github-actions[bot]
1a25457178
Post-release preparation for codeql-cli-2.9.1
2022-05-05 19:05:50 +00:00
github-actions[bot]
8e4cf190e9
Release preparation for version 2.9.1
2022-04-28 11:59:05 +00:00
Harry Maclean
ba1d43dd42
Merge pull request #8658 from hmac/hmac/insecure-download
...
Ruby: Add InsecureDownload query
2022-04-28 11:07:35 +12:00
Harry Maclean
f4453f4da2
Merge pull request #8573 from hmac/hmac/missing-regexp-anchor
...
Ruby: Add MissingRegExpAnchor query
2022-04-28 11:06:33 +12:00
Erik Krogh Kristensen
e1c7d369be
Merge pull request #8796 from erik-krogh/redundantImport
...
Remove redundant imports
2022-04-27 12:39:51 +02:00
Harry Maclean
f35379bf8c
Ruby: Add change note for rb/insecure-download
2022-04-27 12:47:09 +12:00
Harry Maclean
bb3fb0325b
Ruby: Add InsecureDownload query
...
This query finds cases where a potentially unsafe file is downloaded
over an unsecured connection.
2022-04-27 12:47:09 +12:00
Harry Maclean
bbc3043836
Add change note for rb/regex/missing-regexp-anchor
2022-04-27 10:12:33 +12:00
Harry Maclean
af2965c2a0
Explain anchors in MissingRegExpAnchor qlhelp
2022-04-27 10:12:33 +12:00
Harry Maclean
6f9dc5eb7e
Ruby: Update import for file move
2022-04-27 10:12:33 +12:00
Harry Maclean
2feb4a48be
Ruby: Add hasMisleadingAnchorPrecedence to MissingRegExpAnchor
2022-04-27 10:12:33 +12:00
Harry Maclean
e3c3c00c68
Ruby: Add MissingRegExpAnchor query
2022-04-27 10:12:33 +12:00
Nick Rolfe
649d7dd022
Merge pull request #8607 from github/nickrolfe/incomplete_sanitization
...
Ruby: port of `js/incomplete-sanitization`
2022-04-26 17:10:24 +01:00
Erik Krogh Kristensen
d389012b75
Merge branch 'main' into redundantImport
2022-04-26 14:24:51 +02:00
Mathias Vorreiter Pedersen
aca4c8727f
Merge pull request #8802 from github/post-release-prep/codeql-cli-2.9.0
...
Post-release preparation for codeql-cli-2.9.0
2022-04-25 22:52:55 +01:00
Erik Krogh Kristensen
ff73dbc35c
delete redundant imports
2022-04-22 12:55:28 +02:00
Erik Krogh Kristensen
a737350f27
RB: dont import the PathGraph module from Query.qll files
2022-04-22 11:46:06 +02:00
github-actions[bot]
1aecfc67c2
Post-release preparation for codeql-cli-2.9.0
2022-04-21 19:22:19 +00:00
github-actions[bot]
eeaf233c29
Release preparation for version 2.9.0
2022-04-21 14:49:00 +00:00
Nick Rolfe
9b2a98326c
Ruby: update use of PostUpdateNode now that it's public
2022-04-20 12:08:41 +01:00
Nick Rolfe
9b6e610e24
Merge remote-tracking branch 'origin/main' into nickrolfe/incomplete_sanitization
2022-04-20 12:05:22 +01:00
Nick Rolfe
08f6fbbe10
Ruby: make comment about backslash escaping clearer
2022-04-19 14:05:17 +01:00
Nick Rolfe
76c6a521fd
Ruby: add clarifying comment
2022-04-19 13:10:57 +01:00
Nick Rolfe
76587c4144
Ruby: fix capitalisation of String in qhelp
2022-04-19 11:42:31 +01:00
Nick Rolfe
ac805f0cdc
Ruby: simplify predicate by using DataFlow::CallNode
2022-04-19 11:27:33 +01:00
Nick Rolfe
ca4dc0583d
Ruby: fix comment typos
2022-04-19 11:15:34 +01:00
Harry Maclean
c3f1fba985
Merge pull request #8598 from hmac/hmac/insecure-dep-resolution
...
Ruby: Add rb/insecure-dependency query
2022-04-14 02:09:44 +02:00
Nick Rolfe
a1a7d2c088
Ruby: add changenote for rb/incomplete-sanitization
2022-04-13 17:32:38 +01:00
Nick Rolfe
fdca896614
Ruby: improve handling of [g]sub!
...
rb/incomplete-sanitization has a few cases where we find flow from one
one string substitution call to another, e.g.
a.sub(...).sub(...)
But this didn't find typical chained uses of the destructive variants,
e.g.
a.sub!(...)
a.sub!(...)
We now handle those cases by tracking flow from the post-update node for
the receiver of the first call.
2022-04-13 17:19:25 +01:00
Nick Rolfe
bbb8177176
Ruby: add rc/incomplete-sanitization query
2022-04-13 16:48:43 +01:00
Edoardo Pirovano
f25618eed6
Bump minor version of all packs
2022-04-08 15:38:58 +01:00
Edoardo Pirovano
ce82c54b94
Merge branch 'main' into edoardo/3.5-mergeback
2022-04-08 15:30:58 +01:00
github-actions[bot]
6af568b16d
Post-release preparation for codeql-cli-2.8.5
2022-04-01 16:22:14 +00:00
github-actions[bot]
ee746d20df
Release preparation for version 2.8.5
2022-04-01 10:39:31 +00:00
Harry Maclean
ae60d40511
Ruby: Fix typo in rb/insecure-dependency qhelp
...
Co-authored-by: Nick Rolfe <nickrolfe@github.com >
2022-04-01 15:35:53 +13:00
Alex Ford
882f78c6f9
Merge remote-tracking branch 'origin/main' into ruby/weak-cryptographic-algorithm
2022-03-31 17:17:46 +01:00
Tom Hvitved
40986bfcb1
Ruby: Fix broken import
2022-03-31 12:32:03 +02:00
Arthur Baars
15c54f6100
Merge pull request #8354 from aibaars/incomplete-url-string-sanitization
...
Incomplete url string sanitization
2022-03-31 10:59:51 +02:00
Harry Maclean
d13bbbaf35
Ruby: Add change note for rb/insecure-dependency
2022-03-30 13:39:35 +13:00
Harry Maclean
37cedda63a
Ruby: Add InsecureDependencyResolution query
...
This query looks for places in a Gemfile where URLs with insecure
protocols (HTTP or FTP) are specified.
2022-03-30 13:39:15 +13:00
Arthur Baars
85c4daa2bf
Address comments
2022-03-28 13:15:32 +02:00
Arthur Baars
74aea81fe3
Ruby: refactor regex libraries
2022-03-24 11:37:02 +01:00
Arthur Baars
65f8f56095
Merge branch 'main' into incomplete-url-string-sanitization
2022-03-24 11:27:30 +01:00
Harry Maclean
91a7e9405c
Share HttpToFileAccessQuery between JS and Ruby
...
There's so little in this query that it may not be worth sharing, but
it's an interesting exercise in figuring out how we do it nicely.
2022-03-22 11:10:08 +13:00
Harry Maclean
ff1d96c922
Ruby: Add rb/http-to-file-access query
2022-03-22 11:09:08 +13:00
Harry Maclean
6c18e1d7ac
Merge pull request #8272 from hmac/hmac/tainted-format-string
2022-03-22 08:37:47 +13:00
github-actions[bot]
a3e74efc21
Post-release preparation for codeql-cli-2.8.4
2022-03-21 19:36:47 +00:00
github-actions[bot]
dedc8c2254
Release preparation for version 2.8.4
2022-03-21 13:25:49 +00:00
Alex Ford
c891c53835
Merge pull request #8395 from alexrford/ruby/clear-text-storage
...
Ruby: add `rb/clear-text-storage-sensitive-data` query
2022-03-21 10:05:39 +00:00
Harry Maclean
c73dc8ad0c
Ruby: Add change note for rb/tainted-format-string
2022-03-21 12:51:47 +13:00
