6 Commits

Author	SHA1	Message	Date
Joe Farebrother	0b7b7ea1b8	Add test cases and improve controller model	2024-03-01 09:57:24 +00:00
erik-krogh	5a98f66bef	simplify the modeling of html_safe. Any call to html_safe is now considered an XSS sink	2022-10-18 10:43:22 +02:00
Harry Maclean	0e6322d673	Ruby: Restrict XSS header sinks ... Not all header writes are relevant to XSS. Restrict these to just content-type and access-control-allow-origin.	2022-10-17 09:34:44 +13:00
Harry Maclean	8ae86cf443	Ruby: Consider header writes as XSS sinks	2022-10-17 08:17:37 +13:00
Harry Maclean	4686718630	Ruby: Add kind to Http::Server::RequestInputAccess ... Like in JS, this describes whether the input came from the request URL, body, parameters, headers or cookie. Only some of these are relevant for UrlRedirect and ReflectedXSS queries.	2022-10-13 13:24:16 +13:00
Arthur Baars	976daddd36	Move files to ruby subfolder	2021-10-15 11:47:28 +02:00