Tom Hvitved
f1afa2bf59
Ruby: Fix expected test output
2024-10-07 09:16:12 +02:00
Tom Hvitved
f287216060
Update expected test output
2024-09-24 14:21:38 +02:00
Tom Hvitved
6d4f3bd014
Ruby: Rework splat argument/parameter matching
2024-08-20 16:21:56 +02:00
Tom Hvitved
c9aaba677d
Ruby: Update expected test output
2024-08-13 13:34:46 +02:00
Tom Hvitved
8ea4f85de3
Ruby: Rework Sinatra.FilterJumpStep
2024-06-21 08:57:59 +02:00
Tom Hvitved
95c764eff6
Fix Sinatra test to properly output pathgraph
2024-06-21 08:57:19 +02:00
Alex Ford
6c3d90e8a0
Merge pull request #16650 from alexrford/rb/routing-improvements
...
Ruby: ActionDispatch - support `path => target` route format
2024-06-18 11:17:05 +01:00
Tom Hvitved
e42de3de6f
Ruby: Fix extraction errors
2024-06-04 14:54:02 +02:00
Tom Hvitved
ad99158838
Ruby: Fix/accept extraction errors
2024-06-04 12:55:44 +02:00
Alex Ford
1100b75a3c
Ruby: handle routes with path/action pairs
2024-05-31 15:54:57 +01:00
Alex Ford
0473655752
Ruby: actiondispatch add hash arg testcase
2024-05-31 15:08:35 +01:00
Alex Ford
22858249f9
Ruby: actiondispatch test whitespace changes
2024-05-31 15:07:39 +01:00
Tom Hvitved
a006c29a00
Merge pull request #16481 from hvitved/treesitter/bump2
...
Tree-sitter: Bump to 0.22.6
2024-05-22 12:53:14 +02:00
Rasmus Wriedt Larsen
2451a6d3f6
Accept .expected changes
2024-05-21 14:47:42 +02:00
Tom Hvitved
bf2ae9890f
Tree-sitter: Bump to 0.22.6
2024-05-21 11:14:06 +02:00
Tom Hvitved
04de315e0e
Ruby: Deprecate models-as-data CSV interface
2024-04-12 13:40:14 +02:00
Anders Schack-Mulligen
7cc8fd00aa
Ruby: Update expected output (uninteresting).
2024-04-12 09:20:35 +02:00
Harry Maclean
409f46ef7b
Merge pull request #14308 from hmac/hmac-rb-csrf-not-enabled
...
Ruby: Add a query for CSRF protection not enabled
2024-04-02 11:30:36 +01:00
Tom Hvitved
e7b00a7b42
Ruby: Add post-update argument nodes for string constants
2024-03-15 10:47:39 +01:00
Joe Farebrother
f464f1b94e
Accept test output + fix qldoc typo
2024-03-14 22:25:37 +00:00
Joe Farebrother
3e61be1b6a
Add test cases
2024-03-14 22:25:36 +00:00
Harry Maclean
dd5eb982ec
Merge pull request #15524 from hmac/hmac-process-spawn
...
Ruby: Add some more command injection sinks
2024-03-13 09:53:10 +00:00
Joe Farebrother
dcc6f83d3b
Merge pull request #15782 from joefarebrother/ruby-typhoeus
...
Ruby: Model `Typhoeus::Request.new`
2024-03-05 16:55:38 +00:00
Harry Maclean
91cb2a37fd
Ruby: Model Process.exec
2024-03-05 10:19:22 +00:00
Harry Maclean
179aaa1342
Ruby: model Open4.popen4ext
2024-03-05 09:35:18 +00:00
Peter Stöckli
4adc373dfe
Ruby: more test cases for code injection via method
2024-03-01 16:01:07 +01:00
Joe Farebrother
65b30c1dff
Add tests and qldoc
2024-03-01 14:46:55 +00:00
Peter Stöckli
a693c6d9b4
Ruby: sinks for code injection via calls to method
2024-03-01 14:42:22 +01:00
Tom Hvitved
914a605a87
Ruby: Rework hidden synthetic data-flow nodes
2024-02-27 15:33:58 +01:00
Harry Maclean
beef9965cc
Ruby: Model Open4 library
...
Also remove duplicate modeling of Process.spawn.
2024-02-26 11:26:38 +00:00
Harry Maclean
f19a5a9837
Ruby: Add tests for Gemfile modeling
2024-02-23 11:13:16 +00:00
Harry Maclean
fbc689227d
Merge pull request #15604 from p-/p--rails-more-request-sources
...
Ruby: add additional sources on the request object of Rails
2024-02-22 16:35:59 +00:00
Joe Farebrother
92bdd637a3
Address reveiw comment - add create nd remove select_insert
2024-02-22 09:55:46 +00:00
Joe Farebrother
e36b9f4d3c
Add tests and change note
2024-02-15 15:26:20 +00:00
Peter Stöckli
2f7b946c9f
Ruby: add sources on request object of Rails
2024-02-13 15:52:18 +01:00
Harry Maclean
3d9f9afa77
Merge pull request #15566 from hmac/hmac-actioncontroller-regex
...
Ruby: Fix ActionController path regex
2024-02-12 14:14:57 +00:00
Harry Maclean
99497e5f3c
Merge pull request #15521 from hmac/hmac-ar-connection
...
Ruby: Recognise more ActiveRecord connections
2024-02-12 14:06:50 +00:00
Anders Schack-Mulligen
35a3aa0a09
Ruby: Add empty provenance column to expected files.
2024-02-09 11:32:08 +01:00
Harry Maclean
3a90d78c36
Ruby: Fix Rails view file regex
...
This picks up non-nested template files correctly.
2024-02-09 09:41:43 +00:00
Harry Maclean
48890b446d
Ruby: Add more actioncontroller tests
2024-02-09 09:31:35 +00:00
Harry Maclean
f792b58421
Ruby: Recognise more ActiveRecord connections
2024-02-05 16:45:59 +00:00
Harry Maclean
1297acf5b1
Merge pull request #14216 from hmac/hmac-graphql-enum
...
Ruby: Restrict GraphQL remote flow sources
2023-10-13 11:31:50 +01:00
Tom Hvitved
c570083163
Ruby: Improve performance of flow through (hash) splats
2023-09-27 11:49:31 +02:00
Harry Maclean
2214caef4b
Ruby: Identify named graphql params as sources
2023-09-22 17:54:55 +01:00
Harry Maclean
18dac9ab8a
Ruby: Handle GraphQL array types
2023-09-18 16:00:56 +01:00
Harry Maclean
5706bc6205
Ruby: Model GraphQL InputObject arguments
2023-09-14 19:02:39 +01:00
Harry Maclean
57ae1ee3e9
Ruby: Add test for GraphQL remote flow sources
2023-09-14 13:46:52 +01:00
Harry Maclean
20f1a74202
Ruby: Restrict GraphQL remote flow sources
...
Previously we considered any splat parameter in a graphql resolver to be
a remote flow source. Now we limit that to reads of the parameter which
yield scalar types (e.g. String), as defined by the GraphQL schema.
This should reduce GraphQL false positives.
2023-09-14 12:14:56 +01:00
Tom Hvitved
e258324960
Ruby: Allow for implicit array reads at all sinks during taint tracking
2023-09-14 09:40:05 +02:00
Tom Hvitved
48e2dcfa35
Ruby: Reimplement flow through captured variables using field flow
2023-09-06 11:00:55 +02:00
