Alex Ford
f01670f663
Ruby: add a note to a test case
2022-10-05 13:06:49 +01:00
Alex Ford
d64f8c73be
Merge branch 'main' into rb/sensitive-get-query
2022-10-05 12:59:35 +01:00
Alex Ford
977e8a8a6f
Ruby: add a test case for sensitive data from cookies for rb/sensitive-get-query (should not be flagged)
2022-10-05 12:57:07 +01:00
Arthur Baars
6509c19aad
Merge pull request #10692 from aibaars/fix-splats
...
Ruby: fix CFG and toString for anonymous '*' and '**'
2022-10-05 13:25:29 +02:00
Alex Ford
880fb2b14a
Ruby: split out rb/sensitive-get-query using query/customizations pattern
2022-10-05 11:59:40 +01:00
Arthur Baars
a080f498be
Ruby: fix CFG and toString for anonymous '*' and '**'
2022-10-05 11:50:37 +02:00
Arthur Baars
4ff85d5275
Ruby: add test case
2022-10-05 10:57:53 +02:00
Nick Rolfe
525fe12671
Merge pull request #10585 from github/nickrolfe/libxml-xxe
...
Ruby: detect uses of LibXML with entity substitution enabled by default
2022-10-05 09:51:39 +01:00
Tom Hvitved
1496c4f0e2
Merge pull request #10686 from hvitved/ruby/remove-value-pair-content
...
Ruby: Remove `PairValueContent`
2022-10-05 09:41:14 +02:00
Arthur Baars
c1c16e44ee
Merge pull request #10559 from aibaars/cve-2019-3881
...
Ruby: some improvements
2022-10-04 21:24:14 +02:00
Tom Hvitved
aae9a58ca3
Ruby: Remove ValuePairContent
2022-10-04 20:10:51 +02:00
Nick Rolfe
d69a658e06
Merge pull request #10673 from github/nickrolfe/no_abstract
...
Ruby: remove public abstract classes for Action{View,Controller}
2022-10-04 17:49:59 +01:00
Nick Rolfe
227100d883
Ruby: make old class names available as deprecated aliases
2022-10-04 16:11:43 +01:00
Alex Ford
703829c647
Ruby: use taint tracking for rb/sensitive-get-query
2022-10-04 15:04:41 +01:00
erik-krogh
dedbe66619
update expected output
2022-10-04 14:16:07 +02:00
erik-krogh
bf74481f65
add a link to the source in the alert-message for rb/kernel-open
2022-10-04 13:41:50 +02:00
Tom Hvitved
9d7d6c29f9
Review comments
2022-10-04 12:58:50 +02:00
Tom Hvitved
77c47bc856
Ruby: Add another call graph test
2022-10-04 12:58:49 +02:00
Arthur Baars
44cc6f7350
Ruby: improve tracking of regular expressions
...
There are two flavours of `match?`. If the receiver of `match?` has type String
then the argument to `match?` is a regular expression. However, if the receiver of
`match?` has type Regexp then the argument is the text.
The role of receiver and argument flips depending on the type of the receiver, this
caused a lot of false positives when looking for string-like literals that are
used as a regular expression.
This commit attempts to improve things by trying to determine whether the type of the
receiver is known to be of type Regexp. In such cases we know that the argument
is unlikely to be regular expression.
2022-10-04 12:58:49 +02:00
Arthur Baars
0160c374e4
Ruby: add flow summaries for Object#dup and Kernel#tap
2022-10-04 12:58:49 +02:00
Arthur Baars
c2b98a4761
Ruby: add support for 'extend' method
2022-10-04 12:58:49 +02:00
Arthur Baars
09bc78eafc
Ruby: local dataflow step for || and &&
2022-10-04 12:58:49 +02:00
Arthur Baars
e95b5468d9
Ruby: use Dataflow for Pathname instead of TypeTracking
2022-10-04 12:58:49 +02:00
Nick Rolfe
a738f1d5cf
Ruby: remove public abstract classes for Action{View,Controller}
2022-10-04 10:53:41 +01:00
Harry Maclean
42a97b26bb
Merge pull request #10316 from hmac/hmac/actionview
...
Ruby: Model ActionView
2022-10-04 08:16:16 +13:00
Tom Hvitved
d52d3d7b75
Merge pull request #10644 from hvitved/ruby/prevent-reevaluation
...
Ruby: Prevent reevaluation of expensive predicates
2022-10-03 13:10:39 +02:00
Asger F
47e5623b90
Merge pull request #10639 from hvitved/ruby/dataflow/known-element-no-floats-complexs
...
Ruby: Do not attempt to track precise hash indices for floats and complex numbers
2022-10-03 09:23:33 +02:00
Harry Maclean
ba83b7c6c7
Merge pull request #10599 from hmac/hmac/actioncontroller-datastreaming
...
Ruby: Model send_file
2022-10-03 09:44:05 +13:00
Alex Ford
5c32c8badf
Merge pull request #10560 from alexrford/ruby/yaml-load_file
...
Ruby: treat `Psych` and `YAML` as aliases for rb/unsafe-deserialization
2022-10-02 20:19:10 +01:00
Tom Hvitved
292bc67125
Merge pull request #10620 from hvitved/ruby/call-graph-protected-methods
...
Ruby: Account for `protected` methods in call graph
2022-09-30 19:31:36 +02:00
Tom Hvitved
dd7458acc8
Ruby: Add more call graph tests for protected methods
2022-09-30 16:24:34 +02:00
Tom Hvitved
3ec43dbd16
Ruby: Do not attempt to track precise hash indices for floats and complex numbers
2022-09-30 14:57:50 +02:00
Tom Hvitved
299339f817
Ruby: Expose relevant predicates from internal/Module.qll and make sure they are cached
2022-09-30 14:56:55 +02:00
Asger F
6e1914ad01
Merge pull request #10375 from asgerf/rb/summarize-loads-v2
...
Ruby: type-tracking and API edges through simple library callables
2022-09-30 14:25:17 +02:00
Nick Rolfe
ef8ec0878a
Merge pull request #10641 from github/nickrolfe/a_an
...
JS/Python/Ruby: s/a HTML/an HTML/
2022-09-30 12:17:15 +01:00
Nick Rolfe
ed74e0aad1
JS/Python/Ruby: s/a HTML/an HTML/
2022-09-30 10:37:52 +01:00
Michael Nebel
82294c1349
Merge pull request #10622 from michaelnebel/ruby/postupdateassignexpr
...
Ruby: Postupdate notes for assignment expressions.
2022-09-30 10:00:02 +02:00
Harry Maclean
4a39bc8f47
Merge pull request #10598 from hmac/hmac/actioncontroller-metal
...
Ruby: Identify ActionController::Metal controllers
2022-09-30 13:07:03 +13:00
Asger F
ae60b0ae6d
Ruby: ensure pruning works with startInContent
2022-09-29 15:54:51 +02:00
Michael Nebel
dd0f19d0b0
Ruby: Update expected test output.
2022-09-29 14:12:20 +02:00
Michael Nebel
af4db77046
Ruby: Update expected test output.
2022-09-29 13:54:59 +02:00
Michael Nebel
9ee831a378
Ruby: Add (failing) test case for flow out via assignment expression.
2022-09-29 13:54:32 +02:00
Asger F
dc03557aea
Merge branch 'main' into rb/summarize-loads-v2
2022-09-29 12:07:30 +02:00
Tom Hvitved
e9b96c19b8
Ruby: Account for protected methods in call graph
2022-09-29 11:58:04 +02:00
Asger F
296c0a7925
Merge pull request #10603 from asgerf/type-model-api-node
...
Add TypeModel.getAnApiNode
2022-09-29 11:39:09 +02:00
Tom Hvitved
58b7556bdf
Ruby: Add call graph tests for protected methods
2022-09-29 11:37:35 +02:00
Harry Maclean
4217a50900
Treat ActiveRecord.create as a model instantiation
2022-09-29 09:24:42 +13:00
Harry Maclean
424f31a24a
Add test for AR Model.create instantiations
...
These currently aren't recognised.
2022-09-29 09:24:42 +13:00
Harry Maclean
63309150e0
Make some space
2022-09-29 09:24:37 +13:00
Harry Maclean
e7d19e849f
Merge pull request #10090 from hmac/hmac/activestorage
...
Ruby: Model Activestorage
2022-09-29 09:16:25 +13:00
