Erik Krogh Kristensen 59a8b21851 Merge pull request #10862 from erik-krogh/unsafeCodeConstruction ...

Rb: Add an `unsafe-code-construction` query

2023-01-16 13:22:58 +01:00

..

cwe-020

Ruby: improve tracking of regular expressions

2022-10-04 12:58:49 +02:00

cwe-022

add support for super calls to Kernel

2022-12-06 14:25:51 +01:00

cwe-078

Add suggestions to fix FileJoinSanitizer

2022-12-09 09:42:44 +01:00

cwe-079

Merge branch 'main' into formatTaint

2022-10-20 10:46:16 +02:00

cwe-089

Ruby: treat an Arel.sql call as a SqlConstruction

2022-11-10 14:11:14 +00:00

cwe-094

use eval() instead of send() in test

2023-01-05 20:04:04 +01:00

cwe-116

Ruby: Remove omittable exists variables

2023-01-10 13:39:49 +01:00

cwe-117

Ruby: Consider Object#inspect a log sanitizer

2022-11-16 13:46:51 +13:00

cwe-134

add String#% as a printf like call

2022-10-17 13:51:43 +02:00

cwe-209

Ruby: StackTraceExposure: add test for a specific rescue type

2022-11-24 14:08:34 +00:00

cwe-295

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-300

Ruby: Fix tag missing from getARelevantTag

2022-10-27 09:12:06 +02:00

cwe-312

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-327

Ruby: weak crypto: do not report weak hash algorithms

2022-11-04 15:58:50 +01:00

cwe-352

Ruby: add missing example rails action

2022-01-19 13:47:00 +00:00

cwe-502

drive-by: make Base64.decode64(..) into a flowsummary that is shared with all queries

2023-01-06 09:04:37 +01:00

cwe-506

make the alert messages of taint-tracking queries more consistent

2022-09-07 12:22:50 +02:00

cwe-598

Ruby: update rb/sensitive-get-query tests

2022-10-13 22:41:34 +01:00

cwe-601

Ruby: Add kind to Http::Server::RequestInputAccess

2022-10-13 13:24:16 +13:00

cwe-611

Ruby: detect uses of libxml with entity substitution enabled by default

2022-09-27 11:53:43 +01:00

cwe-732

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-798

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-807-user-controlled-bypass

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-829

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

cwe-912

update expected output

2022-10-11 11:37:26 +02:00

cwe-918

Add Faraday::Connection.new as sink for SSRF query

2022-10-20 20:32:08 +00:00

cwe-1333-exponential-redos

update expected output of the queries (some sorting changed due to locations being used slightly differently in the shared pack)

2022-11-07 14:34:20 +01:00

cwe-1333-polynomial-redos

add case-in as a sink for polynomial-redos

2022-10-13 12:36:07 +02:00

cwe-1333-regexp-injection

apply suggestions from review

2022-09-13 10:52:23 +02:00

decompression-api

update test expectation

2022-06-20 17:27:33 +00:00