Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Latest commit

 

History

History
8 lines (6 loc) · 792 Bytes

File metadata and controls

8 lines (6 loc) · 792 Bytes

0.8.10

Minor Analysis Improvements

  • Calls to I18n.translate as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
  • Calls to Arel::Nodes::SqlLiteral.new are now modeled as instances of the SqlConstruction concept, as well as propagating taint from their argument.
  • Additional arguments beyond the first of calls to the ActiveRecord methods select, reselect, order, reorder, joins, group, and pluck are now recognized as sql injection sinks.
  • Calls to several methods of ActiveRecord::Connection, such as ActiveRecord::Connection#exec_query, are now recognized as SQL executions, including those via subclasses.