hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update and fix tests

Browse Source
This commit is contained in:
Joe Farebrother
2025-09-23 15:41:09 +01:00
parent d28e8004fd
commit 2cffb21604
8 changed files with 30 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/src/Security/CWE-1004/NonHttpOnlyCookie.ql
View File

@@ -15,5 +15,7 @@ import semmle.python.dataflow.new.DataFlow
import semmle.python.Concepts
from Http::Server::CookieWrite cookie
where cookie.hasHttpOnlyFlag(false)
where
cookie.hasHttpOnlyFlag(false) and
cookie.isSensitive()
select cookie, "Cookie is added without the HttpOnly attribute properly set."

6
python/ql/src/Security/CWE-1275/SameSiteNoneCookie.ql
View File

@@ -3,7 +3,7 @@
* @description Cookies with `SameSite` set to `None` can allow for Cross-Site Request Forgery (CSRF) attacks.
* @kind problem
* @problem.severity warning
* @security-severity 3.5
* @security-severity 4.0
* @precision high
* @id py/samesite-none-cookie
* @tags security
@@ -15,5 +15,7 @@ import semmle.python.dataflow.new.DataFlow
import semmle.python.Concepts
from Http::Server::CookieWrite cookie
where cookie.hasSameSiteAttribute(any(Http::Server::CookieWrite::SameSiteNone v))
where
cookie.hasSameSiteAttribute(any(Http::Server::CookieWrite::SameSiteNone v)) and
cookie.isSensitive()
select cookie, "Cookie is added with the SameSite attribute set to None."

5
python/ql/src/Security/CWE-614/InsecureCookie.ql
View File

@@ -16,6 +16,7 @@ import semmle.python.dataflow.new.DataFlow
import semmle.python.Concepts
from Http::Server::CookieWrite cookie
where cookie.hasSecureFlag(false) //and
//cookie.isSensitive()
where
cookie.hasSecureFlag(false) and
cookie.isSensitive()
select cookie, "Cookie is added without the Secure attribute properly set."