Alex Ford 594812640e Merge pull request #10746 from alexrford/ruby/activejob-deserialize ...

Ruby: Add `ActiveJob::Serializers.deserialize` as a code execution sink

2022-10-13 15:36:45 +01:00

..

cwe-020

Ruby: improve tracking of regular expressions

2022-10-04 12:58:49 +02:00

cwe-022

Recognise send_file as a FileSystemAccess

2022-09-28 12:14:22 +13:00

cwe-078

update expected output

2022-10-04 14:16:07 +02:00

cwe-079

Ruby: local dataflow step for || and &&

2022-10-04 12:58:49 +02:00

cwe-089

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-094

Ruby: Add ActiveJob::Serializers.deserialize as a code execution sink

2022-10-09 22:28:22 +01:00

cwe-116

JS/Python/Ruby: s/a HTML/an HTML/

2022-09-30 10:37:52 +01:00

cwe-117

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-134

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-295

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-300

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

cwe-312

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-327

ruby: update rb/weak-cryptographic-algorithm to specify the block mode if appropriate

2022-05-13 16:32:30 +01:00

cwe-352

Ruby: add missing example rails action

2022-01-19 13:47:00 +00:00

cwe-502

Ruby: add rb/unsafe-deserialization sinks for const_get args

2022-10-11 15:45:51 +01:00

cwe-506

make the alert messages of taint-tracking queries more consistent

2022-09-07 12:22:50 +02:00

cwe-601

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-611

Ruby: detect uses of libxml with entity substitution enabled by default

2022-09-27 11:53:43 +01:00

cwe-732

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-798

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-807-user-controlled-bypass

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-829

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

cwe-912

update expected output

2022-10-11 11:37:26 +02:00

cwe-918

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-1333-exponential-redos

add further normalization of char classses

2022-06-23 14:36:25 +02:00

cwe-1333-polynomial-redos

add case-in as a sink for polynomial-redos

2022-10-13 12:36:07 +02:00

cwe-1333-regexp-injection

apply suggestions from review

2022-09-13 10:52:23 +02:00

decompression-api

update test expectation

2022-06-20 17:27:33 +00:00