Peter Stöckli
03fff2709b
Add suggestions to fix FileJoinSanitizer
2022-12-09 09:42:44 +01:00
Peter Stöckli
0d8c82009c
Merge branch 'main' into p--ruby-kernel-open-addition
2022-12-09 07:54:56 +01:00
Harry Maclean
375403fb9d
Merge pull request #11114 from hmac/case-barrier-guard-3
...
Ruby: Add case string comparison barrier guard
2022-11-30 11:21:07 +13:00
erik-krogh
7dcb813ff3
remove two more claseses of FPs in rb/non-constant-kernel-open
2022-11-29 12:49:23 +01:00
Peter Stöckli
5b6dd786c3
Add changes for NonConstantKernelOpenQuery
2022-11-29 10:00:57 +01:00
Peter Stöckli
d8752a0b12
Add additional sinks to the rb/kernel-open query
2022-11-29 10:00:56 +01:00
erik-krogh
88de299e12
add join(" ") calls as a sink for rb/shell-command-constructed-from-input
2022-11-09 21:46:25 +01:00
Harry Maclean
4bc9096446
Ruby: Add case string comparison barrier guard
...
This recognises barriers of the form
STRINGS = ["foo", "bar"]
case foo
when "some string literal"
foo
when *["other", "strings"]
foo
when *STRINGS
foo
end
where the reads of `foo` inside each `when` are guarded by the comparison
of `foo` with the string literals.
We don't yet recognise this construct:
case foo
when "foo", "bar"
foo
end
This is due to a limitation in the shared barrier guard logic.
2022-11-09 15:03:13 +13:00
erik-krogh
f3741ff1e4
changes based on review
2022-11-03 09:41:05 +01:00
erik-krogh
7797211118
Merge branch 'main' into unsafeRbCmd
2022-10-20 10:34:17 +02:00
erik-krogh
557dd10896
add a rb/unsafe-shell-command-construction query
2022-10-11 13:26:01 +02:00
erik-krogh
99b90789e5
add .shellescape as a sanitizer for rb/command-injection
2022-10-11 13:05:19 +02:00
erik-krogh
b16b3c0394
move cwe-078 tests into subfolders
2022-10-11 13:05:19 +02:00
erik-krogh
186205bd4b
add a test for explicit shell invocations using Kernel.open
2022-10-11 09:23:29 +02:00
erik-krogh
de3b15ebe9
add a query flagging uses of Kernel.open that are not with a constant string
2022-10-11 09:23:29 +02:00
erik-krogh
708f6b51f3
move cwe-078 tests into subfolders
2022-10-11 09:23:29 +02:00
erik-krogh
dedbe66619
update expected output
2022-10-04 14:16:07 +02:00
erik-krogh
bf74481f65
add a link to the source in the alert-message for rb/kernel-open
2022-10-04 13:41:50 +02:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
Tom Hvitved
a7b39ebeca
Ruby: Flow through hash-splat parameters
2022-05-25 12:37:22 +02:00
Jeff Gran
47697f59c1
Ruby: Add classes for detecting user input from graphql-ruby
2022-01-18 09:13:58 -07:00
Tom Hvitved
400802c5ce
Ruby: Add flow summaries for Array/Enumerable methods
2021-12-22 15:56:20 +01:00
Arthur Baars
976daddd36
Move files to ruby subfolder
2021-10-15 11:47:28 +02:00
