Anders Schack-Mulligen
8c23e21073
Dataflow: Cache compatibleTypes.
2024-06-24 13:35:48 +02:00
Tom Hvitved
8ea4f85de3
Ruby: Rework Sinatra.FilterJumpStep
2024-06-21 08:57:59 +02:00
Alex Ford
6c3d90e8a0
Merge pull request #16650 from alexrford/rb/routing-improvements
...
Ruby: ActionDispatch - support `path => target` route format
2024-06-18 11:17:05 +01:00
Joe Farebrother
eee7f5a896
Use a combined regex for performance
2024-06-17 22:21:33 +01:00
Joe Farebrother
90d6f2ece3
Factor out nameIndicatesRelevantSensitiveData
2024-06-12 15:11:47 +01:00
Tom Hvitved
605fe54a06
Ruby: Remove two Cartesian products
2024-06-12 15:11:43 +01:00
Joe Farebrother
b0c03f6d68
Allow implicit read steps on sinks
2024-06-12 15:11:32 +01:00
Joe Farebrother
8b51ee8fe8
Use additional sensitive data heuristics in CleartextSources
2024-06-12 15:11:27 +01:00
Arthur Baars
4ee80653e2
Merge pull request #16471 from Sim4n6/ruby-UBV
...
Ruby: Add some method calls as a Source
2024-06-12 12:42:08 +02:00
Anders Schack-Mulligen
5d51b5b97b
Ruby: Add support for pretty-printed provenace in tests. Convert one test.
2024-06-07 11:47:48 +02:00
Asger F
6e0f3df573
Merge pull request #14120 from asgerf/dynamic/typemodel-istypeused
...
Dynamic: add TypeModel.isTypeUsed
2024-06-06 15:31:16 +02:00
Sim4n6
dabc33bf66
simplify UnicodeBypassValidationQuery code
2024-06-05 22:45:49 +01:00
Sim4n6
7dcbbbac91
Refactor UnicodeBypassValidationQuery to remove unnecessary code
2024-06-05 13:05:34 +01:00
Alex Ford
1100b75a3c
Ruby: handle routes with path/action pairs
2024-05-31 15:54:57 +01:00
Alex Ford
4644f08195
Ruby: Routing.qll - rename call as methodCall
2024-05-31 14:45:32 +01:00
Alex Ford
25f9449f53
Ruby: Routing.qll - rename method as httpMethod
2024-05-31 14:45:26 +01:00
Alex Ford
af9ed21c36
Ruby: Routing.qll - rename method as methodCall
2024-05-31 14:45:20 +01:00
Tom Hvitved
69fb2bb97c
Merge pull request #16597 from hvitved/tree-sitter/empty-location
...
Tree-sitter: Emit `empty_location` relation to avoid scan
2024-05-27 15:19:15 +02:00
Anders Schack-Mulligen
1432519cc2
Dataflow: Add totalorder predicates to all languages.
2024-05-27 11:01:52 +02:00
Anders Schack-Mulligen
bc8ca1af86
Dataflow: Introduce NodeRegions for use in isUnreachableInCall.
2024-05-27 11:01:51 +02:00
Tom Hvitved
94d2e9591d
Tree-sitter: Emit empty_location relation to avoid scan
2024-05-27 10:39:21 +02:00
Alex Ford
8119a27540
Merge pull request #16185 from alexrford/rb/conditions-arr0
...
Ruby: ActiveRecord - refine `conditions` argument as an SQLi sink
2024-05-22 12:19:10 +01:00
Asger F
13d01f1ec4
Ruby/Python: add recursion guard
2024-05-21 14:40:15 +02:00
Asger F
14c71a351e
Sync shared files
2024-05-21 14:38:55 +02:00
Joe Farebrother
01a6c5e82f
Merge pull request #16446 from joefarebrother/shared-sensitive-heuristics
...
Ruby/Python/JS/Swift: Add category of Private information to shared sensitive data heuristics
2024-05-21 09:07:13 +01:00
Sim4n6
7f153ed07b
Add some method calls as a Source
2024-05-12 09:46:36 +01:00
Joe Farebrother
9aff22c664
Fix typos in sensitive data regex
2024-05-09 09:39:03 +01:00
Joe Farebrother
5f4bc4197b
Add private category to sensitive data heuristics
2024-05-08 10:02:00 +01:00
Harry Maclean
ef88f3ed09
Merge pull request #16377 from hmac/hmac-sanitization-fp
...
Ruby: Fix StringSubstitutionCall charpred
2024-05-02 13:31:01 +01:00
Owen Mansel-Chan
83249cd9c2
Fix grammar in comment
2024-05-02 09:59:48 +01:00
Owen Mansel-Chan
16dcc0969b
Standardise comment explaining why extensible predicates must be defined
2024-05-01 22:00:01 +01:00
Owen Mansel-Chan
09e59ccf44
Name files with empty definitions of MaD extensible predicates to erowdmpty.model.yml
2024-05-01 21:39:38 +01:00
Harry Maclean
f7fc2e0b00
Ruby: Fix StringSubstitutionCall charpred
...
Some missing parens meant this class targeted way more things than
intended.
2024-05-01 16:14:58 +01:00
Erik Krogh Kristensen
7e839792da
Merge pull request #16330 from erik-krogh/del-deps-apr-2024
...
All: delete outdated deprecations
2024-04-30 10:43:39 +02:00
Harry Maclean
51bc8e917e
Ruby: Reduce FPs for rb/incomplete-hostname-regexp
...
Arguments in calls to `match[?]` should only be considered regular
expression interpretations if the `match` refers to the standard library
method, not a method in source code.
2024-04-29 11:19:34 +01:00
erik-krogh
baa31e1469
delete outdated deprecations
2024-04-25 22:19:28 +02:00
Nick Rolfe
8f2e51faa6
Ruby: do fewer regexp matches in SensitiveActions
2024-04-24 12:32:49 +01:00
Nick Rolfe
af72c0848e
Merge pull request #16306 from github/nickrolfe/js-sensitive
...
JS: do fewer regexp matches in SensitiveActions
2024-04-24 09:49:44 +01:00
Nick Rolfe
003d208574
JS: do fewer regexp matches in SensitiveActions
2024-04-23 15:31:38 +01:00
Anders Schack-Mulligen
b2f09949df
Merge pull request #15599 from aschackmull/dataflow/fieldflowbranchlimit-v2
...
Dataflow: update fieldFlowBranchLimit semantics
2024-04-23 10:08:05 +02:00
Asger F
3335d48154
Sync files
2024-04-16 20:26:41 +02:00
Asger F
be64daf265
Merge branch 'main' into js/graph-export
2024-04-16 20:23:33 +02:00
Tom Hvitved
75b1e14098
Merge pull request #16205 from samgiz/samgiz-tiny-docs-fix
...
Tiny docs fix
2024-04-16 13:57:38 +02:00
Anders Schack-Mulligen
2f0987e980
Dataflow: Add dummy DataFlowSecondLevelScope implementations.
...
These could be an empty type, but Unit was available and it probably
doesn't matter.
2024-04-15 15:16:30 +02:00
Zigmas Bitinas
5125468307
Tiny docs fix
...
Noticed the mistake when browsing the docs [here](https://codeql.github.com/codeql-standard-libraries/ruby/codeql/ruby/security/CodeInjectionCustomizations.qll/module.CodeInjectionCustomizations$CodeInjection$FlowState.html )
2024-04-13 21:18:36 +01:00
Alex Ford
91bca4a2c3
Ruby: limit ActiveRecord conditions sink to first array element
2024-04-12 15:32:16 +01:00
Tom Hvitved
e7dc120456
Add deprecation comments
2024-04-12 13:40:15 +02:00
Tom Hvitved
04de315e0e
Ruby: Deprecate models-as-data CSV interface
2024-04-12 13:40:14 +02:00
Joe Farebrother
5cebcadc56
Merge pull request #15987 from joefarebrother/ruby-mass-reassignment
...
Ruby: Add query for insecure mass assignment
2024-04-12 10:18:41 +01:00
Anders Schack-Mulligen
6991f5452f
Ruby: Add alert provenance plumbing.
2024-04-12 09:20:04 +02:00
