Tom Hvitved
44b734e120
Merge pull request #13955 from hvitved/ruby/type-tracking-capture-insensitive
...
Ruby: Make type tracking flow-insensitive for captured variables
2023-08-15 11:42:41 +02:00
Tom Hvitved
061575ff77
Merge pull request #13937 from hvitved/ruby/for-loop-desugar
...
Ruby: Improve desugaring of `for` loops
2023-08-14 20:12:12 +02:00
Tom Hvitved
e96cbeb00a
Ruby: Adjust locations of synthesized nodes
2023-08-14 14:37:47 +02:00
Tom Hvitved
c084a9b27a
Ruby: Make type tracking flow-insensitive for captured variables
2023-08-14 13:44:37 +02:00
Tom Hvitved
b28f60ccd2
Ruby: Add test for documenting missing flow through destructured parameters
2023-08-10 20:22:11 +02:00
Tom Hvitved
77fca277fe
Ruby: Improve desugaring of for loops
2023-08-10 13:22:01 +02:00
Harry Maclean
142393b599
Ruby: Handle unknown content in splat flow
2023-08-09 15:01:40 +01:00
Harry Maclean
4239268efd
Ruby: Prevent some false flow into splat params
...
In cases where there are positional parameters after a splat parameter,
don't attempt to match the splat parameter to a splat argument. We need
more sophisticated modelling to handle these cases, which is future
work.
2023-08-09 15:01:40 +01:00
Harry Maclean
c0baa5116f
Ruby: add test for example splat arg/param matches
2023-08-09 15:01:40 +01:00
Harry Maclean
72356d1515
Ruby: track flow from *args to positional params
...
This models flow in the following case:
def foo(x, y)
sink x # 1
sink y # 2
end
args = [source 1, source 2]
foo(*args)
We do this by introducing a SynthSplatParameterNode which accepts
content from the splat argument, if one is given at the callsite.
From this node we add read steps to each positional parameter.
2023-08-09 15:01:40 +01:00
Asger F
c38cbe859d
Merge pull request #13737 from asgerf/dynamic/fuzzy-models
...
Dynamic: add Fuzzy token
2023-08-03 09:58:24 +02:00
Alex Ford
f437a6f729
Merge branch 'main' into maikypedia/ldap-injection
2023-07-31 16:00:41 +01:00
Alex Ford
558238a9be
Ruby: update TaintStep test output
2023-07-31 16:00:27 +01:00
Alex Ford
ab1f341aa6
Merge pull request #13566 from alexrford/rb/rack-params
...
Ruby: add `Rack::Request` params and cookies as remote input sources
2023-07-17 14:07:20 +01:00
Asger F
f1c82b650f
Ruby: Implement Fuzzy for Ruby
2023-07-13 15:42:34 +02:00
Asger F
f232669ea5
Ruby: support Proc.new alongside 'proc' and 'lambda'
2023-07-13 11:53:16 +02:00
Asger F
194fe85442
Ruby: Use asCallable() to generate epsilon edges
2023-07-13 11:53:16 +02:00
Asger F
452fbe7e8f
Ruby: add test showing lack of lambda handling
2023-07-13 11:53:16 +02:00
Asger F
86b5f0adc7
Revert "Merge pull request #13620 from github/revert-13496-rb/tracking-on-demand"
...
This reverts commit 133de56ac228a8e48351
2023-07-07 09:42:34 +02:00
Alex Ford
082f26bcb1
Ruby: update TaintStep.ql output
2023-07-05 12:19:55 +01:00
Michael Nebel
0665f4f004
Ruby: Update TaintStep expected test output.
2023-07-03 14:36:06 +02:00
Asger F
5d1a437e9c
Revert "Ruby: overhaul API graphs"
2023-06-29 15:39:19 +02:00
Asger F
67032b5d73
Ruby: add test for self.class call
2023-06-28 13:20:58 +02:00
Asger F
0039cb141e
Merge branch 'main' into rb/tracking-on-demand
2023-06-23 12:55:54 +02:00
Jeroen Ketema
c53e529bac
Ruby: Update remaining inline expectation tests to use the paramterized module
2023-06-20 10:16:01 +02:00
Asger F
0110610c6a
Ruby: overhaul API graphs
2023-06-19 12:01:42 +02:00
Jeroen Ketema
d82c3ce11a
Ruby: Rewrite InlineFlowTest as a parameterized module
2023-06-15 10:52:23 +02:00
Anders Schack-Mulligen
1a4fca334f
Merge pull request #13273 from aschackmull/dataflow/summarynode-refactor
...
Dataflow: Refactor FlowSummaryImpl to synthesize nodes independently from DataFlow::Node.
2023-06-14 09:38:36 +02:00
Jeroen Ketema
c3ba206b6a
Merge pull request #13346 from jketema/inline-2
...
Update inline expectation tests to use parameterized module
2023-06-13 10:10:55 +02:00
Anders Schack-Mulligen
0c62901a67
Ruby: Fix tests.
2023-06-09 15:39:18 +02:00
Asger F
d47477bd3b
Ruby: update line numbers in expectation file
2023-06-09 14:52:21 +02:00
Asger F
a50d91ea48
Ruby: fix bug in filter_map summary
2023-06-09 14:31:10 +02:00
Jeroen Ketema
4485560f43
Ruby: Rewrite inline expectation tests to use parameterized module
2023-06-09 10:43:05 +02:00
Tom Hvitved
cee70883f0
Merge pull request #12964 from hvitved/ruby/remove-synth-returns
...
Ruby: Remove canonical return nodes
2023-06-08 10:07:48 +02:00
Alex Ford
6fa9e13a2e
Ruby: update TaintStep output
2023-06-01 16:27:20 +01:00
Alex Ford
7d943c7621
Ruby: update test output
2023-06-01 13:50:32 +01:00
Alex Ford
baabd2d1fa
Merge pull request #12832 from maikypedia/maikypedia/pg-sqli
...
Ruby: Add SQL Injection Sinks
2023-05-26 11:36:17 +01:00
Alex Ford
609319da20
ruby: update TaintStep.ql test output
2023-05-25 17:53:01 +01:00
Tom Hvitved
13ada1e6ad
Ruby: Remove canonical return nodes
2023-05-24 11:11:50 +02:00
Asger F
6d1a4451fb
Ruby: update a test expectation
2023-05-24 10:15:51 +02:00
Kasper Svendsen
6b8a7c2f6f
Ruby: Make implicit this receivers explicit
2023-05-10 13:03:39 +02:00
Anders Schack-Mulligen
09d4fe21e8
Ruby: Update more expected output.
2023-04-26 13:37:07 +02:00
Anders Schack-Mulligen
90f84bb516
Ruby: Update expected output.
2023-04-26 13:08:16 +02:00
Asger F
8c0c335daf
Ruby: update test output
2023-04-17 12:47:23 +02:00
Arthur Baars
8b90d021fa
Ruby: change evaluation order of destructured assignments
2023-03-24 16:57:25 +01:00
Tom Hvitved
b816c79248
Ruby: Include all assignments in data flow paths
2023-03-24 10:09:30 +01:00
Tom Hvitved
5260d9815a
Merge pull request #12582 from hvitved/ruby/element-of-type-content-set
...
Ruby: Introduce `ContentSet::isElementOfType[OrUnknown]/1`
2023-03-21 13:41:15 +01:00
Tom Hvitved
a9ef3f95a2
Ruby: Introduce ContentSet::isElementOfType[OrUnknown]/1
2023-03-20 10:03:15 +01:00
Alex Ford
e84b08409c
Ruby: test fixes
2023-03-17 12:08:38 +00:00
Tom Hvitved
1d0b3d4112
Ruby: Ssa::WriteDefinition::getWriteAccess should return a CFG node
2023-03-16 11:28:24 +01:00
