Tom Hvitved
|
c2d771b334
|
Ruby: Reduce alerts produced by MassAssignment.ql
|
2024-04-03 19:58:51 +02:00 |
|
Tom Hvitved
|
3c96bf6b22
|
Fix bad join
|
2024-04-03 19:41:37 +02:00 |
|
Joe Farebrother
|
592acb94d2
|
Add missing .s to qldoc
|
2024-03-22 15:28:34 +00:00 |
|
Joe Farebrother
|
b74145349b
|
Add test cases
|
2024-03-22 14:07:11 +00:00 |
|
Joe Farebrother
|
507a6102a2
|
Reorganise into Custimizations file + add some more sinks on ActiveRecord methods
|
2024-03-22 14:07:04 +00:00 |
|
Joe Farebrother
|
0f45a53adc
|
Add mass assignment query
|
2024-03-22 14:04:52 +00:00 |
|
Tom Hvitved
|
8f56edea80
|
Merge pull request #15966 from hvitved/treesitter-split-up-node-info-table
Tree-sitter: Split up `ast_node_info` table into two tables
|
2024-03-20 20:38:18 +01:00 |
|
Harry Maclean
|
219cd4e415
|
Merge pull request #14426 from hmac/hmac-ar-scopes
Ruby: Track flow into ActiveRecord scopes
|
2024-03-19 14:19:14 +00:00 |
|
Harry Maclean
|
7e479e3c8e
|
Ruby: Fix Hash#keys flow summary
|
2024-03-19 13:47:45 +00:00 |
|
Harry Maclean
|
22ddf2129b
|
Ruby: remove isString from TSymbol
|
2024-03-19 12:27:34 +00:00 |
|
Tom Hvitved
|
72ff494739
|
Ruby: Regenerate dbscheme and stats
|
2024-03-19 13:04:07 +01:00 |
|
Harry Maclean
|
32b80f8cb1
|
Ruby: Add tests for hash flow
|
2024-03-19 08:38:14 +00:00 |
|
Tom Hvitved
|
fc55567d90
|
Merge pull request #15853 from hvitved/dataflow/get-location
Data flow: Replace `hasLocationInfo` with `getLocation`
|
2024-03-18 20:21:46 +01:00 |
|
Harry Maclean
|
187a68bf76
|
Ruby: Add flow summary for Hash#keys
|
2024-03-18 17:56:10 +00:00 |
|
Harry Maclean
|
e895f96a3a
|
Ruby: Taint flow to second block param in map
When `map` is called on a hash, the values in the hash are passed to the
second parameter of the block.
|
2024-03-18 17:55:02 +00:00 |
|
Harry Maclean
|
80ae017aa1
|
Ruby: Track flow into ActiveRecord scopes
|
2024-03-18 15:01:37 +00:00 |
|
Joe Farebrother
|
8c5fff2d11
|
Update names and qldoc for params taint predicates
|
2024-03-15 14:43:29 +00:00 |
|
Tom Hvitved
|
e7b00a7b42
|
Ruby: Add post-update argument nodes for string constants
|
2024-03-15 10:47:39 +01:00 |
|
Joe Farebrother
|
f464f1b94e
|
Accept test output + fix qldoc typo
|
2024-03-14 22:25:37 +00:00 |
|
Joe Farebrother
|
b4ed77343b
|
Add change note + fix qldoc
|
2024-03-14 22:25:36 +00:00 |
|
Joe Farebrother
|
5333c75919
|
Model additional string attributes
|
2024-03-14 22:25:36 +00:00 |
|
Joe Farebrother
|
8c31b612ca
|
Model UploadedFile original_filename and read
|
2024-03-14 22:25:35 +00:00 |
|
Tom Hvitved
|
4085c8ec8f
|
Merge pull request #15866 from hvitved/ruby/orm-tracking-ap-limit
Ruby: Lower access path limit to 1 for `OrmTracking`
|
2024-03-13 10:57:09 +01:00 |
|
Harry Maclean
|
dd5eb982ec
|
Merge pull request #15524 from hmac/hmac-process-spawn
Ruby: Add some more command injection sinks
|
2024-03-13 09:53:10 +00:00 |
|
Tom Hvitved
|
695e728ed5
|
Ruby: Lower access path limit to 1 for OrmTracking
|
2024-03-12 14:58:29 +01:00 |
|
Tom Hvitved
|
dddba3228b
|
Merge pull request #15867 from hvitved/dataflow/ap-limit
Data flow: Add `ConfigSig::accessPathLimit`
|
2024-03-12 14:57:51 +01:00 |
|
Tom Hvitved
|
4291290277
|
Ruby: Implement new data flow interface
|
2024-03-11 20:56:38 +01:00 |
|
Joe Farebrother
|
9c51514bd9
|
Merge pull request #15857 from joefarebrother/ruby-activerecord-from
Ruby: Model second argument of `ActiveRecord` `from`
|
2024-03-11 16:49:52 +00:00 |
|
Tom Hvitved
|
da66281fef
|
Sync files
|
2024-03-11 13:02:04 +01:00 |
|
Tom Hvitved
|
7a39f077d9
|
Data flow: Add ConfigSig::accessPathLimit
|
2024-03-11 13:01:58 +01:00 |
|
Joe Farebrother
|
dbd33d1cf0
|
Model Argument[1] of ActiveRecord from
|
2024-03-08 14:04:01 +00:00 |
|
Tom Hvitved
|
85782ff1d4
|
Ruby: Exclude calls with arguments from OrmFieldAsSource
|
2024-03-07 17:34:01 +01:00 |
|
Harry Maclean
|
350dab4621
|
Merge pull request #15722 from hmac/mad-sinks
|
2024-03-06 08:18:19 +00:00 |
|
Joe Farebrother
|
dcc6f83d3b
|
Merge pull request #15782 from joefarebrother/ruby-typhoeus
Ruby: Model `Typhoeus::Request.new`
|
2024-03-05 16:55:38 +00:00 |
|
Joe Farebrother
|
7027b7fe82
|
Apply review suggestions: Use getInstance and clarify predicate name/qldoc. Also fix changenote formatting.
|
2024-03-05 16:34:48 +00:00 |
|
Harry Maclean
|
91cb2a37fd
|
Ruby: Model Process.exec
|
2024-03-05 10:19:22 +00:00 |
|
Harry Maclean
|
179aaa1342
|
Ruby: model Open4.popen4ext
|
2024-03-05 09:35:18 +00:00 |
|
Joe Farebrother
|
31687afd5d
|
Fix performance
|
2024-03-04 09:47:12 +00:00 |
|
Joe Farebrother
|
5a1c0f60e6
|
Fix qldoc typo
|
2024-03-01 15:12:16 +00:00 |
|
Joe Farebrother
|
65b30c1dff
|
Add tests and qldoc
|
2024-03-01 14:46:55 +00:00 |
|
Joe Farebrother
|
a08b292099
|
Add models for Typhoeus::Request
|
2024-03-01 14:23:24 +00:00 |
|
Peter Stöckli
|
a693c6d9b4
|
Ruby: sinks for code injection via calls to method
|
2024-03-01 14:42:22 +01:00 |
|
Joe Farebrother
|
0b7b7ea1b8
|
Add test cases and improve controller model
|
2024-03-01 09:57:24 +00:00 |
|
Joe Farebrother
|
ef0a1d2873
|
Implement models for translation methods
|
2024-03-01 09:52:53 +00:00 |
|
Tom Hvitved
|
914a605a87
|
Ruby: Rework hidden synthetic data-flow nodes
|
2024-02-27 15:33:58 +01:00 |
|
Joe Farebrother
|
3ab6f222d0
|
Merge pull request #15718 from joefarebrother/ruby-arel-sqlliteral
Ruby: Model Arel::Nodes::SqlLiteral.new
|
2024-02-27 12:43:47 +00:00 |
|
Joe Farebrother
|
cb733dcf85
|
Simplify model defenition
|
2024-02-26 14:59:03 +00:00 |
|
Harry Maclean
|
f7b8e8af41
|
Ruby: Include request forgery sinks from MaD
|
2024-02-26 11:34:11 +00:00 |
|
Harry Maclean
|
8bed3fbed4
|
Ruby: Add basic model for Terrapin library
|
2024-02-26 11:32:41 +00:00 |
|
Harry Maclean
|
9d13a1ff51
|
Ruby: Add model for Process.spawn
|
2024-02-26 11:26:38 +00:00 |
|