Nick Rolfe
8a94cabdbf
Merge pull request #11250 from github/nickrolfe/stack-trace-exposure
...
Ruby: add stack-trace exposure query
2022-11-28 10:45:59 +00:00
Alex Ford
893c8763bb
Ruby: model ActiveSupport json_escape flow
2022-11-24 15:33:08 +00:00
Nick Rolfe
50b10be2db
Ruby: StackTraceExposure: add test for a specific rescue type
2022-11-24 14:08:34 +00:00
Nick Rolfe
1c407a28cd
Apply suggestions from code review
...
Co-authored-by: Harry Maclean <hmac@github.com >
2022-11-24 14:02:32 +00:00
Erik Krogh Kristensen
b4661f4a59
Merge pull request #11245 from erik-krogh/rb-redosMod
...
Ruby: use the shared regex pack
2022-11-21 15:34:20 +01:00
Tom Hvitved
2fac505221
Ruby: Update expected test output
2022-11-21 12:52:27 +01:00
Harry Maclean
a6f6936719
Merge pull request #11058 from hmac/actioncontroller-logger
...
Ruby: Model various ActionController methods
2022-11-17 08:21:00 +13:00
Tom Hvitved
67b6a82cf1
Merge pull request #11198 from hvitved/ssa/expose-phi-reads
...
SSA: Expose phi-read nodes
2022-11-16 15:11:58 +01:00
Erik Krogh Kristensen
7d4ea47611
Merge pull request #10855 from erik-krogh/formatTaint
...
Ruby: taint-steps for printf calls - and add a `AdditionalTaintStep` class
2022-11-16 12:08:45 +01:00
Harry Maclean
ed3270fb04
Ruby: Update for upstream changes
2022-11-16 14:06:32 +13:00
Harry Maclean
2e2fcd49bf
Ruby: Consider Object#inspect a log sanitizer
...
The behaviour of `Object#inspect` depends on whether it has been
overridden by a subclass, but it will typically produce output on a
single line. Calling `inspect` on a String will replace newlines with
`\n`, which is then safe for interpolation into a log line.
2022-11-16 13:46:51 +13:00
Harry Maclean
d0521f15f1
Ruby: Update tests
2022-11-16 13:46:51 +13:00
Harry Maclean
d2c0250b41
Ruby: Model ActionDispatch::Request#body_stream
2022-11-16 13:46:51 +13:00
Harry Maclean
9f357837fa
Ruby: Model send_data as an HTTP response
2022-11-16 13:46:51 +13:00
Harry Maclean
5cfc494e16
Ruby: Test render inside redirect_to
...
This test shows that we correctly identify redirect_to and render calls
inside respond_to blocks.
2022-11-16 13:46:51 +13:00
Harry Maclean
155b64d3fc
Ruby: Add test for render calls
2022-11-16 13:46:51 +13:00
Harry Maclean
b7e14311be
Ruby: Model ActionController logger
2022-11-16 13:46:50 +13:00
Harry Maclean
27681ac987
Ruby: Move ActionController tests to own directory
2022-11-16 13:46:49 +13:00
erik-krogh
f6255e497b
Merge branch 'main' into rb-redosMod
2022-11-15 17:14:19 +01:00
Tom Hvitved
67f31ffdf0
Ruby: Add tests for phi reads
2022-11-15 11:45:32 +01:00
Tom Hvitved
32f60fd112
Ruby: Add more local flow tests for use-use flow
2022-11-15 11:45:31 +01:00
Nick Rolfe
8d854e0a6b
Merge pull request #11252 from github/nickrolfe/active_support_enumerable
...
Ruby: add flow summary for Enumerable#index_by
2022-11-15 10:40:42 +00:00
erik-krogh
10fff4e2ef
Merge branch 'main' into rb-redosMod
2022-11-14 21:31:10 +01:00
Nick Rolfe
b39e2ef71c
Ruby: add stacktrace exposure query
2022-11-14 12:26:40 +00:00
Nick Rolfe
83b3312467
Merge pull request #11207 from github/nickrolfe/arel-sql
...
Ruby: add `SqlConstruction` concept, and implement it for calls to `Arel.sql`
2022-11-14 10:21:37 +00:00
Nick Rolfe
0dadf0bbb4
Ruby: add flow summary for Enumerable#index_by
2022-11-14 10:01:24 +00:00
Nick Rolfe
e3ebf1c668
Merge pull request #11187 from github/nickrolfe/actioncable
...
Ruby: add ActionCable channel RPC params as remote flow sources
2022-11-11 11:32:13 +00:00
Tom Hvitved
bda4b52395
Merge pull request #11206 from hvitved/ruby/self-toplevel-def
...
Ruby: Fix SSA entry definitions for `self` in top-level
2022-11-10 17:01:59 +01:00
Nick Rolfe
5a15558355
Ruby: treat an Arel.sql call as a SqlConstruction
2022-11-10 14:11:14 +00:00
Tom Hvitved
e18442069b
Ruby: Fix SSA entry definitions for self in top-level
2022-11-10 15:08:17 +01:00
Erik Krogh Kristensen
5d2ab8adfb
Merge pull request #11191 from erik-krogh/arrJoin
...
RB: add join(" ") calls as a sink for rb/shell-command-constructed-from-input
2022-11-10 14:20:42 +01:00
erik-krogh
88de299e12
add join(" ") calls as a sink for rb/shell-command-constructed-from-input
2022-11-09 21:46:25 +01:00
Nick Rolfe
eb2a487433
Ruby: update expected test output
2022-11-09 17:38:33 +00:00
Nick Rolfe
0d9aa0cdac
Ruby: fix clashing method names from merge conflict
2022-11-09 17:06:43 +00:00
Nick Rolfe
c8c53cb424
Merge remote-tracking branch 'origin/main' into nickrolfe/active_support_flow_summaries
2022-11-09 17:02:05 +00:00
Nick Rolfe
db20e7d143
Ruby: add ActionCable channel RPC params as remote-flow sources
2022-11-09 14:16:04 +00:00
Asger F
859dc7beb7
Merge pull request #11024 from asgerf/rb/data-flow-layer-capture2
...
Ruby: expand DataFlow API
2022-11-09 15:06:03 +01:00
Nick Rolfe
97e939ae2b
Ruby: refine summaries for Hash#reverse_merge etc.
...
- revert the changes to the taint summaries specific to ActionController
params
- make the general flow summaries value-preserving and use
WithElement[any]
2022-11-09 11:56:07 +00:00
Asger F
43769ad464
Ruby: update test output
2022-11-08 19:20:57 +01:00
Nick Rolfe
a9ff0bdbbf
Ruby: accept changed test output
2022-11-08 17:36:31 +00:00
Nick Rolfe
04575674db
Ruby: generalise summaries for ActiveSupport Hash extensions
2022-11-08 15:48:20 +00:00
Asger F
271de66f01
Ruby: rename getConst -> getConstant
2022-11-08 16:41:04 +01:00
Tom Hvitved
edde3defed
Merge pull request #11153 from hvitved/ruby/basic-block-at-conditions
...
Ruby: Split basic blocks around constant conditionals
2022-11-08 13:35:52 +01:00
Tom Hvitved
f0b9ca4bf9
Ruby: Add more guards tests
2022-11-08 11:09:54 +01:00
Asger F
a75c50620c
Ruby: update more SSA test output
2022-11-08 11:03:24 +01:00
Erik Krogh Kristensen
c82410fd16
Merge pull request #10680 from erik-krogh/unsafeRbCmd
...
RB: add an unsafe-shell-command-construction query
2022-11-08 09:22:33 +01:00
Tom Hvitved
7ba0682297
Ruby: Split basic blocks around constant conditionals
2022-11-08 09:07:23 +01:00
Tom Hvitved
c86f597153
Ruby: Add test for disjunctive guard
2022-11-08 09:01:22 +01:00
Harry Maclean
d392cdaab6
Merge pull request #11022 from hmac/try-code-injection
...
Ruby: try/try! as code execution
2022-11-08 09:42:52 +13:00
erik-krogh
860c3c443c
update expected output of the queries (some sorting changed due to locations being used slightly differently in the shared pack)
2022-11-07 14:34:20 +01:00
