Owen Mansel-Chan
1d6b8c5120
Use postprocessing queries for unrelated test
...
Need to do this because the model numbering was changing. At the same
time we may as well use inline expectations.
2026-02-18 13:49:53 +00:00
Tom Hvitved
978a816f11
Ruby: Track types in data flow
2025-01-06 13:26:10 +01:00
Asger F
f9c0ba3826
Ruby: use DeduplicatePathGraph in CodeInjection query
2024-12-11 11:48:15 +01:00
Tom Hvitved
f287216060
Update expected test output
2024-09-24 14:21:38 +02:00
Tom Hvitved
c92c96fa78
Data flow: Compute local big step relation per stage
2024-08-26 09:15:27 +02:00
Tom Hvitved
04de315e0e
Ruby: Deprecate models-as-data CSV interface
2024-04-12 13:40:14 +02:00
Anders Schack-Mulligen
7cc8fd00aa
Ruby: Update expected output (uninteresting).
2024-04-12 09:20:35 +02:00
Tom Hvitved
914a605a87
Ruby: Rework hidden synthetic data-flow nodes
2024-02-27 15:33:58 +01:00
Anders Schack-Mulligen
35a3aa0a09
Ruby: Add empty provenance column to expected files.
2024-02-09 11:32:08 +01:00
Tom Hvitved
e258324960
Ruby: Allow for implicit array reads at all sinks during taint tracking
2023-09-14 09:40:05 +02:00
Anders Schack-Mulligen
90f84bb516
Ruby: Update expected output.
2023-04-26 13:08:16 +02:00
Tom Hvitved
b816c79248
Ruby: Include all assignments in data flow paths
2023-03-24 10:09:30 +01:00
erik-krogh
25a6d496d9
Merge branch 'main' into HEAD
2023-03-13 17:33:06 +01:00
erik-krogh
31336b09c4
add summary for the Array method on Kernel
2023-03-01 12:53:13 +01:00
erik-krogh
36b33765a5
use allowImplicitRead instead of a taint-step from elements to the array
2023-02-28 16:09:52 +01:00
Harry Maclean
ae3d91b546
Ruby: First draft of rails callback flow
2023-02-21 19:26:36 +13:00
erik-krogh
c2e8206090
add more array taint steps that taint the entire array
2023-01-30 21:14:27 +01:00
erik-krogh
8fc3b268e8
add string concat as a sink for code-construction
2023-01-17 14:48:06 +01:00
erik-krogh
f98ff65b11
use eval() instead of send() in test
2023-01-05 20:04:04 +01:00
erik-krogh
378cc1aed2
add support for string-like-literals
2022-11-25 10:32:06 +01:00
erik-krogh
80c92dc3e6
add support for array pushes
2022-11-25 10:32:05 +01:00
erik-krogh
3461404bbb
add basic support for arrays
2022-11-25 10:31:35 +01:00
erik-krogh
2033dd2dcc
remove parameters named "code" as source
2022-11-25 10:25:31 +01:00
erik-krogh
e7c6571f52
remove the "send(..)" and similar from unsafe-code-construction
2022-11-25 10:25:31 +01:00
erik-krogh
f1668801d3
add a rb/unsafe-code-construction query
...
rebase
2022-11-25 10:25:30 +01:00
erik-krogh
5f6cb1684b
move the code-injection tests into a subfolder
2022-11-24 17:23:25 +01:00
erik-krogh
e8dce25cc2
fix rb/code-injection
2022-10-25 14:44:23 +02:00
erik-krogh
3dd89bb7bf
remove duplicate alerts due to multiple states reaching the same sink
2022-10-19 13:19:18 +02:00
erik-krogh
3e51f6fa8e
use flow-states to remove FPs related to an attacker only controlling a substring in code-injection
2022-10-19 13:00:44 +02:00
erik-krogh
d77b31672d
add failing test for safe-ish uses of Object.send
2022-10-19 11:27:08 +02:00
erik-krogh
cb33d5aeff
add test for .send(..) in code-injection
2022-10-19 11:25:30 +02:00
Alex Ford
ee77404006
Ruby: Add ActiveJob::Serializers.deserialize as a code execution sink
2022-10-09 22:28:22 +01:00
Alex Ford
4a39e4aac0
Ruby: Add new test case for rb/code-injection
2022-10-09 22:26:29 +01:00
Alex Ford
c4baf0b8fa
Ruby: add space for test case
2022-10-09 22:16:23 +01:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
erik-krogh
79a048968e
make the alert messages of taint-tracking queries more consistent
2022-09-07 12:22:50 +02:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
Asger Feldthaus
cbd044a768
Ruby: add a code injection test for flwo through Regexp.escape
2022-03-01 14:08:21 +01:00
Harry Maclean
43ddc54f2b
Ruby: Add Module#const_get as a code execution
...
Module#const_get takes a single string argument and interprets it as the
name of a constant. It then looks up the constant and returns its value.
Object.const_get("Math::PI")
# => 3.141592653589793
By itself, this method is not as dangerous as e.g. eval, but if the
value returned is a class that is then instantiated, this can allow an
attacker to instantiate arbitrary Ruby classes.
As a result, I think it's safe to say that any remote input flowing into
this call is a potential vulnerability. A real-world example of this is
https://github.com/advisories/GHSA-52p9-v744-mwjj .
2022-01-06 13:03:41 +13:00
Tom Hvitved
400802c5ce
Ruby: Add flow summaries for Array/Enumerable methods
2021-12-22 15:56:20 +01:00
Arthur Baars
976daddd36
Move files to ruby subfolder
2021-10-15 11:47:28 +02:00
