Skip to content

Conversation

asgerf
Copy link
Contributor

@asgerf asgerf commented Mar 31, 2023

Previously the NetHttpRequest charpred expected to find an access to the response body. As a result, the class would not get instantiated in cases where we can't find an access to the response body.

This logic has now been moved into the corresponding member predicate.

Also refactored the test to not make the same assumption.

Evaluation shows neutral perf and 106 new SSRF sinks.

Commit-by-commit review recommended mainly due to the test refactoring.

@asgerf asgerf added Ruby no-change-note-required This PR does not need a change note labels Mar 31, 2023
@asgerf asgerf marked this pull request as ready for review April 3, 2023 07:47
@asgerf asgerf requested a review from a team as a code owner April 3, 2023 07:47
@calumgrant calumgrant requested a review from alexrford April 3, 2023 08:55
Copy link
Contributor

@alexrford alexrford left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@asgerf asgerf merged commit 7c9100c into github:main Apr 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
no-change-note-required This PR does not need a change note Ruby
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants