Harry Maclean 0626d693f5 Ruby: Recognise rack applications ...

This is a basic first step in modelling rack apps. We recognise classes
that look like rack applications and then treat the argument to `call`
in the same way that we treat `request.env` in ActionController classes.

This finds a TP in CVE-2021-43840.

2023-01-12 11:28:31 +13:00

..

action_cable

Ruby: add ActionCable channel RPC params as remote-flow sources

2022-11-09 14:16:04 +00:00

action_controller

Ruby: Update for upstream changes

2022-11-16 14:06:32 +13:00

action_dispatch

Ruby: Model Mime::Type

2022-07-29 11:41:48 +12:00

action_mailbox

Ruby: Remove unused class

2022-11-30 11:50:35 +13:00

action_mailer

Ruby: add ActionMailer#params as a RemoteFlowSource

2022-10-10 10:23:48 +01:00

action_view

Add test code

2022-09-26 20:56:11 +13:00

active_record

Treat ActiveRecord.create as a model instantiation

2022-09-29 09:24:42 +13:00

active_resource

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

active_storage

Ruby: rename one of the PostsController2 classes

2022-10-31 13:33:41 +01:00

active_support

Merge pull request #11339 from aibaars/active_support_enumerable

2022-12-05 11:02:19 +01:00

app

Ruby: Model ActionDispatch::Response

2022-10-17 08:17:37 +13:00

archive

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

arel

Ruby: treat an Arel.sql call as a SqlConstruction

2022-11-10 14:11:14 +00:00

core

Ruby: Fix identification IO.open args

2022-05-10 17:32:00 +12:00

files

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

globalid

Ruby: improve coverage of GlobalID::Identification modelling

2022-12-14 15:21:19 +00:00

http_clients

Add Faraday::Connection.new as sink for SSRF query

2022-10-20 20:32:08 +00:00

json

Ruby: Model JSON.pretty_generate

2022-11-30 13:18:45 +13:00

pathname

Ruby: merge package/type columns

2022-11-23 11:17:42 +01:00

rack

Ruby: Recognise rack applications

2023-01-12 11:28:31 +13:00

railties

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

stdlib

Ruby: Add tests for ActiveSupport modelling

2022-05-24 09:35:26 +01:00

ActionDispatch.expected

Ruby: Update tests

2022-11-16 13:46:51 +13:00

ActionDispatch.ql

Ruby: merge package/type columns

2022-11-23 11:17:42 +01:00

ActionView.expected

Ruby: Update tests

2022-11-16 13:46:51 +13:00

ActionView.ql

remove use of HtmlSafeCall from tests

2022-10-18 10:43:24 +02:00

Core.expected

Ruby: Update filename in test fixture

2022-02-21 09:43:36 +13:00

Core.ql

Ruby: split tests to match stdlib changes

2022-02-17 20:44:04 +13:00

Eval.rb

Ruby: split tests to match stdlib changes

2022-02-17 20:44:04 +13:00

GraphQL.expected

Ruby: Add classes for detecting user input from graphql-ruby

2022-01-18 09:13:58 -07:00

GraphQL.ql

Ruby: Add classes for detecting user input from graphql-ruby

2022-01-18 09:13:58 -07:00

PosixSpawn.expected

Ruby: Simplify posix-spawn modeling

2022-05-26 14:29:04 +01:00

PosixSpawn.ql

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

PosixSpawn.rb

Ruby: Simplify posix-spawn modeling

2022-05-26 14:29:04 +01:00

Stdlib.rb

Ruby: split tests to match stdlib changes

2022-02-17 20:44:04 +13:00