hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #13781 from maikypedia/maikypedia/python-unsafe-deserialization

Browse Source 
Python: Add unsafe deserialization sinks (CWE-502)
This commit is contained in:
Rasmus Wriedt Larsen
2023-10-10 13:30:38 +02:00
committed by GitHub
parent 542d5a2451 f3acc89900
commit 2d947a4f53
16 changed files with 153 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/lib/change-notes/2023-07-20-add-unsafe-deserialization-sinks.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Improved modeling of decoding through pickle related functions (which can lead to code execution), resulting in additional sinks for the _Deserializing untrusted input_ query (`py/unsafe-deserialization`). Added support for `pandas.read_pickle`, `numpy.load` and `joblib.load`.