►
From YouTube: CodeQL for Ruby - GitHub Checkout
Description
Ruby is the 10th* most popular language within the open source community. To help more open source maintainers and organizations find potential vulnerabilities in their code, we’ve added Ruby support (beta) to the CodeQL engine that powers GitHub code scanning.
Blog: https://github.blog/changelog/2021-10-27-codeql-code-scanning-adds-beta-support-for-ruby/
Docs: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning
Public forum: https://github.com/github/codeql/discussions
https://codeql.github.com/
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
Hey
folks,
anisha
here
and
I've
got
to
get
a
feature
for
you
to
check
out.
So
ruby
is
a
pretty
well-known
language
in
and
a
popular
language
actually
in
the
open
source
community,
as
well
as
as
at
github,
and
we've
got
a
pretty
cool
update
on
support
for
ruby
in
code
scanning
so
pierre.
Why
don't
you
tell
us
more
about
it
and
take
it
away
from
here.
B
Yeah
thanks
anisha,
thanks
for
having
me
hi
everyone,
I'm
pierre,
I'm
the
product
manager
for
codeql
the
analysis
engine
that
powers
github
code
scanning
github
code
scanning
helps
open
source,
maintainers
and
organizations
find
potential
vulnerabilities
in
their
code
before
they
reach
any
deployments.
Today
I
want
to
dive
deeper
into
ruby
support
for
codekill
an
exciting
improvement.
We
recently
announced
at
github
universe
first
off.
B
What
is
codeql
codeql
is
a
query
language
for
source
code,
think
sql,
but
for
programs,
github
code
scanning
uses
codeqr
and
runs
its
queries
to
identify
security
issues
in
your
code,
along
with
the
flow
of
data
to
the
vulnerable
location.
That
way,
we
can
identify
real
vulnerabilities,
alert
you
to
them
and
provide
you
with
a
necessary
context
to
judge
the
impact
and
quickly
implement
fixes.
B
Today,
codecl
already
supports
a
variety
of
languages,
for
example,
c
and
c,
plus,
plus
c
sharp
go
and
java
and
dynamic
languages
such
as
javascript,
typescript
or
python,
and
now
we've
added
ruby
to
that
list.
As
you
said,
in
asia,
ruby
is
an
important
language
to
github.
We
maintain
one
of
the
largest
ruby
code
bases
in
the
world,
so
we've
been
putting
this
beta
through
its
paces
internally
and
with
a
few
customers
over
the
past
few
months
and
now
it's
time
for
everyone
else
to
try
it
out.
B
So
let
me
show
you
how
to
set
up
code
scanning
for
ruby.
So
here
I
have
a
repository
that
has
ruby
code
checked
in
let's
enable
code
scanning
and
see
if
there
are
any
security
issues
with
my
code
so
I'll
head
on
over
to
the
security
tab,
which
is
where
you
can
set
up
most
of
the
github
code
security
tools.
I've
also
like
set
up
code
scanning
and
to
use
the
first
suggestion,
which
is
the
codeql
analysis.
B
This
will
create
the
default
workflow,
but
before
we
commit
this
workflow,
let's
check
if
ruby
was
correctly
included
in
the
list
of
languages,
that
coql
is
supposed
to
scan
and
I
don't
need
to
change
anything
else
and
we
can
track
the
analysis
progress
in
the
actions
tab.
We
can
see
that
the
first
code,
qr
analysis
in
our
repository,
is
in
progress.
B
Now
we
see
it's
completed,
let's
head
over
to
the
security
tab,
and
I
can
see
that
I
have
one
new
code
scanning
alert.
Let's
take
a
look
and
oh,
we
have
detected
a
critical
issue,
apparently
with
the
way
we're
deserializing
data.
Let's
dig
deeper
on
that,
I
can
see.
Cochlear
has
highlighted
the
most
important
line
for
me.
I
already
know
I'm
not
using
the
safe
load
mechanism
for
parsing
yamo,
but
how
did
codeql
determine
this?
Was
user
controlled
data?
B
Let's
take
a
look
at
the
path
the
data
takes
through
the
code
and
we
have
two
steps
and
there
it
is.
The
input
is
taken
straight
from
the
request
parameters
and
piped
into
yamo
load.
That's
not
good
down
here.
The
query.
Help
also
provides
useful
information
on
the
nature
of
the
issue
and
even
a
fix
just
use
safe
load.
There's
a
lot
more
information
to
dig
into
for
each
of
the
alerts
and
code
scanning
provides
many
great
tools
to
manage
your
alerts.
B
A
B
Ruby
support
will
mature
substantially
over
time
we're
launching
right
out
of
the
gate,
with
queries
for
the
most
common
security
issues,
including
sql
injection
redos,
which
is
regular
expression,
denial
of
service
command
line
code,
injection
xml
entity
expansion
and
several
types
of
stored
and
reflected
cross-site
scripting
attack
vectors.
So
quite
a
lot,
and
we
cover
more
than
a
dozen
cwes
out
of
the
box
and
it
works.
We
have
found
issues
in
code.
Github
depends
on
found,
cves
and
hugely
popular
open
source
projects
such
as
fluentd
and
even
bugs
in
ruby
itself.
A
B
The
github
documentation
is
a
great
place
to
go
for
information
on
how
to
set
up
any
of
github's
code
security
tools.
We
also
have
codeql.github.com,
which
hosts
a
variety
of
guides
on
everything,
from
running
your
analyses
locally
to
even
writing
your
own
queries.
If
you
encounter
issues
with
an
alert,
you
can
use
the
submit
feedback
button
in
the
alert
and
for
any
other
questions.
We
hope
to
see
you
in
the
discussions
tab
on
the
public
code,
qr
repository
on
github,
and
we
do
a
lot
of
feedback.
B
For
example,
we've
received
a
lot
of
feedback
since
we've
announced
the
support
at
universe,
about
queries
that
detect
hard-coded
credentials
in
code
and
will
soon
be
tweaking
the
severity
of
those
queries
to
reduce
potential
alert
noise,
because
we
want
to
bubble
up
true
positive
alerts,
front
and
center,
so
you
can
fix
them
and
secure
your
code
better
than
ever
before,
and
your
feedback
helps
us
accomplish.
That
mission.