Nick Rolfe 83b3312467 Merge pull request #11207 from github/nickrolfe/arel-sql ...

Ruby: add `SqlConstruction` concept, and implement it for calls to `Arel.sql`

2022-11-14 10:21:37 +00:00

..

cwe-020

Ruby: improve tracking of regular expressions

2022-10-04 12:58:49 +02:00

cwe-022

add model for Dir.glob and other Dir methods

2022-10-24 12:05:26 +02:00

cwe-078

add join(" ") calls as a sink for rb/shell-command-constructed-from-input

2022-11-09 21:46:25 +01:00

cwe-079

remove FPs in rb/stored-xss from spurious sources

2022-10-18 11:07:48 +02:00

cwe-089

Ruby: treat an Arel.sql call as a SqlConstruction

2022-11-10 14:11:14 +00:00

cwe-094

fix rb/code-injection

2022-10-25 14:44:23 +02:00

cwe-116

JS/Python/Ruby: s/a HTML/an HTML/

2022-09-30 10:37:52 +01:00

cwe-117

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-134

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-295

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-300

Ruby: Fix tag missing from getARelevantTag

2022-10-27 09:12:06 +02:00

cwe-312

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-327

Ruby: weak crypto: do not report weak hash algorithms

2022-11-04 15:58:50 +01:00

cwe-352

Ruby: add missing example rails action

2022-01-19 13:47:00 +00:00

cwe-502

Ruby: add rb/unsafe-deserialization sinks for const_get args

2022-10-11 15:45:51 +01:00

cwe-506

make the alert messages of taint-tracking queries more consistent

2022-09-07 12:22:50 +02:00

cwe-598

Ruby: update rb/sensitive-get-query tests

2022-10-13 22:41:34 +01:00

cwe-601

Ruby: Add kind to Http::Server::RequestInputAccess

2022-10-13 13:24:16 +13:00

cwe-611

Ruby: detect uses of libxml with entity substitution enabled by default

2022-09-27 11:53:43 +01:00

cwe-732

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-798

fix some more style-guide violations in the alert-messages

2022-10-07 12:01:03 +02:00

cwe-807-user-controlled-bypass

apply suggestions from review

2022-09-13 10:52:23 +02:00

cwe-829

Ruby: Do not expose AST layer through ruby.qll

2022-09-13 19:59:56 +02:00

cwe-912

update expected output

2022-10-11 11:37:26 +02:00

cwe-918

Add Faraday::Connection.new as sink for SSRF query

2022-10-20 20:32:08 +00:00

cwe-1333-exponential-redos

add further normalization of char classses

2022-06-23 14:36:25 +02:00

cwe-1333-polynomial-redos

add case-in as a sink for polynomial-redos

2022-10-13 12:36:07 +02:00

cwe-1333-regexp-injection

apply suggestions from review

2022-09-13 10:52:23 +02:00

decompression-api

update test expectation

2022-06-20 17:27:33 +00:00