hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-19 09:24:46 +01:00
Code Issues Packages Projects Releases Wiki Activity
63,809 Commits 1,679 Branches 158 Tags
c68d36eb7937678fa7e82f04ec2cd2df2b0b9a5b
Commit Graph

2616 Commits

Author SHA1 Message Date
Harry Maclean
a9abba5859 Merge pull request #15520 from hmac/hmac-erb-raw-output-directive 
Ruby: Recognise raw Erb output as XSS sink
 2024-02-15 08:05:16 +00:00
Harry Maclean
6cc5c09769 Ruby: Simplify ErbOutputDirective 2024-02-13 08:38:16 +00:00
Harry Maclean
3d9f9afa77 Merge pull request #15566 from hmac/hmac-actioncontroller-regex 
Ruby: Fix ActionController path regex
 2024-02-12 14:14:57 +00:00
Harry Maclean
99497e5f3c Merge pull request #15521 from hmac/hmac-ar-connection 
Ruby: Recognise more ActiveRecord connections
 2024-02-12 14:06:50 +00:00
Harry Maclean
5af58d24e0 Ruby: Recognise raw Erb output as XSS sink 2024-02-12 13:28:44 +00:00
Tom Hvitved
37d774176b Ruby: Fix SSA inconsistency 2024-02-09 14:49:26 +01:00
Tom Hvitved
1ea7717714 Capture flow: Take overwrites in nested scopes into account 2024-02-09 14:49:23 +01:00
Harry Maclean
3a90d78c36 Ruby: Fix Rails view file regex 
This picks up non-nested template files correctly.
 2024-02-09 09:41:43 +00:00
Harry Maclean
f792b58421 Ruby: Recognise more ActiveRecord connections 2024-02-05 16:45:59 +00:00
Jim Ockers
e477909200 Merge branch 'main' into ockers/certification_not_certificate 2024-02-02 15:39:29 -08:00
Harry Maclean
06334eee2e Merge pull request #14554 from maikypedia/maikypedia/insecure-randomness 
Ruby: Add Insecure Randomness Query
 2024-01-31 17:16:32 +00:00
James Ockers
eb5e0123d6 exclude certification from maybeCertificate() regexes 2024-01-30 13:16:18 -08:00
Tom Hvitved
d2d017dd64 Ruby: Model flow through ViewComponent render methods 2024-01-30 20:30:58 +01:00
Harry Maclean
557b49cfc5 Ruby: Add basic modeling for ViewComponent 2024-01-30 20:30:58 +01:00
Tom Hvitved
2d95ac9d5f Merge pull request #15468 from hvitved/ruby/ctx-sensitivity-rework 2024-01-30 20:27:43 +01:00
Peter Stöckli
1947dee46a Merge branch 'main' into p--oj-ox-unsafe-deser 2024-01-30 15:33:39 +01:00
Peter Stöckli
9596aebee3 Format: getValue now on one line 2024-01-30 15:22:16 +01:00
Peter Stöckli
3c8bc96ab5 replace occurence of AssignExprCfgNode for Oj as well 2024-01-30 15:17:37 +01:00
Peter Stöckli
e87effc18c Apply suggestions from code review 
Co-authored-by: Arthur Baars <aibaars@github.com>
 2024-01-30 15:14:35 +01:00
Tom Hvitved
503d2f7b95 Ruby: Rework mayBenefitFromCallContext 2024-01-30 09:57:29 +01:00
Harry Maclean
75b13da4e4 Ruby: Block flow from LHS of && expressions 
The only values that can flow from the LHS of an && expression are
`false` and `nil`, neither of which seem relevant for any of our
queries.
 2024-01-30 08:53:32 +00:00
maikypedia
d7314a1689 File format 2024-01-27 14:07:36 +01:00
erik-krogh
8be7eadace delete outdated deprecations 2024-01-22 09:11:35 +01:00
Tom Hvitved
295198744b Ruby: Handle captured yield calls 2024-01-10 14:25:15 +01:00
Tom Hvitved
c9cf2a899c Merge pull request #15260 from hvitved/dataflow/may-benefit-from-cctx-simplify 
Data flow: Remove column from `mayBenefitFromCallContext`
 2024-01-10 11:43:15 +01:00
Tom Hvitved
f90201eb56 Data flow: Remove column from mayBenefitFromCallContext 2024-01-09 11:34:43 +01:00
maikypedia
6c8fbe877d Changes 2024-01-09 00:46:41 +01:00
Alex Ford
ef8ca55d92 Merge pull request #15203 from pwntester/patch-3 
Ruby: Update Kernel.qll to include `Object.send` aliases
 2024-01-08 15:32:57 +00:00
Alvaro Muñoz
dbefc132de Apply suggestions from code review 
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com>
 2024-01-07 10:31:50 +01:00
Alvaro Muñoz
9146407f23 Add [] to the list of methods returning an `ActionController::Parameters" 2024-01-05 15:14:11 +01:00
Harry Maclean
c96be39474 Merge pull request #15048 from hmac/hmac-model-editor-ruby-modules 
Ruby: Model editor improvements
 2024-01-03 12:53:43 +00:00
Alvaro Muñoz
2964aef083 Update Kernel.qll to include send aliases 
Add `public_send` and `__send__` as Code Injection sinks as proposed by @vcsjones
 2023-12-28 19:08:03 +01:00
yoff
e0c027f13c Merge pull request #14848 from hvitved/python/shared-type-tracking 
Python: Adopt shared type tracking library
 2023-12-18 21:14:42 +01:00
maikypedia
8b2accca83 Add fixes and suggestions 2023-12-18 12:20:32 +01:00
Tom Hvitved
020a049d30 Merge pull request #15103 from hvitved/ruby/simple-pattern-flow 
Ruby: Model simple pattern matching as value steps instead of taint steps
 2023-12-18 08:49:11 +01:00
Tom Hvitved
25a676ac6a Ruby: Model simple pattern matching as value steps instead of taint steps 2023-12-14 20:18:24 +01:00
Anders Schack-Mulligen
a1068ce2f9 Dataflow: deprecate references 2023-12-14 15:05:33 +01:00
Tom Hvitved
84aa9f17a0 Python/Ruby: Use SummaryTypeTracker from typetracking pack 2023-12-14 13:25:18 +01:00
Tom Hvitved
a46964dfe8 Address review comments 2023-12-12 13:55:52 +01:00
Tom Hvitved
cdf59e1e1d Ruby: Cache more predicates 2023-12-11 10:15:17 +01:00
Tom Hvitved
0e81577269 Ruby: Use FlowSummaryImpl from dataflow pack 2023-12-10 11:25:43 +01:00
Harry Maclean
e6df264865 Ruby: Report module declarations to model editor 
This allows us to render type relations between modules/classes, not
just methods.
 2023-12-08 14:16:49 +00:00
Harry Maclean
c1c258f567 Ruby: Include ancestors in type model generation 2023-12-08 14:16:49 +00:00
Anders Schack-Mulligen
64eb4ff753 Merge pull request #14983 from aschackmull/dataflow/deprecate-old-api 
Data Flow: Deprecate old data flow api.
 2023-12-08 14:27:25 +01:00
Harry Maclean
1dc0a063b0 Merge pull request #14679 from hmac/hmac-model-editor-ruby 
Ruby: Experimental model editor support
 2023-12-08 11:03:38 +00:00
Tom Hvitved
dde83b6415 Merge pull request #14709 from hvitved/ruby/shared-type-tracking 
Ruby: Adopt shared type tracking library
 2023-12-05 20:12:06 +01:00
Tom Hvitved
c6e805faef Ruby: Add more deprecation comments 2023-12-05 14:57:15 +01:00
Harry Maclean
d630773575 Merge pull request #14627 from alexrford/rb/update_all_sink 
Ruby: refine `ActiveRecord` `update_all` as an SQL sink
 2023-12-04 13:02:14 +00:00
Anders Schack-Mulligen
67f0529cda Dataflow: Sync. 2023-12-04 12:36:57 +01:00
Harry Maclean
f40f2db3ab Ruby: Fix name of url-redirection sink model 2023-11-27 11:25:37 +00:00