Alvaro Muñoz
dd31be43e0
Support for Twirp framework
2023-02-03 09:35:22 +01:00
Harry Maclean
0d68d88741
Merge pull request #11934 from hmac/actioncontroller-filters
2023-02-01 09:10:30 +13:00
Harry Maclean
c99a096c9b
Ruby: Update test fixtures
2023-01-31 11:27:19 +13:00
Harry Maclean
69ed00cdf1
Ruby: QL4QL fix
2023-01-31 11:06:32 +13:00
erik-krogh
f04a9cb523
Merge branch 'main' into rbRegConcept
2023-01-30 11:05:40 +01:00
Harry Maclean
f7cdd430a2
Ruby: Small fix
2023-01-30 21:55:19 +13:00
Harry Maclean
7778524e08
Ruby: Refactor
2023-01-30 21:52:59 +13:00
Harry Maclean
5e9210fcea
Ruby: use getAnAncestor
2023-01-30 21:21:38 +13:00
Harry Maclean
708e303c01
Ruby: Model except: with a const argument
2023-01-30 21:17:31 +13:00
Harry Maclean
28716866d8
Ruby: getAction -> getAnAction
2023-01-30 18:52:47 +13:00
Harry Maclean
246ad46eb1
Ruby: Account for filter skip ordering
...
A `skip_*_filter :foo` call only has an effect if there was an earlier
call that registered `:foo` as a filter.
2023-01-30 18:50:30 +13:00
Harry Maclean
a164e76a5d
Ruby: Model actioncontroller filter overrides
...
If a filter is registered twice with the same name, the last
registration wins.
2023-01-30 18:05:22 +13:00
Harry Maclean
28c3bd3e2f
Ruby: QL4QL fix
2023-01-30 17:41:36 +13:00
Harry Maclean
fb86ef4aac
Ruby: Model ActionController filters
...
ActionController filters provide a way to register callbacks that run
before, after or around an action (i.e. HTTP request handler). They run
in the same class context as the action, so can get/set instance
variables and generally interact with the action in arbitrary ways.
In order to track flow between filters and actions, we have to model the
callback chain. This commit does that. A later change will add dataflow
steps to actually track flow through the chain.
2023-01-30 17:41:36 +13:00
Mathias Vorreiter Pedersen
95b15825f9
DataFlow: Sync identical files.
2023-01-27 16:24:31 +00:00
Harry Maclean
07a7a213b3
Merge pull request #11871 from hmac/rack
2023-01-26 08:40:30 +13:00
Alex Ford
3dd9392f5e
Merge pull request #11869 from alexrford/rails/render_locals_shared
...
Ruby: Rails - generalize rails flow step for accessing render locals hash in view
2023-01-25 12:07:26 +00:00
erik-krogh
54b0350cac
add note in ReDoS qhelp that Ruby 3.2 has fixed ReDoS
2023-01-25 10:24:11 +01:00
Harry Maclean
e6e4e29bf8
Ruby: newline
2023-01-23 21:53:52 +00:00
Harry Maclean
224db456af
Ruby: Simplify isRackResponse
2023-01-23 21:53:09 +00:00
Harry Maclean
60f9635ada
Ruby: Move import
2023-01-23 21:51:27 +00:00
Harry Maclean
c1207e0938
Ruby: Fix rack response tracking
...
Use type tracking instead of getReturningNode, which seems to be faster
and works correctly for the cases I've tried.
2023-01-23 21:43:04 +00:00
Erik Krogh Kristensen
240248b9cf
Merge pull request #11453 from erik-krogh/unsafeHtmlConstruction
...
RB: add unsafe-html-construction query
2023-01-23 16:40:25 +01:00
Erik Krogh Kristensen
5be97f3761
Merge pull request #11909 from erik-krogh/concatCode
...
Rb: recognize string concatenations as sinks for unsafe-code-construction
2023-01-23 16:22:46 +01:00
erik-krogh
ae00518ddf
remove the isAdditionalTaintStep predicate from UnsafeHtmlConstructionQuery, as it was not needed
2023-01-23 15:27:19 +01:00
erik-krogh
7c6ee5f293
Merge branch 'main' into unsafeHtmlConstruction
2023-01-23 15:01:01 +01:00
Erik Krogh Kristensen
32c4cf5769
Apply suggestions from code review
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-01-23 14:58:04 +01:00
erik-krogh
800077dabe
changes based on feedback
2023-01-23 14:54:36 +01:00
Alex Ford
3b10a2de11
Merge branch 'main' into rails/render_locals_shared
2023-01-23 10:00:22 +00:00
Alex Ford
55550e7980
Merge pull request #11941 from alexrford/summary-component-tostring-syntheticglobal
...
Add missing toString case for synthetic globals
2023-01-23 10:00:00 +00:00
Arthur Baars
99148244a4
Merge pull request #11856 from aibaars/update-grammars
...
Update grammars
2023-01-23 09:46:50 +01:00
Michael Nebel
69a42d8b1f
Merge pull request #11931 from michaelnebel/csharp/refactor
...
Remove the Csv postfix of some predicate names.
2023-01-23 09:09:48 +01:00
Harry Maclean
21ce9b448a
Ruby: Attempt to fix performance of AppCandidate
...
`DataFlow::MethodNode.getAReturningNode` is expensive to compute.
Instead we look for rack responses which flow to the `SynthReturnNode`.
Each method has only one of these (vs many "returning" nodes) so it is
a lot faster.
I'm not sure yet whether the results are the same.
2023-01-23 15:25:52 +13:00
github-actions[bot]
b62cb6ba84
Post-release preparation for codeql-cli-2.12.1
2023-01-20 19:49:56 +00:00
Alex Ford
8ae993185c
Ruby: fix missing docs
2023-01-20 13:40:19 +00:00
Alex Ford
c986ea1070
Ruby: scope local_assigns synthetic globals to both render call and template file
2023-01-20 13:40:19 +00:00
Alex Ford
14c896215c
Ruby: factor out some RenderCall methods into a helper module
2023-01-20 13:40:19 +00:00
Alex Ford
03070c9fd0
Ruby: restrict AccessLocalsKeySummary to method calls against self
2023-01-20 13:40:19 +00:00
Alex Ford
f6516db105
Ruby: correct preservesValue in AccessLocalsKeySummary
2023-01-20 13:40:19 +00:00
Alex Ford
ab72301a4c
Ruby: add a change note for rails render locals dataflow
2023-01-20 13:40:19 +00:00
Alex Ford
8fec4b804f
Ruby: StoredXSS test whitespace change
2023-01-20 13:40:19 +00:00
Alex Ford
fd8dd5e103
Ruby: update StoredXSS test output
2023-01-20 13:40:19 +00:00
Alex Ford
8845157d08
Ruby: slightly limit AccessLocalsKeySummary summarized callables
2023-01-20 13:40:19 +00:00
Alex Ford
b5cc1087fe
Ruby: add LocalAssignsHashSyntheticGlobal#getARenderCall predicate
2023-01-20 13:40:19 +00:00
Alex Ford
022171923c
Ruby: fix some ql for ql alerts
2023-01-20 13:40:19 +00:00
Alex Ford
bea110b598
Ruby: remove blank line in test file
2023-01-20 13:40:19 +00:00
Alex Ford
b78ae1608e
Ruby: remove a fixed TODO
2023-01-20 13:40:19 +00:00
Alex Ford
e5fbc92856
Ruby: generalize rails flow step for accessing render locals hash in view
2023-01-20 13:40:19 +00:00
Alex Ford
e4df1f5a6f
Ruby: add missing toString case for synthetic globals
2023-01-20 13:31:43 +00:00
github-actions[bot]
005b3e4a47
Release preparation for version 2.12.1
2023-01-20 12:03:19 +00:00
