codeql/ruby/ql/lib/change-notes/released/0.8.13.md

0.8.13

Minor Analysis Improvements

• Data flow is now tracked through ActiveRecord scopes.
• Modeled instances of ActionDispatch::Http::UploadedFile that can be obtained from element reads of ActionController::Parameters, with calls to original_filename, content_type, and read now propagating taint from their receiver.
• The second argument, subquery_name, of the ActiveRecord::QueryMethods::from method, is now recognized as an sql injection sink.
• Calls to Typhoeus::Request.new are now considered as instances of the Http::Client::Request concept, with the response body being treated as a remote flow source.
• New command injection sinks have been added, including Process.spawn, Process.exec, Terrapin::CommandLine and the open4 gem.