hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 03:06:31 +01:00
Code Issues Packages Projects Releases Wiki Activity
82,643 Commits 1,672 Branches 157 Tags
alexet/avoid-path-node-java
Commit Graph

620 Commits

Author SHA1 Message Date
yoff
140dc1a61e merge in main 2022-06-23 09:05:32 +00:00
Anders Schack-Mulligen
df6d68b215 Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class 
Dataflow: Deprecate BarrierGuard class
 2022-06-22 10:44:08 +02:00
Asger F
181a53bd03 Python: Rename getAnImmediateUse -> asSource 2022-06-21 12:44:06 +02:00
Asger F
60fde3c031 Python: Rename getARhs -> asSink 2022-06-21 12:44:06 +02:00
Anders Schack-Mulligen
a7c268f804 Python: adjust test. 2022-06-20 15:46:38 +02:00
Rasmus Wriedt Larsen
ae44a941f9 Merge pull request #9421 from RasmusWL/inline-brackets 
Inline Expectation Tests: Allow `tag[foo bar]`
 2022-06-20 10:01:19 +02:00
yoff
9dbb451f41 Merge pull request #9463 from RasmusWL/req-wo-cert-validation 
Python: Rewrite `py/request-without-cert-validation`
 2022-06-15 13:00:57 +02:00
Rasmus Wriedt Larsen
cfd640b1b2 Python: Apply suggestions from code review 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2022-06-14 16:47:24 +02:00
Alex Ford
8d195e3188 Merge pull request #9157 from alexrford/crypto-op-block-mode 
Ruby/Python: Add a `BlockMode` concept for `CryptographicOperations`
 2022-06-13 21:32:36 +02:00
Rasmus Wriedt Larsen
5b2d799fde Python: Model certificate disabling in urllib3 2022-06-08 17:41:45 +02:00
Rasmus Wriedt Larsen
0d02ca07d7 Python: Add certificate disable test of urllib/urllib2 2022-06-08 17:41:45 +02:00
Rasmus Wriedt Larsen
049e87201c Python: Model certificate disabling in httpx 2022-06-08 17:41:45 +02:00
Rasmus Wriedt Larsen
1a2a4232a8 Python: Refactor httpx tests 
and improve QLDocs a bit
 2022-06-08 17:41:45 +02:00
Rasmus Wriedt Larsen
f72a1d98bb Python: Model certificate disabling in aiohttp.client 2022-06-08 17:41:45 +02:00
Rasmus Wriedt Larsen
f37d1775f1 Python: Improve requests tests 2022-06-08 17:41:11 +02:00
Rasmus Wriedt Larsen
c1e6996e99 Inline Expectation Tests: Allow tag[foo bar] 
This is partly motivated by the MaD tests which looks much better now in
my opinion.

I also wanted this for testing argument passing. In Python we're
adopting the same argument positions as Ruby has
[here](4f3751dfea/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowDispatch.qll (L508-L540))

So it would be nice if `arg[keyword foo]=...` was allowed, without
having to transform the `toString()` result of an argument position into
something without a space.
 2022-06-03 11:39:57 +02:00
Rasmus Wriedt Larsen
729cf79be7 Merge pull request #9351 from RasmusWL/django-file-read 
Python: Support `read` on Django file
 2022-06-01 10:45:26 +02:00
Erik Krogh Kristensen
e557d8839b have the Instance token just be an alias for ReturnValue 2022-05-30 12:21:42 +02:00
Rasmus Wriedt Larsen
5924e88a86 Python: Support read on Django file 2022-05-27 11:18:26 +02:00
Erik Krogh Kristensen
204e01fc24 change getNumArgument to only count positional arguments 2022-05-20 12:43:06 +02:00
Erik Krogh Kristensen
d5f0446940 exclude self parameter from the API-graph edge for keywordParameter 2022-05-17 22:34:38 +02:00
Erik Krogh Kristensen
2868eb61ea add test for Parameter[any] and Parameter[any-named] 2022-05-17 12:08:53 +02:00
Erik Krogh Kristensen
f273ccf73b add explicit test of what Parameter[0] matches 2022-05-17 11:17:15 +02:00
Erik Krogh Kristensen
ce21d7e5a8 use test-sink for sinks in the MaD test 2022-05-17 11:13:59 +02:00
Erik Krogh Kristensen
aef592fec8 make a more realistic test for self-parameter 2022-05-17 11:13:35 +02:00
Alex Ford
da135448a2 python: update tests for CryptographicOperation#getBlockMode 2022-05-13 16:32:36 +01:00
Erik Krogh Kristensen
dea5596289 update MaD test to reflect that dotted module names don't work 2022-05-12 14:45:29 +02:00
Erik Krogh Kristensen
31e9876de7 Merge branch 'main' into pyMaD 2022-05-12 14:43:16 +02:00
yoff
6c3e2db7fd Merge branch 'main' into python/simple-csrf 2022-05-10 10:55:28 +02:00
yoff
b6605bc330 Merge pull request #8634 from RasmusWL/promote-xxe 
Python: Promote XXE and XML-bomb queries
 2022-05-09 21:54:55 +02:00
Erik Krogh Kristensen
efe306733e move path-injection MaD to PathInjectionCustomizations.qll 2022-05-05 16:51:39 +02:00
yoff
6169ac6122 Merge pull request #7776 from RasmusWL/django-filefield-uploadto 
Python: Support Django FileField.upload_to
 2022-05-05 14:25:08 +02:00
Rasmus Wriedt Larsen
0a589bed4e Python: Add inline test of MaD sinks 
This enables us to keep the framework modeling tests under `/frameworks`
folder

I had hoped to use `mad-sink[<kind>]` syntax, but that was not allowed
:(

Maybe it oculd be allowed in the future, but for now I'll stick with the
more ugly solution of `mad-sink__<kind>`
 2022-05-05 13:11:43 +02:00
Rasmus Wriedt Larsen
6ae5ef9f3b Revert "move most of asyncpg test into SqlInjection after moving MaD sql-injection sink" 
This reverts commit 4b9c9b0c8d.
 2022-05-05 10:20:41 +02:00
Erik Krogh Kristensen
4b9c9b0c8d move most of asyncpg test into SqlInjection after moving MaD sql-injection sink 2022-05-04 10:59:02 +02:00
Erik Krogh Kristensen
571fc3e73b Revert "deprecate SqlConstruction" 
This reverts commit c0eca0d09a.
 2022-05-04 10:59:02 +02:00
Erik Krogh Kristensen
1062aae21c add test that the foo.bar package syntax works 2022-05-04 10:58:59 +02:00
Erik Krogh Kristensen
8ffc05c84b count both named and positional arguments in the WithArity filter 2022-05-03 21:21:57 +02:00
Rasmus Wriedt Larsen
fb0133d276 Python: Fix Flask request.files modeling 2022-05-02 14:14:58 +02:00
Rasmus Wriedt Larsen
0c62916af5 Python: Highlight problem with Flask request.files modeling 2022-05-02 14:14:53 +02:00
Erik Krogh Kristensen
c0eca0d09a deprecate SqlConstruction 2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
6c67e51ec3 add test for the .Call token 2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
9c3d45a16a last test of taint steps 2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
894252dfa7 third test of taint steps 2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
0f1e070d82 second test of taint steps 2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
649df1dd31 simple taint-flow test 2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
a8790412dd add support for the Argument[any] and Argument[any-named] tokens 2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
b1fa7f86a8 add support for the any argument tokens 2022-05-02 12:58:15 +02:00
Erik Krogh Kristensen
413d182bcf add support for named parameters 2022-05-02 12:56:44 +02:00
Erik Krogh Kristensen
547047ef19 add self parameters to API-graphs, and add support for self parameters in MaD 2022-05-02 12:50:31 +02:00