4c30fb
Merge pull request #13299 from asgerf/rb/meta-query-summarised-callable-sites
...
Ruby/Python: add meta-queries for calls to summarised callables
2023-05-26 13:27:56 +02:00
Arthur Baars
e0466900ad
Merge pull request #12992 from Sim4n6/ruby-UBV
...
[Ruby] Add Unicode Bypass Validation query, test and help file
2023-05-26 13:00:21 +02:00
Alex Ford
baabd2d1fa
Merge pull request #12832 from maikypedia/maikypedia/pg-sqli
...
Ruby: Add SQL Injection Sinks
2023-05-26 11:36:17 +01:00
Michael Nebel
915042a881
Minor cleanup and sync files.
2023-05-26 12:25:00 +02:00
Michael Nebel
58fcbc136c
Ruby: Re-factor getComponent.
2023-05-26 12:25:00 +02:00
Asger F
1c7f6dc32e
Ruby: add meta-query for calls to summarized callables
2023-05-26 11:34:23 +02:00
Alex Ford
609319da20
ruby: update TaintStep.ql test output
2023-05-25 17:53:01 +01:00
Asger F
9e8cef5e1b
Ruby: fix type-tracking flow-through for new->initialize calls
2023-05-25 15:03:38 +02:00
Asger F
93678e5d36
Ruby: fix name of super calls in singleton methods
2023-05-25 15:03:34 +02:00
erik-krogh
9f5bf8fb22
also fix the first code-block
2023-05-25 13:56:29 +02:00
erik-krogh
765076bcba
fix whitespace in the samples in ReDoS.qhelp
2023-05-25 13:28:39 +02:00
Sim4n6
52dd247a81
Removed redundant cast
2023-05-25 11:55:13 +01:00
Sim4n6
09c97ce0da
Added one more example to the qhelp
2023-05-25 09:41:22 +01:00
Sim4n6
7d68f6afc9
added ActiveSupport::Multibyte::Chars normalize() sink
2023-05-25 09:21:55 +01:00
Sim4n6
d772bb213a
Added three more Unicode Normalization sinks
2023-05-25 03:10:00 +01:00
Maiky
40450a2792
typo
2023-05-24 17:02:48 +02:00
github-actions[bot]
d2e192020b
Post-release preparation for codeql-cli-2.13.3
2023-05-24 11:26:12 +00:00
Tom Hvitved
13ada1e6ad
Ruby: Remove canonical return nodes
2023-05-24 11:11:50 +02:00
Tom Hvitved
deee314370
Python/Ruby: Optimize join-order in TypeTracker::[small]step
2023-05-24 11:11:07 +02:00
Tom Hvitved
05f3934042
Merge pull request #13251 from hvitved/ruby/call-graph-self-param
...
Ruby: Include both `self` parameters and SSA definitions in call graph construction
2023-05-24 11:10:34 +02:00
Asger F
818753e922
Merge pull request #13265 from asgerf/rb/delete-name-clash
...
Ruby: fix some name clashes between summarized callables
2023-05-24 11:08:56 +02:00
Tom Hvitved
b486a4d52c
Merge pull request #13255 from hvitved/ruby/ssa-param-capture-input
...
Ruby: Include underlying SSA parameter definition in `localFlowSsaParamCaptureInput`
2023-05-24 10:40:54 +02:00
Asger F
8bd6f6c450
Ruby: change note
2023-05-24 10:22:22 +02:00
Asger F
6d1a4451fb
Ruby: update a test expectation
2023-05-24 10:15:51 +02:00
Maiky
27c1e47ece
Update ruby/ql/lib/change-notes/2023-05-06-pg.md
...
Co-authored-by: Jorge <46056498+jorgectf@users.noreply.github.com >
2023-05-24 01:44:51 +02:00
Maiky
8dca585207
Expected
2023-05-23 20:04:34 +02:00
Maiky
ad5355a04a
Pg Library, change note and Frameworks.qll
2023-05-23 19:49:03 +02:00
Arthur Baars
e33f3a6668
Merge pull request #13154 from aibaars/sync-dbscheme-py
...
JS/Ruby/QL/Python: sync dbscheme fragments
2023-05-23 19:14:29 +02:00
Sim4n6
90c174de4e
Updated the .expected file accordingly
2023-05-23 17:36:50 +01:00
