Chad Bentz
46d330cb21
Merge branch 'ruby-framework-grape' of github.com:felickz/codeql into ruby-framework-grape
2025-09-23 10:40:46 -04:00
Chad Bentz
37e0c30842
Add expected output for VariablesConsistency test case
2025-09-23 10:40:30 -04:00
Chad Bentz
7a9a259c03
Merge branch 'main' into ruby-framework-grape
2025-09-22 19:29:36 -04:00
Chad Bentz
89fd9694ce
codeql query format
2025-09-22 19:25:05 -04:00
Chad Bentz
0665c39a07
Refactor GrapeHelperMethod constructor to reuse getHelperSelf to traverse dataflow instead of AST
...
- add tests to check for nested helpers
2025-09-22 19:08:34 -04:00
Chad Bentz
f4bbbc346f
Refactor Grape framework to be encapsulated properly in Module
2025-09-19 19:06:50 -04:00
Chad Bentz
89e9ee43c0
Convert from GrapeHelperMethodTaintStep extends AdditionalTaintStep to a simplified GrapeHelperMethodTarget extends AdditionalCallTarget
2025-09-19 18:28:45 -04:00
Anders Schack-Mulligen
d93b2edc0d
Ruby: Accept test changes.
2025-09-18 08:13:43 +02:00
Chad Bentz
c5e3be2c4c
Grape - detect params calls inside helper methods
...
- added unit tests for flow using inline format
- removed grape from Arel tests (temporary)
2025-09-16 17:09:18 -04:00
Chad Bentz
ffd32efba2
codeql query format
2025-09-16 09:08:07 -04:00
Chad Bentz
a8d4d6b563
Apply naming standards + changenote
2025-09-15 22:02:03 -04:00
Chad Bentz
5cfa6e83b3
Add support for route parameters(+ blocks), headers, and cookies in Grape API
2025-09-12 22:51:47 -04:00
Chad Bentz
3252bd39d2
Enhance Grape framework with additional data flow modeling and helper method support
2025-09-12 22:13:21 -04:00
Chad Bentz
738ab6fba7
Refactor Grape framework code for improved readability and consistency
2025-09-12 19:23:15 -04:00
Chad Bentz
d295acc3c3
Add initial support for Ruby Grape
2025-09-12 19:22:05 -04:00
Arthur Baars
5d3ec35e29
Remove non-breaking spaces from code
2025-09-05 09:41:15 +02:00
Anders Schack-Mulligen
c1662cf05c
C#/Ruby: Accept qltest changes.
...
Mostly toString changes, and a slight change to
splitting in C#.
2025-09-01 12:56:07 +02:00
Anders Schack-Mulligen
d8c193df18
Ruby: Use shared SuccessorType.
2025-09-01 12:56:04 +02:00
Anders Schack-Mulligen
e2eb6dbbf2
Ruby: Fix query compilation.
2025-09-01 11:26:37 +02:00
Matt Schwager
5192f3128a
Update expected test output
2025-07-21 15:26:39 -04:00
Matt Schwager
9da94fb880
Fix #19294 , Ruby NetHttpRequest improvements
2025-07-21 15:17:54 -04:00
Jeroen Ketema
f4ba2e1fd0
Properly share CryptoAlgorithms and CryptoAlgorithmNames
2025-07-14 11:39:00 +02:00
Jeroen Ketema
52bbfa30d2
Ruby: update expected test results
2025-07-04 15:32:07 +02:00
Nora Dimitrijević
89f1ee0301
Ruby: add meta/TaintedNodes.ql test
2025-06-26 13:22:07 +02:00
Nora Dimitrijević
92a48cdc2b
Ruby: convert InsecureDownload test to .qlref
2025-06-24 14:57:59 +02:00
Nora Dimitrijević
e32982057c
Ruby: convert CommandInjection test to .qlref
2025-06-24 14:57:54 +02:00
Nora Dimitrijević
8a1987ab71
Merge pull request #19448 from d10c/d10c/ruby-printast-order-fix
...
Ruby printAst: fix order for synth children of real parents
2025-05-15 18:17:01 +02:00
yoff
3fcd46ec6c
Apply suggestions from code review
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-05-13 16:57:32 +02:00
yoff
774b1820c2
ruby: also insert capturedExitRead-nodes by exceptional exits
2025-05-13 15:11:00 +02:00
yoff
73bae1627b
ruby: test for DeadStore and captured variables
2025-05-13 15:08:01 +02:00
Nora Dimitrijević
b95092ef1c
Ruby printAst: order by start line and column before synth index
...
This counteracts the movement of synth children away from the node from which they take their location, following the decision to take the index of synth children of real parents into account.
2025-05-02 15:33:02 -04:00
Nora Dimitrijević
2511f52161
Ruby printAst: fix order for synth children of real parents
...
Real parents can have synthesized children, so always assigning index 0 leads to nondeterminism in graph output.
2025-05-02 15:33:00 -04:00
Alexander Eyers-Taylor
c11ed6d119
Merge pull request #19116 from github/alexet/ruby-deterministic
...
Ruby: Make module graph queries avoid relying on evalaution order.
2025-04-22 11:27:03 +01:00
yoff
2477233508
ruby: only report on method calls
...
Interviewing a Ruby developer, I learned that
dealing with nil is common practice.
So alerts are mostly useful, if we can point to a place where this has gone wrong.
2025-04-11 15:01:57 +02:00
yoff
b641d5f177
ruby: fix FP
2025-04-11 13:22:42 +02:00
yoff
6e2cfab7b2
ruby: add test for for
...
found during triage
2025-04-11 12:46:25 +02:00
yoff
53c88da91b
ruby: refine query for uninitialised local variables
...
- there are places where uninitialised reads are intentional
- there are also some places where they are impossible
2025-04-11 03:07:19 +02:00
yoff
1ca25b2ccb
ruby: add test of rb/uninitialized-local-variable
2025-04-11 03:00:05 +02:00
yoff
385598d46d
ruby: remove some FPs from rb/useless-assignment-to-local
2025-04-07 13:28:05 +02:00
yoff
b205fedef4
ruby: add tests
2025-04-07 13:27:27 +02:00
yoff
a885e61875
Merge pull request #19206 from hvitved/ruby/super-implicit-args-synth
...
Ruby: Synthesize implicit super arguments
2025-04-07 11:57:12 +02:00
Tom Hvitved
15bfeab652
Ruby: Make getPreUpdateNode Unique Again
2025-04-04 09:43:55 +02:00
Tom Hvitved
65a11984bd
Ruby: Synthesize implicit super arguments
2025-04-03 09:13:06 +02:00
Tom Hvitved
c10b5801b1
Ruby: Add argument-less super call tests
2025-04-03 09:12:23 +02:00
Alex Eyers-Taylor
0ccbe3ef7f
Ruby: Make module graph queries avoid relying on evalaution order.
2025-04-01 16:18:45 +01:00
Anders Schack-Mulligen
e7e5f75949
Ruby: Accept test changes.
2025-03-25 12:31:04 +01:00
Tom Hvitved
a574c9f276
Ruby: Add SyntheticGlobal test
2025-03-12 09:22:41 +01:00
Anders Schack-Mulligen
97a3411c0c
Ruby: Accept test output.
2025-03-06 13:58:14 +01:00
Anders Schack-Mulligen
122034fe8c
Ruby: Switch test to use dedicated test module.
2025-03-04 12:24:23 +01:00
Anders Schack-Mulligen
1f628d0f86
Ruby: Remove reference to SsaInputNode.
2025-02-25 10:01:57 +01:00
