Add PR_10_ruby for ruby

PR_10_ruby/codeql_ruby/cwe-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.expected

@@ -0,0 +1,30 @@
+| hosttest.rb:1:18:1:41 | (www\|beta).example.com\\/ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | hosttest.rb:1:17:1:42 | /(www\|beta).example.com\\// | here |
+| hosttest.rb:2:33:2:55 | (www\|beta).example.com/ | This regular expression has an unescaped '.' before 'example.com/', so it might match more hosts than expected. | hosttest.rb:2:32:2:56 | "(www\|beta).example.com/" | here |
+| hosttest.rb:3:29:3:51 | (www\|beta).example.com/ | This regular expression has an unescaped '.' before 'example.com/', so it might match more hosts than expected. | hosttest.rb:3:28:3:52 | "(www\|beta).example.com/" | here |
+| tst-IncompleteHostnameRegExp.rb:3:3:3:28 | ^http:\\/\\/test.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:3:2:3:29 | /^http:\\/\\/test.example.com/ | here |
+| tst-IncompleteHostnameRegExp.rb:5:3:5:28 | ^http:\\/\\/test.example.net | This regular expression has an unescaped '.' before 'example.net', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:5:2:5:29 | /^http:\\/\\/test.example.net/ | here |
+| tst-IncompleteHostnameRegExp.rb:6:3:6:42 | ^http:\\/\\/test.(example-a\|example-b).com | This regular expression has an unescaped '.' before '(example-a\|example-b).com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:6:2:6:43 | /^http:\\/\\/test.(example-a\|exa.../ | here |
+| tst-IncompleteHostnameRegExp.rb:7:3:7:30 | ^http:\\/\\/(.+).example.com\\/ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:7:2:7:31 | /^http:\\/\\/(.+).example.com\\// | here |
+| tst-IncompleteHostnameRegExp.rb:7:3:7:30 | ^http:\\/\\/(.+).example.com\\/ | This regular expression has an unrestricted wildcard '.+' which may cause 'example.com' to be matched anywhere in the URL, outside the hostname. | tst-IncompleteHostnameRegExp.rb:7:2:7:31 | /^http:\\/\\/(.+).example.com\\// | here |
+| tst-IncompleteHostnameRegExp.rb:9:3:9:39 | ^http:\\/\\/(?:.+)\\.test\\.example.com\\/ | This regular expression has an unrestricted wildcard '.+' which may cause 'example.com' to be matched anywhere in the URL, outside the hostname. | tst-IncompleteHostnameRegExp.rb:9:2:9:40 | /^http:\\/\\/(?:.+)\\.test\\.examp.../ | here |
+| tst-IncompleteHostnameRegExp.rb:10:3:10:36 | ^http:\\/\\/test.example.com\\/(?:.*) | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:10:2:10:37 | /^http:\\/\\/test.example.com\\/(.../ | here |
+| tst-IncompleteHostnameRegExp.rb:11:14:11:37 | ^http://test.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:11:13:11:38 | "^http://test.example.com" | here |
+| tst-IncompleteHostnameRegExp.rb:12:15:12:38 | ^http://test.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:12:14:12:39 | "^http://test.example.com" | here |
+| tst-IncompleteHostnameRegExp.rb:15:23:15:46 | ^http://test.example.com | This string, which is used as a regular expression $@, has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:15:13:15:50 | call to id | here |
+| tst-IncompleteHostnameRegExp.rb:17:14:17:30 | test.example.com$ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:17:13:17:31 | `test.example.com$` | here |
+| tst-IncompleteHostnameRegExp.rb:19:14:19:30 | ^test.example.com | This string, which is used as a regular expression $@, has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:20:13:20:26 | "#{...}$" | here |
+| tst-IncompleteHostnameRegExp.rb:20:14:20:31 | ^test.example.com$ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:20:13:20:26 | "#{...}$" | here |
+| tst-IncompleteHostnameRegExp.rb:22:24:22:40 | test.example.com$ | This string, which is used as a regular expression $@, has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:23:13:23:29 | ...[...] | here |
+| tst-IncompleteHostnameRegExp.rb:28:24:28:40 | test.example.com$ | This string, which is used as a regular expression $@, has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:63:20:63:36 | ...[...] | here |
+| tst-IncompleteHostnameRegExp.rb:37:3:37:53 | ^(https?:)?\\/\\/((service\|www).)?example.com(?=$\|\\/) | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:37:2:37:54 | /^(https?:)?\\/\\/((service\|www).../ | here |
+| tst-IncompleteHostnameRegExp.rb:38:3:38:43 | ^(http\|https):\\/\\/www.example.com\\/p\\/f\\/ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:38:2:38:44 | /^(http\|https):\\/\\/www.example.../ | here |
+| tst-IncompleteHostnameRegExp.rb:39:5:39:30 | http:\\/\\/sub.example.com\\/ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:39:2:39:33 | /^(http:\\/\\/sub.example.com\\/)/ | here |
+| tst-IncompleteHostnameRegExp.rb:40:3:40:29 | ^https?:\\/\\/api.example.com | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:40:2:40:30 | /^https?:\\/\\/api.example.com/ | here |
+| tst-IncompleteHostnameRegExp.rb:41:42:41:68 | ^https?://.+\\.example\\.com/ | This string, which is used as a regular expression $@, has an unrestricted wildcard '.+' which may cause 'example\\.com/' to be matched anywhere in the URL, outside the hostname. | tst-IncompleteHostnameRegExp.rb:41:13:41:71 | ... + ... | here |
+| tst-IncompleteHostnameRegExp.rb:43:3:43:32 | ^https:\\/\\/[a-z]*.example.com$ | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:43:2:43:33 | /^https:\\/\\/[a-z]*.example.com$/ | here |
+| tst-IncompleteHostnameRegExp.rb:44:40:44:53 | .+.example.net | This regular expression has an unescaped '.' before 'example.net', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:44:17:44:109 | "^protos?://(localhost\|.+.exam..." | here |
+| tst-IncompleteHostnameRegExp.rb:44:55:44:70 | .+.example-a.com | This regular expression has an unescaped '.' before 'example-a.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:44:17:44:109 | "^protos?://(localhost\|.+.exam..." | here |
+| tst-IncompleteHostnameRegExp.rb:44:72:44:87 | .+.example-b.com | This regular expression has an unescaped '.' before 'example-b.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:44:17:44:109 | "^protos?://(localhost\|.+.exam..." | here |
+| tst-IncompleteHostnameRegExp.rb:48:42:48:67 | ^https?://.+.example\\.com/ | This string, which is used as a regular expression $@, has an unescaped '.' before 'example\\.com/', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:48:13:48:69 | ... + ... | here |
+| tst-IncompleteHostnameRegExp.rb:48:42:48:67 | ^https?://.+.example\\.com/ | This string, which is used as a regular expression $@, has an unrestricted wildcard '.+' which may cause 'example\\.com/' to be matched anywhere in the URL, outside the hostname. | tst-IncompleteHostnameRegExp.rb:48:13:48:69 | ... + ... | here |
+| tst-IncompleteHostnameRegExp.rb:59:5:59:20 | foo.example\\.com | This regular expression has an unescaped '.' before 'example\\.com', so it might match more hosts than expected. | tst-IncompleteHostnameRegExp.rb:59:2:59:32 | /^(foo.example\\.com\|whatever)$/ | here |

PR_10_ruby/codeql_ruby/cwe-020/IncompleteHostnameRegExp/IncompleteHostnameRegExp.qlref

@@ -0,0 +1 @@
+queries/security/cwe-020/IncompleteHostnameRegExp.ql

PR_10_ruby/codeql_ruby/cwe-020/IncompleteHostnameRegExp/hosttest.rb

@@ -0,0 +1,22 @@
+UNSAFE_REGEX1 = /(www|beta).example.com\//
+UNSAFE_REGEX2 = Regexp.compile("(www|beta).example.com/")
+UNSAFE_REGEX3 = Regexp.new("(www|beta).example.com/")
+SAFE_REGEX = /(www|beta)\.example\.com\//
+
+def unsafe
+    target = params[:target]
+    if UNSAFE_REGEX1.match(target)
+        redirect_to target
+    end
+end
+
+def safe
+    target = params[:target]
+    if SAFE_REGEX.match(target)
+        redirect_to target
+    end
+end
+
+# FP reported in https://github.com/github/codeql/issues/3712
+# This does not define a regex (but could be used by other code to do so)
+escaped = Regexp::escape("https://www.humblebundle.com/home/library")

PR_10_ruby/codeql_ruby/cwe-020/IncompleteHostnameRegExp/tst-IncompleteHostnameRegExp.rb

@@ -0,0 +1,155 @@
+def foo
+# {fact rule=cryptographic-key-generator@v1.0 defects=0}
+	/^http:\/\/example.com/; # OK
+# {/fact}
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^http:\/\/test.example.com/; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=0}
+	/^http:\/\/test\.example.com/; # OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^http:\/\/test.example.net/; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^http:\/\/test.(example-a|example-b).com/; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^http:\/\/(.+).example.com\//; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=0}
+	/^http:\/\/(\.+)\.example.com/; # OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^http:\/\/(?:.+)\.test\.example.com\//; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=0}
+	/^http:\/\/test.example.com\/(?:.*)/; # OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new("^http://test.example.com"); # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	if (s.match("^http://test.example.com")); end # NOT OK
+# {/fact}
+
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new(id(id(id("^http://test.example.com")))); # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new(`test.example.com$`); # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	hostname = '^test.example.com'; # NOT OK
+# {/fact}
+
+	Regexp.new("#{hostname}$");
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	domain = { hostname: 'test.example.com$' }; # NOT OK
+# {/fact}
+
+	Regexp.new(domain[:hostname]);
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	convert1({ hostname: 'test.example.com$' }); # NOT OK
+
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	domains = [ { hostname: 'test.example.com$' } ];  # NOT OK - but not flagged due to limitations of TypeTracking.
+# {/fact}
+
+
+	domains.map{ |d| convert2(d) };
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^(.+\.(?:example-a|example-b)\.com)\//; # NOT OK
+
+# {/fact}
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^(https?:)?\/\/((service|www).)?example.com(?=$|\/)/; # NOT OK
+
+# {/fact}
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^(http|https):\/\/www.example.com\/p\/f\//; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^(http:\/\/sub.example.com\/)/i; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^https?:\/\/api.example.com/; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new('^http://localhost:8000|' + "^https?://.+\\.example\\.com/"); # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new("^http[s]?:\/\/?sub1\\.sub2\\.example\\.com\/f\/(.+)"); # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	/^https:\/\/[a-z]*.example.com$/; # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.compile('^protos?://(localhost|.+.example.net|.+.example-a.com|.+.example-b.com|.+.example.internal)'); # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=0}
+	/^(example.dev|example.com)/; # OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new('^http://localhost:8000|' + "^https?://.+.example\\.com/"); # NOT OK
+# {/fact}
+
+	primary = 'example.com$';
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new('test.' + primary); # NOT OK, but not detected
+
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new('test.' + 'example.com$'); # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=1}
+	Regexp.new('^http://test\.example.com'); # NOT OK
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=0}
+	/^http:\/\/(..|...)\.example\.com\/index\.html/; # OK, wildcards are intentional
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=0}
+	/^http:\/\/.\.example\.com\/index\.html/; # OK, the wildcard is intentional
+# {/fact}
+
+# {fact rule=cryptographic-key-generator@v1.0 defects=0}
+	/^(foo.example\.com|whatever)$/; # kinda OK - one disjunction doesn't even look like a hostname
+# {/fact}
+end
+
+def id(e); return e; end
+def convert1(domain)
+	return Regexp.new(domain[:hostname]);
+end
+def convert2(domain)
+	return Regexp.new(domain[:hostname]);
+end

PR_10_ruby/codeql_ruby/cwe-020/IncompleteUrlSubstringSanitization/IncompleteUrlSubstringSanitization.expected

@@ -0,0 +1,25 @@
+| tst-IncompleteUrlSubstringSanitization.rb:4:5:4:32 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:4:13:4:24 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:5:5:5:32 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:5:13:5:24 | "secure.net" | secure.net |
+| tst-IncompleteUrlSubstringSanitization.rb:6:5:6:33 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:6:13:6:25 | ".secure.com" | .secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:10:5:10:33 | ... === ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:10:13:10:24 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:11:5:11:31 | ... === ... | '$@' may be followed by an arbitrary host name. | tst-IncompleteUrlSubstringSanitization.rb:11:13:11:24 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:12:5:12:30 | ... >= ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:12:13:12:24 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:14:5:14:39 | call to start_with? | '$@' may be followed by an arbitrary host name. | tst-IncompleteUrlSubstringSanitization.rb:14:19:14:38 | "https://secure.com" | https://secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:15:5:15:29 | call to end_with? | '$@' may be preceded by an arbitrary host name. | tst-IncompleteUrlSubstringSanitization.rb:15:17:15:28 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:20:5:20:28 | call to include? | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:20:16:20:27 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:32:5:32:40 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:32:13:32:32 | "https://secure.com" | https://secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:33:5:33:44 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:33:13:33:36 | "https://secure.com:443" | https://secure.com:443 |
+| tst-IncompleteUrlSubstringSanitization.rb:34:5:34:41 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:34:13:34:33 | "https://secure.com/" | https://secure.com/ |
+| tst-IncompleteUrlSubstringSanitization.rb:52:5:52:46 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:52:13:52:38 | "https://example.internal" | https://example.internal |
+| tst-IncompleteUrlSubstringSanitization.rb:55:5:55:45 | call to start_with? | '$@' may be followed by an arbitrary host name. | tst-IncompleteUrlSubstringSanitization.rb:55:19:55:44 | "https://example.internal" | https://example.internal |
+| tst-IncompleteUrlSubstringSanitization.rb:56:5:56:48 | ... != ... | '$@' may be followed by an arbitrary host name. | tst-IncompleteUrlSubstringSanitization.rb:56:13:56:42 | "https://example.internal.org" | https://example.internal.org |
+| tst-IncompleteUrlSubstringSanitization.rb:57:5:57:49 | ... === ... | '$@' may be followed by an arbitrary host name. | tst-IncompleteUrlSubstringSanitization.rb:57:13:57:42 | "https://example.internal.org" | https://example.internal.org |
+| tst-IncompleteUrlSubstringSanitization.rb:58:5:58:31 | call to end_with? | '$@' may be preceded by an arbitrary host name. | tst-IncompleteUrlSubstringSanitization.rb:58:17:58:30 | "internal.com" | internal.com |
+| tst-IncompleteUrlSubstringSanitization.rb:61:2:61:29 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:61:10:61:21 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:62:2:62:30 | ... === ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:62:10:62:21 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:63:4:63:31 | ... != ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:63:12:63:23 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:64:3:64:26 | call to include? | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:64:14:64:25 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:66:6:66:29 | call to include? | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:66:17:66:28 | "secure.com" | secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:73:5:73:46 | ... >= ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:73:13:73:40 | "https://secure.com/foo/bar" | https://secure.com/foo/bar |
+| tst-IncompleteUrlSubstringSanitization.rb:74:5:74:38 | ... >= ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:74:13:74:32 | "https://secure.com" | https://secure.com |
+| tst-IncompleteUrlSubstringSanitization.rb:75:5:75:50 | ... >= ... | '$@' can be anywhere in the URL, and arbitrary hosts may come before or after it. | tst-IncompleteUrlSubstringSanitization.rb:75:13:75:44 | "https://secure.com/foo/bar-baz" | https://secure.com/foo/bar-baz |

PR_10_ruby/codeql_ruby/cwe-020/IncompleteUrlSubstringSanitization/IncompleteUrlSubstringSanitization.qlref

@@ -0,0 +1 @@
+queries/security/cwe-020/IncompleteUrlSubstringSanitization.ql