Stephan Brandauer
c17d8b145a
Merge pull request #8054 from asgerf/js/split-request-forgery
...
JS: split request forgery query into server-side and client-side variants
2022-02-23 10:27:16 +01:00
Arthur Baars
69ed121ecb
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-22 16:15:33 +01:00
Asger Feldthaus
5390faeb8a
Ruby: add query for measuring call graph
2022-02-22 14:42:05 +01:00
Asger Feldthaus
c7c97d5bbb
Ruby: add queries for measuring taint sources and sinks
2022-02-22 14:29:47 +01:00
Harry Maclean
07c70adde5
Ruby: Update CleartextLogging fixture
...
The flow summary for `String#sub` leads to two new results in this test.
They are duplicates of existing results, because the query is quite
liberal in what it considers a source.
```ruby
password = "abc"
password_masked = password.sub(/./, "x")
Logger.new(STDOUT).info password_masked
```
In the example above, the query considers lines 1 and 2 to both be
sources, with a sink at line 3. Previously there was no flow from line 1
to line 3 because of the missing flow summary for `String#sub`, and
therefore there was just one result. Now we have the flow summary, there
are two results.
Line 2 is considered a source because it is an assignment to a variable
that contains the term "password". I'm not sure how to adjust the query
to avoid these duplicates, so I'm leaving them in for now.
2022-02-22 16:58:41 +13:00
Harry Maclean
340288e0d4
Ruby: Update summary access paths for dot syntax
2022-02-22 16:41:16 +13:00
Harry Maclean
d180a55b3a
Ruby: Fix value/taint flow in String summaries
2022-02-22 16:41:16 +13:00
Harry Maclean
f07ae35b87
Ruby: Fix bug with String flow summaries
...
Split summaries for methods with optional block parmaters into separate
classes. Also model the `exclusive` argument to `String#upto`.
2022-02-22 16:41:16 +13:00
Harry Maclean
379de5581d
Ruby: Disable summaries that clash with Array
...
Some String methods are named identically to Array methods, and this
leads to overlapping flow summaries. These adversely affect the original
Array flow summaries.
2022-02-22 16:41:15 +13:00
Harry Maclean
fef46e1ee4
Ruby: Add flow summaries for String methods
2022-02-22 16:41:15 +13:00
Asger F
02c4966109
Merge pull request #7878 from asgerf/dot-separated-access-paths
...
Shared: Switch to dot-separated access paths in summary specs
2022-02-21 13:29:09 +01:00
Alex Ford
9196b64d6e
Merge pull request #8138 from github/ruby/file-write
...
Ruby: Implement `FileSystemWriteAccess` concept
2022-02-21 10:13:27 +00:00
Alex Ford
746290d903
Merge pull request #7713 from github/ruby/clear-text-logging
...
Ruby: Add `rb/clear-text-logging-sensitive-data` query
2022-02-21 10:12:33 +00:00
Asger Feldthaus
7848fcec80
Shared: sync AccessPathSyntax.qll
2022-02-21 08:21:53 +01:00
Asger Feldthaus
55ac5cb012
Shared: auto format
2022-02-21 08:21:53 +01:00
Asger Feldthaus
4985fbb526
Shared: update getSummaryCsv and related test output
2022-02-21 08:21:53 +01:00
Asger Feldthaus
dcc523a2b7
Shared: auto format
2022-02-21 08:21:53 +01:00
Asger Feldthaus
7fcbdbeada
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
2022-02-21 08:21:52 +01:00
Asger Feldthaus
2907d53e17
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
2022-02-21 08:21:52 +01:00
Asger Feldthaus
57bf0b1432
Ruby: remove support for legacy syntax
2022-02-21 08:21:51 +01:00
Asger Feldthaus
e3605eed44
Ruby: update CSV rows to dot-separated syntax
2022-02-21 08:21:50 +01:00
Asger Feldthaus
7005d53a67
Ruby: manually rewrite DigSummary access path
2022-02-21 08:16:55 +01:00
Asger Feldthaus
6dbeb81f36
Ruby: use AccessPathSyntax.qll to parse input/output summary specs
2022-02-21 08:16:55 +01:00
Harry Maclean
9a60c7e4ac
Ruby: Update filename in test fixture
2022-02-21 09:43:36 +13:00
Alex Ford
6b8537c4e0
Ruby: FileSystemWriteAccess changenote
2022-02-20 20:14:01 +00:00
Alex Ford
baabe66551
Ruby: update Files.ql tests for write accesses
2022-02-20 19:28:12 +00:00
Alex Ford
12ce3d4784
Ruby: Implement FileSystemWriteAccess for IO/File API
2022-02-20 19:27:11 +00:00
Alex Ford
4f0174e89a
Ruby: add FileSystemWriteAccess concept
2022-02-20 19:26:54 +00:00
Alex Ford
dd383f942f
Merge remote-tracking branch 'origin/main' into ruby/clear-text-logging
2022-02-17 15:32:31 +00:00
Alex Ford
33f4fffe16
Ruby: Simplify sub!/gsub! sanitizers for cleartext logging query
2022-02-17 13:10:44 +00:00
Asger Feldthaus
69995d5750
Shared: rephrase request forgery name and description
2022-02-17 09:07:08 +01:00
Harry Maclean
bfd2c14555
Ruby: Add shim StandardLibrary.qll
...
This file re-exports everything it used to define, marking each as
deprecated to warn users that they should import `Core` or `Stdlib`
instead.
2022-02-17 20:44:04 +13:00
Harry Maclean
459f949c24
Ruby: fix old import in ActiveSupport
...
codeql.ruby.frameworks.StandardLibrary is deprecated
2022-02-17 20:44:04 +13:00
Harry Maclean
9fff2cfcff
Ruby: Add missing documentation
2022-02-17 20:44:04 +13:00
Harry Maclean
546bfcb8ea
Ruby: split tests to match stdlib changes
2022-02-17 20:44:04 +13:00
Harry Maclean
eb4f333c25
Ruby: Move UnknownMethodCall to ast/Call.qll
2022-02-17 20:44:04 +13:00
Harry Maclean
a397c65d36
Ruby: Split standard library modeling
...
Split the classes modeling various standard library concepts into a
structured group of multiple files.
Things that are part of the core language live in framworks/core and
standard libraries (that aren't part of core) live in frameworks/stdlib.
This mirrors the structure followed by the Ruby docs
(https://docs.ruby-lang.org/en/3.1/ ).
Tests are split in a followup commit.
2022-02-17 20:44:04 +13:00
Nick Rolfe
17450a5b27
Python/Ruby: rm old prepare-db-upgrade.sh files
2022-02-16 12:21:52 +00:00
Nick Rolfe
26b2012024
Move Ruby doc on db upgrades to common docs dir
...
And explain downgrades
2022-02-16 11:35:52 +00:00
Nick Rolfe
ee5068d843
Python/Ruby: forward to generic prepare-db-upgrade.sh
2022-02-16 11:03:28 +00:00
Arthur Baars
ebb87c4b36
Merge pull request #7975 from github/post-release-prep/codeql-cli-2.8.1
...
Post-release preparation for codeql-cli-2.8.1
2022-02-15 20:17:35 +01:00
Erik Krogh Kristensen
25d64a7901
Merge pull request #7930 from erik-krogh/rbApiIpa
...
RB: convert the ruby ApiGraphs to use IPA labels
2022-02-11 14:35:39 +01:00
Arthur Baars
678645ba57
Merge pull request #7883 from github/aibaars/ruby-cross
...
Ruby: add configuration for 'cross'
2022-02-11 13:15:34 +01:00
Arthur Baars
525c685584
Ruby: add configuration for 'cross'
2022-02-11 12:50:33 +01:00
github-actions[bot]
21bf29353f
Post-release preparation for codeql-cli-2.8.1
2022-02-11 11:07:31 +00:00
Erik Krogh Kristensen
5a39708cf7
move TLabel to the Impl module and cache it
2022-02-11 10:54:45 +01:00
Erik Krogh Kristensen
daa96cc218
change some docstrings based on review, and make fields private
2022-02-11 10:25:54 +01:00
Erik Krogh Kristensen
6ae4652ce9
make the Impl module private again
2022-02-11 10:17:24 +01:00
Harry Maclean
017183e7f3
Merge pull request #7919 from github/hmac/open-uri
...
Ruby: recognise additional form for OpenURI
2022-02-11 14:03:26 +13:00
github-actions[bot]
f25fc70b7c
Release preparation for version 2.8.1
2022-02-10 22:08:24 +00:00
