Commit Graph

980 Commits

Author SHA1 Message Date
Henry Mercer
c325ff8a23 Mark lines of code queries as telemetry queries
The new file coverage metrics are available in all supported GHES
versions. This PR tags lines of code queries as telemetry queries. Lines
of code information will still be available in the SARIF file, but it
will no longer be displayed in the logging output of the CLI.

The one exception is the metric queries for Java/Kotlin that provides
separate lines of code information for Java and Kotlin. I've kept these
since separate file coverage information for languages like Java and
Kotlin is only available for GHES 3.12 and later.
2024-03-11 16:40:31 +00:00
github-actions[bot]
dc9092c9ec Post-release preparation for codeql-cli-2.16.4 2024-03-06 22:19:33 +00:00
github-actions[bot]
2f058ffb4d Release preparation for version 2.16.4 2024-03-06 20:56:51 +00:00
Angela P Wen
ce31f8641a Revert "Release preparation for version 2.16.4" 2024-03-06 12:07:33 -08:00
github-actions[bot]
661e68dab5 Release preparation for version 2.16.4 2024-03-05 18:13:58 +00:00
Angela P Wen
967963a653 Revert "Release preparation for version 2.16.4" 2024-03-05 08:53:33 -08:00
github-actions[bot]
a67218a027 Release preparation for version 2.16.4 2024-03-04 17:42:08 +00:00
Peter Stöckli
3418ec8a81 Ruby: Update method code injection sinks change note
Co-authored-by: Harry Maclean <hmac@github.com>
2024-03-01 15:54:58 +01:00
Peter Stöckli
e43c368222 Ruby: change note for methode code injection sinks 2024-03-01 15:20:32 +01:00
Harry Maclean
b86643fab2 Ruby: doc fixes 2024-02-26 12:57:21 +00:00
Harry Maclean
8a670fe9a2 Ruby: formatting 2024-02-26 12:26:04 +00:00
amammad
32f5667bb6 revert YAML.qll and yaml sinks to previous PR, make a separate experimental query only for yaml 2024-02-26 12:12:03 +00:00
Harry Maclean
081c1201ed Ruby: Make csrf query more specific
CSRF protection only needs to be explicitly enabled on Rails
applications < 5.2 _or_ those that don't include a `load_defaults` call
with a version >= 5.2.
2024-02-23 11:13:17 +00:00
Harry Maclean
32b775fdc3 Ruby: reduce duplicate alerts for csrf query
Only generate an alert on the top-most vulnerable Rails controller in
the controller tree.
2024-02-23 11:13:17 +00:00
Harry Maclean
0597b2ed1b Ruby: recognise csrf_meta_tag
csrf_meta_tag is an alias for csrf_meta_tags, retained for backwards
compatibility.
2024-02-23 11:13:16 +00:00
Harry Maclean
3c69ab10f2 Ruby: Restrict rb/csrf-protection-not-enabled
This query only applies to codebases using Ruby on Rails < 5.2, or where
there is no call to `csrf_meta_tags` in the base ERb template.
2024-02-23 11:13:15 +00:00
Harry Maclean
581072721c Ruby: Add change note 2024-02-23 11:13:15 +00:00
Harry Maclean
6d6f8ba512 Ruby: Make CSRF query more sensitive
Generate an alert for every controller class that doesn't have or
inherity a `protect_from_forgery` setting.
2024-02-23 11:13:15 +00:00
Harry Maclean
49d826f667 Ruby: Add a query for CSRF protection not enabled
Specifically in Rails apps, we look for root ActionController classes
without a call to `protect_from_forgery`.
2024-02-23 11:13:14 +00:00
Harry Maclean
fbc689227d Merge pull request #15604 from p-/p--rails-more-request-sources
Ruby: add additional sources on the request object of Rails
2024-02-22 16:35:59 +00:00
github-actions[bot]
37f8fa3413 Post-release preparation for codeql-cli-2.16.3 2024-02-20 16:50:47 +00:00
github-actions[bot]
6d061fbc35 Release preparation for version 2.16.3 2024-02-20 14:26:23 +00:00
Peter Stöckli
2f7b946c9f Ruby: add sources on request object of Rails 2024-02-13 15:52:18 +01:00
Koen Vlaswinkel
e596862074 Merge pull request #15541 from github/koesie10/ruby-access-path-constructor-returnvalue
Ruby: Remove `ReturnValue` as access path for constructors
2024-02-08 16:25:34 +01:00
Dave Bartolomeo
92bd550c55 Merge pull request #15531 from github/post-release-prep/codeql-cli-2.16.2
Post-release preparation for codeql-cli-2.16.2
2024-02-08 05:58:17 -08:00
Koen Vlaswinkel
87eb1ab103 Ruby: Include ReturnValue and exclude self for constructors 2024-02-08 13:40:10 +01:00
Koen Vlaswinkel
8646bffaea Ruby: Remove ReturnValue as access path for constructors 2024-02-07 14:35:19 +01:00
github-actions[bot]
b5139078d0 Post-release preparation for codeql-cli-2.16.2 2024-02-06 19:22:35 +00:00
github-actions[bot]
c1b35fbf47 Release preparation for version 2.16.2 2024-02-05 17:58:57 +00:00
Koen Vlaswinkel
6a098120e3 Rename details to node 2024-02-05 16:33:29 +01:00
Koen Vlaswinkel
49dbad96f9 Switch from details string to DataFlow::Node 2024-02-05 16:33:01 +01:00
Koen Vlaswinkel
f83d2a7d55 Ruby: Avoid using toString where possible 2024-02-02 14:18:21 +01:00
Koen Vlaswinkel
ac1ebf27a7 Ruby: Rename suggestion predicates 2024-02-02 14:18:16 +01:00
Koen Vlaswinkel
8853acb4dd Ruby: Add query for access paths in model editor 2024-02-01 16:20:00 +01:00
Koen Vlaswinkel
ce4d8d6b51 Merge pull request #15490 from github/koesie10/ruby-model-constructor-on-new
Ruby: Model constructors in endpoint query on new instead of initialize
2024-02-01 09:31:49 +01:00
Harry Maclean
06334eee2e Merge pull request #14554 from maikypedia/maikypedia/insecure-randomness
Ruby: Add Insecure Randomness Query
2024-01-31 17:16:32 +00:00
Koen Vlaswinkel
d5f0a5ce72 Use predicate for isConstructor 2024-01-31 14:19:14 +01:00
Koen Vlaswinkel
c1aaf5a574 Ruby: Model constructors in endpoint query on new 2024-01-31 13:54:48 +01:00
Koen Vlaswinkel
817fd8c097 Ruby: Move TestFile to modeling Util module
The TestFile class in the ModelEditor module is more accurate than the
existing RelevantFile class in the Util module, so this moves the
TestFile class to Util and redefines RelevantFile in terms of the
TestFile.
2024-01-31 11:53:30 +01:00
Koen Vlaswinkel
b51379b533 Ruby: Only model relevant files for type models 2024-01-31 11:30:16 +01:00
Harry Maclean
a298a395e6 Merge pull request #15473 from github/koesie10/ruby-model-only-public-methods
Ruby: Only generate models for public methods
2024-01-31 09:27:27 +00:00
Arthur Baars
4591560692 Merge pull request #14544 from p-/p--oj-ox-unsafe-deser
Ruby: additional unsafe deserialization sinks for ox and one for oj
2024-01-30 19:28:32 +01:00
Peter Stöckli
fb075a9e88 Rename 2023-10-19-unsafe-deserialization-sinks.md to 2024-01-30-unsafe-deserialization-sinks.md 2024-01-30 17:31:33 +01:00
Sid Shankar
f557110d9b Merge pull request #15465 from sidshank/sidshank/rename-file-name-for-extracted-files-diagnostic
JS/TS/Python/Ruby: Renames diagnostic query files and tests
2024-01-30 10:19:00 -05:00
Koen Vlaswinkel
0442631c68 Ruby: Only generate models for public methods 2024-01-30 16:07:34 +01:00
Peter Stöckli
1947dee46a Merge branch 'main' into p--oj-ox-unsafe-deser 2024-01-30 15:33:39 +01:00
Koen Vlaswinkel
b32071999b Ruby: Correctly report supported status of summary and neutral models 2024-01-30 15:00:13 +01:00
Sid Shankar
b1d7a635f5 Renames diagnostic query files and tests
This commit renames the files relating to the diagnostic query that produces information on the number of files extracted. The files have been renamed from "SuccessfullExtractedFiles.*" to "ExtractedFiles.*". All related tests and test files have been renamed too.

The `@tags` and `@id` attributes of the queries have been left untouched, consistent with the `@tags` and `@id` for similar queries in other languages.
2024-01-29 20:19:20 +00:00
Maiky
c2c4d9e4d1 ` change to <code>
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
2024-01-27 14:08:55 +01:00
github-actions[bot]
d0b74c00fe Post-release preparation for codeql-cli-2.16.1 2024-01-23 23:02:29 +00:00