Andrew Eisenberg
a7f755cf12
Add new groups for examples packs
...
Also, remove version numbers. Will make it easier to avoid publishing
the examples packs.
2022-01-26 14:49:18 -08:00
Edoardo Pirovano
1b539eb4dc
Merge branch rc/3.4 into main
2022-01-25 16:22:01 +00:00
Tom Hvitved
aa9cfebc65
Ruby: Replace getValueText with getConstantValue
2022-01-21 09:19:19 +01:00
Erik Krogh Kristensen
a77b2b0209
Merge pull request #7668 from erik-krogh/simplify-casts
...
simplify expressions that could be type-casts
2022-01-20 15:20:18 +01:00
Alex Ford
9613ff743b
Merge pull request #7611 from github/ruby/protect_from_forgery-without-exception
...
Ruby: flag up `protect_from_forgery` calls without an exception strategy
2022-01-20 13:45:30 +00:00
github-actions[bot]
ab218421da
Post-release preparation for codeql-cli-2.7.6
2022-01-20 12:59:20 +00:00
Erik Krogh Kristensen
4e8e3a7420
simplify expressions that could be type-casts
2022-01-20 10:41:35 +01:00
github-actions[bot]
4ce8ccc52b
Release preparation for version 2.7.6
2022-01-20 08:21:18 +00:00
Alex Ford
45ed5a806c
Ruby: changenote for rb/csrf-protection-disabled enhancement
2022-01-19 13:41:00 +00:00
Alex Ford
d09f48ecb4
Ruby: flag up protect_from_forgery calls without an exception strategy
2022-01-16 20:56:13 +00:00
Andrew Eisenberg
fbb5d7196f
Merge branch 'main' into post-release-prep/codeql-cli-2.7.5
2022-01-14 08:23:43 -08:00
github-actions[bot]
8a2d92badc
Post-release preparation for codeql-cli-2.7.5
2022-01-12 13:28:43 +00:00
Alex Ford
712972cb82
Ruby: formatting
2022-01-04 16:41:23 +00:00
github-actions[bot]
1dfcf427aa
Release preparation for version 2.7.5
2022-01-04 14:44:56 +00:00
Alex Ford
dadaf25262
Merge branch 'main' into ruby/rails-cookie-config
2022-01-04 12:04:44 +00:00
yoff
5ba70ff3b6
Merge pull request #7369 from RasmusWL/filter-tag-cwe
...
JS/Py/Ruby: Add more CWEs to bad-tag-filter queries
2022-01-04 10:11:03 +01:00
Dave Bartolomeo
ded3c52a34
Merge pull request #7407 from github/post-release-prep/codeql-cli-2.7.4
...
Post-release preparation for codeql-cli-2.7.4
2022-01-03 17:09:58 -05:00
github-actions[bot]
1334d207fa
Post-release version bumps
2022-01-03 20:11:15 +00:00
Alex Ford
7d3932dc8d
Merge remote-tracking branch 'origin/main' into ruby/rails-cookie-config
2021-12-22 17:54:03 +00:00
Alex Ford
7f01be7067
Ruby: use new changenote format for rb/weak-cookie-configuration
2021-12-22 17:47:44 +00:00
Alex Ford
737f7332bc
Ruby: add rb/weak-cookie-configuration query
2021-12-22 17:47:44 +00:00
Jeff Gran
7c032f6cb4
fix docs, fix deprecations
2021-12-22 08:35:55 -07:00
Nick Rolfe
dba26a92e9
Merge remote-tracking branch 'origin/main' into nickrolfe/user-controlled-bypass
2021-12-16 15:05:01 +00:00
github-actions[bot]
59da2cdf69
Release preparation for version 2.7.4
2021-12-14 21:35:09 +00:00
Rasmus Wriedt Larsen
1e45fa9ed4
JS/Py/Ruby: Add more CWEs to bad-tag-filter queries
...
CWE-185: Incorrect Regular Expression
The software specifies a regular expression in a way that causes data to
be improperly matched or compared.
https://cwe.mitre.org/data/definitions/185.html
CWE-186: Overly Restrictive Regular Expression
> A regular expression is overly restrictive, which prevents dangerous values from being detected.
>
> (...) [this CWE] is about a regular expression that does not match all
> values that are intended. (...)
https://cwe.mitre.org/data/definitions/186.html
From my understanding,
CWE-625: Permissive Regular Expression, is not applicable. (since this
is about accepting a regex match where there should not be a match).
2021-12-13 10:23:24 +01:00
Nick Rolfe
a4da528812
Ruby: query to find user-controlled bypass of sensitive actions
2021-12-10 11:41:09 +00:00
github-actions[bot]
87b968f337
Post-release preparation 2.7.3
2021-12-02 00:46:55 +00:00
github-actions[bot]
337ce65fe5
Release preparation for version 2.7.3
2021-11-30 20:39:35 +00:00
Dave Bartolomeo
9f6c0991cf
Catch up with recent change notes
2021-11-29 16:41:18 -05:00
Dave Bartolomeo
5ed9029143
Move change notes to correct directories
2021-11-29 16:31:11 -05:00
Dave Bartolomeo
75fb47c76f
Ruby change notes
2021-11-29 16:17:19 -05:00
Dave Bartolomeo
d0dac03bad
Manually bump versions
2021-11-29 14:21:08 -05:00
Dave Bartolomeo
2dfcd1dd9c
Add groups property
...
Also removed versions from test packs
2021-11-29 14:15:53 -05:00
Rasmus Wriedt Larsen
2a5e0a3b77
Merge pull request #7145 from RasmusWL/remove-owasp-tags
...
Python/Ruby: Remove owasp tags
2021-11-24 13:56:48 +01:00
Nick Rolfe
1a90b388a9
Merge remote-tracking branch 'origin/main' into nickrolfe/regex_injection
2021-11-23 15:42:05 +00:00
Alex Ford
055641e684
Merge pull request #7062 from github/ruby/rails-csrf
...
Ruby: Add `rb/csrf-protection-disabled` query
2021-11-23 13:46:42 +00:00
Nick Rolfe
5b11cfe006
Ruby: fix up import path
2021-11-22 17:10:46 +00:00
Nick Rolfe
752b126862
Merge remote-tracking branch 'origin/main' into nickrolfe/regex_injection
2021-11-22 17:05:27 +00:00
Harry Maclean
6f22867af9
Merge pull request #7015 from github/hmac/ssrf
...
Ruby: Add Server-Side Request Forgery query
2021-11-22 12:41:39 +00:00
Erik Krogh Kristensen
9f08acab7e
Merge pull request #7170 from erik-krogh/qldocStyle
...
Ruby: use A/An/The to start qlDoc for classes
2021-11-19 17:34:35 +01:00
Erik Krogh Kristensen
75586b0cf6
Apply suggestions from code review
...
Co-authored-by: Nick Rolfe <nickrolfe@github.com >
2021-11-19 13:23:01 +01:00
Harry Maclean
8fc7e4be43
Ruby: Increase precision of SSRF query
2021-11-19 11:28:09 +00:00
Harry Maclean
e87a4531d8
Remove redundant imports
2021-11-19 11:28:08 +00:00
Harry Maclean
ac20eafecc
Add qhelp for Ruby SSRF
2021-11-19 11:28:08 +00:00
Harry Maclean
2bba31eb02
Update metadata of Ruby SSRF query
2021-11-19 11:28:08 +00:00
Harry Maclean
dc464879a2
Add a query for server-side request forgery
2021-11-19 11:28:08 +00:00
Erik Krogh Kristensen
af55f172ae
use A/An/The to start qlDoc for classes
2021-11-18 15:42:45 +01:00
Erik Krogh Kristensen
011fc20963
use matches instead of regexpMatch
2021-11-18 15:41:25 +01:00
Erik Krogh Kristensen
1cca377e7d
Merge pull request #6561 from erik-krogh/htmlReg
...
JS/Py/Ruby: add a bad-tag-filter query
2021-11-18 09:39:13 +01:00
Rasmus Wriedt Larsen
98e6fc8a88
Python/Ruby: Remove owasp tags
...
These are no longer correct, since the A1 category changed from 2017 to
2021, see https://owasp.org/Top10/#whats-changed-in-the-top-10-for-2021
Since only a very few queries had these tags, I think we're much better
off having them removed.
2021-11-16 12:03:50 +01:00
