Tom Hvitved
9c4c35141a
Ruby: Update type tracker test
2022-03-07 11:51:54 +01:00
Tom Hvitved
c1db0a9429
Merge pull request #8317 from hvitved/typetracker/jump-step
...
Ruby/Python: Clear call contexts after jump steps in type tracking
2022-03-07 11:38:51 +01:00
Alex Ford
98dbe3aaf3
Ruby: make ActiveRecord Persistence::ModifyAndSaveCall private
2022-03-05 18:22:32 +00:00
Alex Ford
8fed9f9aa0
Ruby: ActiveRecord - match OrmWriteAccesses for assignements to the assignment node rather than the setter call
2022-03-04 17:24:24 +00:00
Arthur Baars
cd5c71e85e
Ruby: cache regExpSource/1 instead of isInterpretedAsRegExp
2022-03-04 10:15:22 +01:00
Harry Maclean
1181779c10
Merge pull request #7920 from github/hmac/string-flow-summaries
...
Ruby: Add String flow summaries
2022-03-04 09:09:19 +13:00
Arthur Baars
b79d08523c
Merge pull request #8293 from aibaars/regex-pattern-source
...
Ruby: parse more string literals as regular expressions
2022-03-03 17:35:40 +01:00
Arthur Baars
22b0697371
Update ruby/ql/lib/codeql/ruby/security/performance/ParseRegExp.qll
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2022-03-03 17:13:19 +01:00
Tom Hvitved
9d6d479fba
Add missing QL doc
2022-03-03 14:17:41 +01:00
Tom Hvitved
b23ab8089a
Ruby: Clear call contexts after jump steps in type tracking
2022-03-03 12:29:47 +01:00
Harry Maclean
4a43731b83
Ruby: Use SimpleSummarizedCallable
...
This simplifies some String flow summaries.
2022-03-03 10:49:44 +13:00
Arthur Baars
692fc4cb02
Update ruby/ql/lib/change-notes/2022-02-28-regex-string-literals.md
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-03-02 21:13:23 +01:00
Harry Maclean
37dac186a8
Ruby: String.try_convert isn't value-preserving
...
`String.try_convert` can convert arbitrary objects to strings, which
obviously isn't value-preserving.
2022-03-02 13:31:59 +13:00
Arthur Baars
169f65526e
Merge pull request #8292 from aibaars/api-graphs-private
...
Ruby: ApiGraphs: use private imports
2022-03-02 00:35:46 +01:00
Asger Feldthaus
df379809df
Ruby: support CSV rows of form ;any;Method[foo]
2022-03-01 14:08:21 +01:00
Asger Feldthaus
05ea33033b
Ruby: add test for API::EntryPoint
2022-03-01 14:08:21 +01:00
Asger Feldthaus
bf83400bd2
Ruby: port API::EntryPoint from JS
2022-03-01 14:08:21 +01:00
Asger Feldthaus
e10e3b9466
Ruby: convert ActiveStorage::Filename model to MaD
2022-03-01 14:08:21 +01:00
Asger Feldthaus
e6a3747656
Ruby: add test for ActiveStorage.Filename.new
2022-03-01 14:08:21 +01:00
Asger Feldthaus
70c083fa64
Ruby: convert Regexp.escape model to MaD
2022-03-01 14:08:21 +01:00
Asger Feldthaus
cbd044a768
Ruby: add a code injection test for flwo through Regexp.escape
2022-03-01 14:08:21 +01:00
Asger Feldthaus
63e7c16d6b
Ruby: add test with sinks and type-defs
2022-03-01 14:08:20 +01:00
Asger Feldthaus
388949f12e
Ruby: support WithBlock and WithoutBlock
2022-03-01 14:08:20 +01:00
Asger Feldthaus
d6bc9c259e
Ruby: add simple test case
2022-03-01 14:08:20 +01:00
Asger Feldthaus
a33e89279d
Ruby: instantiate ApiGraphModels library in Ruby
2022-03-01 14:08:20 +01:00
Arthur Baars
b2745d44f2
Ruby: update ReDoS.expected
2022-03-01 13:30:56 +01:00
Arthur Baars
61fa3ba314
Add change note
2022-03-01 13:30:56 +01:00
Arthur Baars
a51f17e0ed
Ruby: introduce RegExpPatternSource
2022-03-01 13:30:51 +01:00
Arthur Baars
1240c11c4b
Ruby: parse some string literals as regex
...
In addition to regex literals, also parse normal string literals
as regular expressions if they somehow "flow" into a method call
that is known to interpret string values as regular expressions.
2022-03-01 13:26:51 +01:00
Tamás Vajk
94cb5c2be4
Merge pull request #8296 from github/post-release-prep/codeql-cli-2.8.2
...
Post-release preparation for codeql-cli-2.8.2
2022-03-01 11:57:36 +01:00
github-actions[bot]
980f822983
Post-release preparation for codeql-cli-2.8.2
2022-03-01 09:24:30 +00:00
Arthur Baars
7e6ef7ac74
Ruby: ApiGraphs: use private imports
2022-03-01 10:24:19 +01:00
Arthur Baars
5ce6b847d1
Merge pull request #8166 from aibaars/regex-char-sequence-1
...
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-28 17:47:53 +01:00
Alex Ford
6ddacce27a
Ruby: Add OrmWriteAccess concept changenote
2022-02-28 01:18:39 +00:00
Alex Ford
63ef9a75c9
Ruby: model OrmWriteAccesses for ActiveRecord
2022-02-28 01:18:39 +00:00
Alex Ford
b1fd321b65
Ruby: update Rails framework test output for existing tests
2022-02-28 01:13:26 +00:00
Alex Ford
283a48c76d
Ruby: tests for OrmWriteAccess
2022-02-28 01:12:49 +00:00
Alex Ford
8c6c680a28
Ruby: Add OrmWriteAccess concept
2022-02-28 01:11:40 +00:00
Arthur Baars
0c23f5815f
Add change note
2022-02-25 18:43:43 +01:00
Arthur Baars
5044f89105
Ruby/Python re-introduce normalCharacterSequence
2022-02-25 18:43:43 +01:00
Asger F
a8bfebaeb6
Merge pull request #8149 from asgerf/shared/use-shared-access-path-syntax
...
Shared: use shared access path syntax to parse arguments in CSV rows
2022-02-25 14:04:18 +01:00
CodeQL CI
0f125d1e8a
Merge pull request #8234 from asgerf/ruby/meta-queries
...
Approved by nickrolfe
2022-02-25 12:46:15 +00:00
Arthur Baars
9d9abaf1f9
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-02-25 12:27:20 +01:00
github-actions[bot]
20fe22c8c8
Release preparation for version 2.8.2
2022-02-24 14:57:08 +00:00
Harry Maclean
fc351fbd64
Ruby: Remove value-flow for name-matched summaries
...
String summaries that are identified by name only should not specify
value-preserving flow as this can cause spurious flow in cases where
they are applied to different but identically-named methods.
2022-02-24 16:15:15 +13:00
Harry Maclean
07369916b0
Ruby: Remove bad flow to/from block arguments
...
In these cases there is no block argument to the method call.
2022-02-24 14:44:59 +13:00
Asger Feldthaus
f1bfb31403
Shared: fix typo in a comment
2022-02-23 14:13:41 +01:00
Asger Feldthaus
bb9348d77f
Ruby: reject ArrayElement[-n] instead of interpreting it as ArrayElement[?]
2022-02-23 14:13:41 +01:00
Asger Feldthaus
a11c6f0f8e
Ruby: use AccessPathSyntax library
2022-02-23 14:13:40 +01:00
Asger Feldthaus
5cab737ef1
Shared: sync AccessPathSyntax.qll
2022-02-23 14:13:40 +01:00
