Rasmus Wriedt Larsen
98c0d73ffe
Merge pull request #8524 from RasmusWL/ruby-update-ssrf-concept
...
Ruby: Minor change of SSRF concept
2022-03-24 13:48:06 +01:00
Arthur Baars
74aea81fe3
Ruby: refactor regex libraries
2022-03-24 11:37:02 +01:00
Arthur Baars
65f8f56095
Merge branch 'main' into incomplete-url-string-sanitization
2022-03-24 11:27:30 +01:00
Arthur Baars
496aab78a7
Merge pull request #8535 from aibaars/setter-method-arg-location
...
Ruby: fix location of setter-call argument
2022-03-24 11:26:13 +01:00
Harry Maclean
28a430a2f2
Ruby: Fix bad name of lambda in test
...
This isn't the identity function, so it's confusing for it to be named
so.
2022-03-24 12:44:41 +13:00
Asger Feldthaus
ce54eb3c78
Ruby: Add Argument[foo:] syntax for keyword arguments
2022-03-23 18:06:12 +01:00
Asger Feldthaus
6d84baf276
Ruby: Support self,block in Argument/Parameter tokens
2022-03-23 18:06:12 +01:00
Arthur Baars
06a99c3987
Ruby: fix location of setter-call argument
2022-03-23 12:55:52 +01:00
Rasmus Wriedt Larsen
9254b2904e
Ruby: Adjust HttpClients test
2022-03-22 11:19:55 +01:00
Tom Hvitved
99ddfb489f
Ruby: Rework getConstantValue implementation
2022-03-22 10:07:44 +01:00
Harry Maclean
99b5c580a5
Ruby: Fix captured reads in lambdas
...
These were previously identified as method calls. The fix is to
recognise lambdas as a scope which can inherit variables from its
parent.
2022-03-22 15:35:43 +13:00
Harry Maclean
c891e62a0e
Ruby: Add some tests for method calls in lambdas
...
This reveals a bug where we identify reads of captured variables in
lambdas as method calls. This is fixed in a followup commit.
2022-03-22 15:33:22 +13:00
Harry Maclean
ff1d96c922
Ruby: Add rb/http-to-file-access query
2022-03-22 11:09:08 +13:00
Harry Maclean
6c18e1d7ac
Merge pull request #8272 from hmac/hmac/tainted-format-string
2022-03-22 08:37:47 +13:00
Alex Ford
c891c53835
Merge pull request #8395 from alexrford/ruby/clear-text-storage
...
Ruby: add `rb/clear-text-storage-sensitive-data` query
2022-03-21 10:05:39 +00:00
Harry Maclean
5a6da827d0
Ruby: Avoid FP in TaintedFormatString query
...
Kernel#printf supports two call signatures:
printf(String, *args)
printf(IO, String, *args)
We want to identify the String argument, which is the format string.
Previously we would return the 0th and 1st arguments, which gives some
FPs when the 1st arg is not a format string.
We now try to rule out the trivial case by checking if arg 0 has a
string value, and then assuming it is the format string. Otherwise we
fall back to returning both arguments.
This still has some false positive potential, but less than previously.
2022-03-21 12:51:47 +13:00
Harry Maclean
4249e30824
Ruby: Test tainted interpolated format arg
2022-03-21 12:51:18 +13:00
Harry Maclean
f6215d4c7e
Ruby: Add rb/tainted-format-string query
2022-03-21 12:51:18 +13:00
Arthur Baars
bf888f0f0b
Merge remote-tracking branch 'upstream/main' into incomplete-url-string-sanitization
...
Conflicts:
config/identical-files.json
javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.ql
javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qll
ruby/ql/src/queries/security/cwe-020/IncompleteUrlSubstringSanitization.qll
2022-03-18 16:09:20 +01:00
Arthur Baars
431b60506e
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-18 13:05:34 +01:00
Arthur Baars
1a51f0cf56
Ruby: regex: fix getGroupNumber
...
non-capture groups should not have a group number
2022-03-16 18:50:51 +01:00
Arthur Baars
fb8cc6e1a4
Ruby: String.index method returns 'nil', not '-1'
2022-03-16 16:18:19 +01:00
Asger F
228570129e
Merge branch 'main' into ruby/mad-prototype
2022-03-16 13:50:31 +01:00
Asger Feldthaus
2ca45ef9f9
Ruby: support BlockArgument in identifying access path
2022-03-16 12:51:14 +01:00
Nick Rolfe
94ce578ea4
Ruby: implement getComponent(n) for simple and hash-key symbols
2022-03-16 11:43:46 +00:00
Asger Feldthaus
71f195d1e0
Ruby: add test for Receiver in summary
2022-03-16 12:37:21 +01:00
Arthur Baars
6b323eeda8
Update expected output
2022-03-16 12:34:03 +01:00
Arthur Baars
ab93b3784b
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-16 12:31:12 +01:00
Nick Rolfe
76918238f0
Ruby: test ExprCfgNode::getConstantValue()
2022-03-16 11:21:57 +00:00
Asger Feldthaus
7f8205684e
Ruby: verify tokens in identifying access path
2022-03-15 10:25:59 +01:00
Asger Feldthaus
65249dabd3
Ruby: add warning for wrong number of columns in CSV row
2022-03-15 09:28:21 +01:00
Nick Rolfe
488c8ef609
Ruby: accept test changes after adding more literals
2022-03-14 15:49:22 +00:00
Nick Rolfe
a39aed52c6
Ruby: add more tests for edge cases in parsing of integers
2022-03-14 15:45:57 +00:00
Nick Rolfe
6c5868cfb5
Ruby: use NumberUtils in parseInteger
...
And make parse{Binary,Octal,Hex}Int hold only for values in the range
0 to 2^31-1 (incl.)
2022-03-14 15:45:57 +00:00
Nick Rolfe
6bd9616c6e
Ruby: interpret string escape sequences in getConstantValue()
2022-03-14 15:45:57 +00:00
Alex Ford
40b87e6df7
Ruby: tests for rb/weak-cryptographic-algorithm
2022-03-13 21:25:24 +00:00
Alex Ford
0f0a51e2e0
Ruby: update test output
2022-03-10 18:27:06 +00:00
Alex Ford
43fb759dfa
Ruby: add a few more rb/clear-text-storage-sensitive-data test cases
2022-03-10 17:52:50 +00:00
Alex Ford
37c0702cdd
Ruby: update test output
2022-03-10 17:50:29 +00:00
Alex Ford
0f3cf47ca9
Ruby/JS/Py: Add "random" to the notSensitiveRegexp() heuristic
2022-03-10 17:38:52 +00:00
Alex Ford
8be1be388e
Ruby: update CleartextStorage test output for source locations
2022-03-10 17:38:52 +00:00
Alex Ford
ef29a372a4
Ruby: Cleartext storage tests
2022-03-10 17:38:52 +00:00
Alex Ford
19c7f7be46
Merge pull request #8271 from github/alexrford/ruby/orm-write-access
...
Ruby: Add `OrmWriteAccess` concept to model writes to a DB using an ORM
2022-03-10 17:35:02 +00:00
Tom Hvitved
d4808a7b4a
Merge pull request #8389 from hvitved/ruby/regex-unique-get-value
...
Ruby: Avoid multiple `RegExpEscape::getValue` results
2022-03-10 15:53:28 +01:00
Tom Hvitved
208851cb91
Merge pull request #7084 from hvitved/ruby/self-flow
...
Ruby: Cleanup flow through `self`
2022-03-10 10:50:24 +01:00
Tom Hvitved
76663f80f0
Ruby: Avoid multiple RegExpEscape::getValue results
2022-03-10 10:32:24 +01:00
Tom Hvitved
0d71f0ab40
Ruby: Add regex unicode test
2022-03-10 10:30:17 +01:00
Tom Hvitved
37f5db5baa
Ruby: Reduce captureFlow(In|Out)
...
When there is flow in/out of a block through a captured variable, we can restrict
the calls that give rise to the flow to the method calls to which the blocks
belong.
2022-03-10 10:21:51 +01:00
Alex Ford
edf8a3f810
Ruby: update test output
2022-03-10 00:17:29 +00:00
Alex Ford
8abee165a5
Ruby: test cases for PersistentWriteAccess in rails model class
2022-03-09 22:35:40 +00:00
