Erik Krogh Kristensen af98ceb3c3 Merge pull request #11478 from erik-krogh/more-shell-taint ...

Rb: more taint-steps for shell-command-construction

2023-03-20 08:41:22 +01:00

..

cwe-020

add query detecting validators that use badly anchored regular expressions on library/remote input

2023-01-30 16:34:20 +01:00

cwe-022

add support for super calls to Kernel

2022-12-06 14:25:51 +01:00

cwe-078

use allowImplicitRead instead of a taint-step from elements to the array

2023-02-28 16:09:52 +01:00

cwe-079

Merge pull request #11869 from alexrford/rails/render_locals_shared

2023-01-25 12:07:26 +00:00

cwe-089

Ruby: ActiveRecord::Connection.execute SQL sink

2023-03-13 09:03:54 +13:00

cwe-094

Merge branch 'main' into HEAD

2023-03-13 17:33:06 +01:00

cwe-116

Ruby: Update test expectations

2023-02-17 13:22:28 +01:00

cwe-117

Ruby: Consider Object#inspect a log sanitizer

2022-11-16 13:46:51 +13:00

cwe-134

add String#% as a printf like call

2022-10-17 13:51:43 +02:00

cwe-209

Ruby: StackTraceExposure: add test for a specific rescue type

2022-11-24 14:08:34 +00:00

cwe-295

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-300

Ruby: Fix tag missing from getARelevantTag

2022-10-27 09:12:06 +02:00

cwe-312

Ruby: Rely on built-in hash-flow in clear text storage query

2023-03-16 14:55:06 +01:00

cwe-327

Ruby: weak crypto: do not report weak hash algorithms

2022-11-04 15:58:50 +01:00

cwe-352

Ruby: add missing example rails action

2022-01-19 13:47:00 +00:00

cwe-502

drive-by: make Base64.decode64(..) into a flowsummary that is shared with all queries

2023-01-06 09:04:37 +01:00

cwe-506

make the alert messages of taint-tracking queries more consistent

2022-09-07 12:22:50 +02:00

cwe-598

Ruby: update rb/sensitive-get-query tests

2022-10-13 22:41:34 +01:00

cwe-601

Ruby: Add kind to Http::Server::RequestInputAccess

2022-10-13 13:24:16 +13:00

cwe-611

Ruby: detect uses of libxml with entity substitution enabled by default

2022-09-27 11:53:43 +01:00

cwe-732

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-798

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-807-user-controlled-bypass

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-829

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

cwe-912

update expected output

2022-10-11 11:37:26 +02:00

cwe-918

Add Faraday::Connection.new as sink for SSRF query

2022-10-20 20:32:08 +00:00

cwe-1333-exponential-redos

update expected output of the queries (some sorting changed due to locations being used slightly differently in the shared pack)

2022-11-07 14:34:20 +01:00

cwe-1333-polynomial-redos

Merge branch 'main' into rbPoly

2023-02-13 10:46:00 +01:00

cwe-1333-regexp-injection

apply suggestions from review

2022-09-13 10:52:23 +02:00

decompression-api

update test expectation

2022-06-20 17:27:33 +00:00