Skip to content

Ruby: rack - model redirect responses#13289

Merged
alexrford merged 24 commits into
github:mainfrom
alexrford:rb/rack-redirect
Jun 22, 2023
Merged

Ruby: rack - model redirect responses#13289
alexrford merged 24 commits into
github:mainfrom
alexrford:rb/rack-redirect

Conversation

@alexrford
Copy link
Copy Markdown
Contributor

@alexrford alexrford commented May 25, 2023

Models redirect responses from rack applications. The direct motivation behind this PR is to help detect open redirects.

The bulk of this PR is restructuring to split Rack modelling into component parts, as it's a fairly complex library. The mimeTypeMatches predicate data is taken from https://www.rubydoc.info/github/rack/rack/Rack/Mime#MIME_TYPES-constant and comprises most of the diff.

@alexrford alexrford added the Ruby label May 25, 2023
Comment thread ruby/ql/lib/codeql/ruby/frameworks/rack/internal/Response.qll Fixed
Comment thread ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll Fixed
@alexrford alexrford marked this pull request as ready for review June 7, 2023 15:33
@alexrford alexrford requested a review from a team as a code owner June 7, 2023 15:33
@calumgrant calumgrant requested a review from asgerf June 12, 2023 08:38
Comment thread ruby/ql/lib/codeql/ruby/frameworks/rack/internal/App.qll Outdated
Comment thread ruby/ql/lib/codeql/ruby/frameworks/rack/internal/Response.qll Outdated
Comment thread ruby/ql/lib/codeql/ruby/frameworks/rack/internal/Response.qll Outdated
Comment thread ruby/ql/lib/codeql/ruby/frameworks/rack/internal/App.qll
Comment thread ruby/ql/lib/codeql/ruby/frameworks/rack/internal/Mime.qll Outdated
Co-authored-by: Asger F <asgerf@github.com>
@alexrford alexrford requested a review from asgerf June 13, 2023 11:48
@alexrford alexrford changed the title Ruby: rack - model redirect responses and Rack::Mime::mime_type Ruby: rack - model redirect responses Jun 20, 2023
@alexrford alexrford merged commit 24e8316 into github:main Jun 22, 2023
@alexrford alexrford deleted the rb/rack-redirect branch June 22, 2023 12:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants