Harry Maclean
ef88f3ed09
Merge pull request #16377 from hmac/hmac-sanitization-fp
...
Ruby: Fix StringSubstitutionCall charpred
2024-05-02 13:31:01 +01:00
Owen Mansel-Chan
83249cd9c2
Fix grammar in comment
2024-05-02 09:59:48 +01:00
Owen Mansel-Chan
16dcc0969b
Standardise comment explaining why extensible predicates must be defined
2024-05-01 22:00:01 +01:00
Owen Mansel-Chan
09e59ccf44
Name files with empty definitions of MaD extensible predicates to erowdmpty.model.yml
2024-05-01 21:39:38 +01:00
Harry Maclean
f7fc2e0b00
Ruby: Fix StringSubstitutionCall charpred
...
Some missing parens meant this class targeted way more things than
intended.
2024-05-01 16:14:58 +01:00
Erik Krogh Kristensen
7e839792da
Merge pull request #16330 from erik-krogh/del-deps-apr-2024
...
All: delete outdated deprecations
2024-04-30 10:43:39 +02:00
Harry Maclean
51bc8e917e
Ruby: Reduce FPs for rb/incomplete-hostname-regexp
...
Arguments in calls to `match[?]` should only be considered regular
expression interpretations if the `match` refers to the standard library
method, not a method in source code.
2024-04-29 11:19:34 +01:00
erik-krogh
baa31e1469
delete outdated deprecations
2024-04-25 22:19:28 +02:00
Nick Rolfe
8f2e51faa6
Ruby: do fewer regexp matches in SensitiveActions
2024-04-24 12:32:49 +01:00
Nick Rolfe
af72c0848e
Merge pull request #16306 from github/nickrolfe/js-sensitive
...
JS: do fewer regexp matches in SensitiveActions
2024-04-24 09:49:44 +01:00
Nick Rolfe
003d208574
JS: do fewer regexp matches in SensitiveActions
2024-04-23 15:31:38 +01:00
Anders Schack-Mulligen
b2f09949df
Merge pull request #15599 from aschackmull/dataflow/fieldflowbranchlimit-v2
...
Dataflow: update fieldFlowBranchLimit semantics
2024-04-23 10:08:05 +02:00
Asger F
3335d48154
Sync files
2024-04-16 20:26:41 +02:00
Asger F
be64daf265
Merge branch 'main' into js/graph-export
2024-04-16 20:23:33 +02:00
Tom Hvitved
75b1e14098
Merge pull request #16205 from samgiz/samgiz-tiny-docs-fix
...
Tiny docs fix
2024-04-16 13:57:38 +02:00
Anders Schack-Mulligen
2f0987e980
Dataflow: Add dummy DataFlowSecondLevelScope implementations.
...
These could be an empty type, but Unit was available and it probably
doesn't matter.
2024-04-15 15:16:30 +02:00
Zigmas Bitinas
5125468307
Tiny docs fix
...
Noticed the mistake when browsing the docs [here](https://codeql.github.com/codeql-standard-libraries/ruby/codeql/ruby/security/CodeInjectionCustomizations.qll/module.CodeInjectionCustomizations$CodeInjection$FlowState.html )
2024-04-13 21:18:36 +01:00
Tom Hvitved
e7dc120456
Add deprecation comments
2024-04-12 13:40:15 +02:00
Tom Hvitved
04de315e0e
Ruby: Deprecate models-as-data CSV interface
2024-04-12 13:40:14 +02:00
Joe Farebrother
5cebcadc56
Merge pull request #15987 from joefarebrother/ruby-mass-reassignment
...
Ruby: Add query for insecure mass assignment
2024-04-12 10:18:41 +01:00
Anders Schack-Mulligen
6991f5452f
Ruby: Add alert provenance plumbing.
2024-04-12 09:20:04 +02:00
Anders Schack-Mulligen
eafc0075fd
Legacy dataflow: Sync.
2024-04-12 09:19:54 +02:00
Joe Farebrother
06d7b3ce80
Use cfg nodes
2024-04-11 22:30:41 +01:00
Erik Krogh Kristensen
c00e2075a4
Merge pull request #16111 from erik-krogh/rb-url
...
RB: Improve QHelp for `rb/url-redirect`, and fix an FP.
2024-04-11 13:03:35 +02:00
Joe Farebrother
ec973ac1f3
Use not exists
2024-04-11 09:38:41 +01:00
Joe Farebrother
0a3d73d902
Add flow steps and sanitizers for permit calls
2024-04-10 21:47:07 +01:00
Erik Krogh Kristensen
844e78dce5
remove redundant cast
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2024-04-10 20:02:49 +02:00
Joe Farebrother
976ca48317
Review suggestions - rename sink class and add barrier out
2024-04-10 10:17:19 +01:00
Asger F
f5355cfa98
Dynamic: Sync ApiGraphModels.qll
2024-04-09 14:37:20 +02:00
Tom Hvitved
e6984aa865
Ruby: Remove two redundant allowImplicitRead predicates
2024-04-09 10:10:25 +02:00
erik-krogh
642a134035
add tests for the fixes in the qhelp, and fix an FP that appeared
2024-04-08 12:00:27 +02:00
Tom Hvitved
ce3b359813
Ruby: Fix CFG for nodes that may raise
2024-04-04 13:27:29 +02:00
Tom Hvitved
c2d771b334
Ruby: Reduce alerts produced by MassAssignment.ql
2024-04-03 19:58:51 +02:00
Tom Hvitved
3c96bf6b22
Fix bad join
2024-04-03 19:41:37 +02:00
Tom Hvitved
2d4cf55c87
Merge pull request #15985 from hvitved/ruby/phi-barrier-guards
...
Ruby: Extend barrier guards to handle phi inputs
2024-04-03 15:22:39 +02:00
Harry Maclean
409f46ef7b
Merge pull request #14308 from hmac/hmac-rb-csrf-not-enabled
...
Ruby: Add a query for CSRF protection not enabled
2024-04-02 11:30:36 +01:00
Erik Krogh Kristensen
332c1e3b8a
Merge pull request #16026 from erik-krogh/htmlSafeSan
...
RB: Add barrier guard for `.html_safe?` to the XSS queries
2024-04-02 07:54:19 +02:00
erik-krogh
051120e958
add qldoc for ReflectedXssSanitizers
2024-03-22 17:58:25 +01:00
erik-krogh
c60cec36d4
add calls to .html_safe? as a shared XSS sanitizer
2024-03-22 17:46:39 +01:00
Joe Farebrother
592acb94d2
Add missing .s to qldoc
2024-03-22 15:28:34 +00:00
Joe Farebrother
b74145349b
Add test cases
2024-03-22 14:07:11 +00:00
Joe Farebrother
507a6102a2
Reorganise into Custimizations file + add some more sinks on ActiveRecord methods
2024-03-22 14:07:04 +00:00
Joe Farebrother
0f45a53adc
Add mass assignment query
2024-03-22 14:04:52 +00:00
Tom Hvitved
8f56edea80
Merge pull request #15966 from hvitved/treesitter-split-up-node-info-table
...
Tree-sitter: Split up `ast_node_info` table into two tables
2024-03-20 20:38:18 +01:00
erik-krogh
db3bf0e482
use the sanitizers from ReflectedXSS in unsafe-html-construction
2024-03-20 10:11:07 +01:00
Tom Hvitved
90779f4413
Ruby: Extend barrier guards to handle phi inputs
2024-03-20 10:02:20 +01:00
Harry Maclean
219cd4e415
Merge pull request #14426 from hmac/hmac-ar-scopes
...
Ruby: Track flow into ActiveRecord scopes
2024-03-19 14:19:14 +00:00
Harry Maclean
7e479e3c8e
Ruby: Fix Hash#keys flow summary
2024-03-19 13:47:45 +00:00
Harry Maclean
22ddf2129b
Ruby: remove isString from TSymbol
2024-03-19 12:27:34 +00:00
Tom Hvitved
72ff494739
Ruby: Regenerate dbscheme and stats
2024-03-19 13:04:07 +01:00
