Alex Ford
4618000567
Ruby: move an import into CleartextStorage.ql
2022-03-10 17:38:52 +00:00
Alex Ford
853fbe8911
Ruby: Fix CleartextStorageCustomizations to use PersistentWriteAccess
2022-03-10 17:38:52 +00:00
Alex Ford
a1a7c31661
Ruby: drop an outdated TODO
2022-03-10 17:38:52 +00:00
Alex Ford
9fe7d6e143
Ruby: fix typo
...
Co-authored-by: Harry Maclean <hmac@github.com >
2022-03-10 17:38:52 +00:00
Alex Ford
0070e30377
Ruby: Add rb/clear-text-storage-sensitive-data query
2022-03-10 17:38:52 +00:00
Alex Ford
7084718b07
Ruby: factor out common parts of CleartextLoggingCustomizations into CleartextSources
2022-03-10 17:38:52 +00:00
Alex Ford
19c7f7be46
Merge pull request #8271 from github/alexrford/ruby/orm-write-access
...
Ruby: Add `OrmWriteAccess` concept to model writes to a DB using an ORM
2022-03-10 17:35:02 +00:00
Tom Hvitved
d4808a7b4a
Merge pull request #8389 from hvitved/ruby/regex-unique-get-value
...
Ruby: Avoid multiple `RegExpEscape::getValue` results
2022-03-10 15:53:28 +01:00
Tom Hvitved
76663f80f0
Ruby: Avoid multiple RegExpEscape::getValue results
2022-03-10 10:32:24 +01:00
Tom Hvitved
37f5db5baa
Ruby: Reduce captureFlow(In|Out)
...
When there is flow in/out of a block through a captured variable, we can restrict
the calls that give rise to the flow to the method calls to which the blocks
belong.
2022-03-10 10:21:51 +01:00
Alex Ford
ace60df619
Ruby: add missing qldoc
2022-03-10 00:00:02 +00:00
Alex Ford
a040b67434
Ruby: drop some redundant extends classes
2022-03-09 19:13:58 +00:00
Alex Ford
d85424d0e0
Ruby: Drop ActiveRecord::Persistence.ModifyAndSaveCall
2022-03-09 19:10:53 +00:00
Alex Ford
19c413d5fb
Ruby: Drop setsKeyValuePair/2 predicate from ActiveRecord::Persistence.ModifyAndSaveCall
2022-03-09 19:09:18 +00:00
Alex Ford
ee433637f8
Ruby: replace OrmWriteAccess with PersistentWriteAccess concept
2022-03-09 18:59:16 +00:00
Tom Hvitved
aa1284aa03
Ruby: Cache two more data flow predicates
2022-03-09 13:17:14 +01:00
Tom Hvitved
1e1b2e284d
Ruby: Cleanup flow through self
2022-03-09 13:17:11 +01:00
Tom Hvitved
f5fbf50d7d
Ruby: Fix incorrect parsing of ranges
2022-03-08 19:53:17 +01:00
Tom Hvitved
5f48cc06bb
Ruby: Fix off-by-one error in getGroupName
2022-03-08 15:59:47 +01:00
Tom Hvitved
3bc8d0878f
Ruby: Add regex consistency queries
2022-03-08 10:10:14 +01:00
Tom Hvitved
6d4eecff14
Ruby: Fix regex parsing of /[|]/
2022-03-08 09:52:06 +01:00
Arthur Baars
49b4fe77ad
Add missing QLdoc
2022-03-07 17:59:06 +01:00
Arthur Baars
a1873cc803
Ruby: IncompleteUrlSubstringSanitization.ql
2022-03-07 16:17:32 +01:00
Arthur Baars
c9fa1fb5bb
Ruby: copy JS version of IncompleteUrlSubstringSanitization.ql
2022-03-07 16:17:08 +01:00
Arthur Baars
98f56f4d60
Js/Ruby: Share IncompleteHostnameRegExp.ql
2022-03-07 16:10:08 +01:00
Arthur Baars
9e8930c192
Ruby: IncompleteHostnameRegExp.ql
2022-03-07 16:10:08 +01:00
Arthur Baars
602538d1c1
Ruby: add RegExpPatterns module
2022-03-07 16:09:12 +01:00
Arthur Baars
95027e746c
Ruby: TypeTracker: add smallstep for functions that return their arguments
2022-03-07 11:51:54 +01:00
Tom Hvitved
c1db0a9429
Merge pull request #8317 from hvitved/typetracker/jump-step
...
Ruby/Python: Clear call contexts after jump steps in type tracking
2022-03-07 11:38:51 +01:00
Alex Ford
98dbe3aaf3
Ruby: make ActiveRecord Persistence::ModifyAndSaveCall private
2022-03-05 18:22:32 +00:00
Alex Ford
8fed9f9aa0
Ruby: ActiveRecord - match OrmWriteAccesses for assignements to the assignment node rather than the setter call
2022-03-04 17:24:24 +00:00
Arthur Baars
cd5c71e85e
Ruby: cache regExpSource/1 instead of isInterpretedAsRegExp
2022-03-04 10:15:22 +01:00
Harry Maclean
1181779c10
Merge pull request #7920 from github/hmac/string-flow-summaries
...
Ruby: Add String flow summaries
2022-03-04 09:09:19 +13:00
Arthur Baars
b79d08523c
Merge pull request #8293 from aibaars/regex-pattern-source
...
Ruby: parse more string literals as regular expressions
2022-03-03 17:35:40 +01:00
Arthur Baars
22b0697371
Update ruby/ql/lib/codeql/ruby/security/performance/ParseRegExp.qll
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2022-03-03 17:13:19 +01:00
Tom Hvitved
9d6d479fba
Add missing QL doc
2022-03-03 14:17:41 +01:00
Tom Hvitved
b23ab8089a
Ruby: Clear call contexts after jump steps in type tracking
2022-03-03 12:29:47 +01:00
Harry Maclean
4a43731b83
Ruby: Use SimpleSummarizedCallable
...
This simplifies some String flow summaries.
2022-03-03 10:49:44 +13:00
Arthur Baars
692fc4cb02
Update ruby/ql/lib/change-notes/2022-02-28-regex-string-literals.md
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-03-02 21:13:23 +01:00
Harry Maclean
37dac186a8
Ruby: String.try_convert isn't value-preserving
...
`String.try_convert` can convert arbitrary objects to strings, which
obviously isn't value-preserving.
2022-03-02 13:31:59 +13:00
Arthur Baars
169f65526e
Merge pull request #8292 from aibaars/api-graphs-private
...
Ruby: ApiGraphs: use private imports
2022-03-02 00:35:46 +01:00
Asger Feldthaus
df379809df
Ruby: support CSV rows of form ;any;Method[foo]
2022-03-01 14:08:21 +01:00
Asger Feldthaus
bf83400bd2
Ruby: port API::EntryPoint from JS
2022-03-01 14:08:21 +01:00
Asger Feldthaus
e10e3b9466
Ruby: convert ActiveStorage::Filename model to MaD
2022-03-01 14:08:21 +01:00
Asger Feldthaus
70c083fa64
Ruby: convert Regexp.escape model to MaD
2022-03-01 14:08:21 +01:00
Asger Feldthaus
388949f12e
Ruby: support WithBlock and WithoutBlock
2022-03-01 14:08:20 +01:00
Asger Feldthaus
a33e89279d
Ruby: instantiate ApiGraphModels library in Ruby
2022-03-01 14:08:20 +01:00
Arthur Baars
61fa3ba314
Add change note
2022-03-01 13:30:56 +01:00
Arthur Baars
a51f17e0ed
Ruby: introduce RegExpPatternSource
2022-03-01 13:30:51 +01:00
Arthur Baars
1240c11c4b
Ruby: parse some string literals as regex
...
In addition to regex literals, also parse normal string literals
as regular expressions if they somehow "flow" into a method call
that is known to interpret string values as regular expressions.
2022-03-01 13:26:51 +01:00
