Rasmus Wriedt Larsen
c4fbfb0d07
Merge branch 'main' into call-graph-code
2023-02-15 20:15:04 +01:00
Rasmus Wriedt Larsen
ee5382d8a6
Merge pull request #12193 from RasmusWL/import-resolution-fixup
...
Python: Fix `from <pkg> import *` import resolution
2023-02-15 20:13:24 +01:00
Alex Ford
1556b1a728
Merge branch 'main' into js-use-shared-cryptography
2023-02-15 17:13:53 +00:00
Alex Ford
43af306d60
dynamic: more detailed qldoc for CryptographicOperation#getBlockMode()
2023-02-15 16:55:18 +00:00
Alex Ford
d4d0b91085
dynamic: switch CryptographicOperation::Range#getBlockMode() back to being an abstract predicate
2023-02-15 16:23:46 +00:00
Alex Ford
c7aaad9ed0
JS: avoid adding a deprecated CryptographicOperation#getInput to py/ruby
2023-02-15 16:23:46 +00:00
Rasmus Wriedt Larsen
c72dbc49fc
Merge pull request #12165 from RasmusWL/crypto-updates
...
Python/Ruby/JS Crypto: Add a few algorithms + block modes
2023-02-15 14:35:40 +01:00
Rasmus Wriedt Larsen
7e16fa9cbe
Python: Add change-note
2023-02-15 14:25:33 +01:00
Rasmus Wriedt Larsen
220f227707
Python: Add wrapper for isPreferredModuleForName
...
We talked about how it's annoying that we in 4 places have the same fix
`isPreferredModuleForName(<module>.getFile(), <name> + ["", ".__init__"])`
, and that it would be nice to have a simple wrapper predicate that
ensures we never forget to do the `+ ["", ".__init__"]` dance...
I had trouble coming up with a name for this (ironically), but
I think `getModuleFromName` is good enough.
2023-02-15 14:23:39 +01:00
Rasmus Wriedt Larsen
66c3529465
Python: Fix import * from __init__.py files
2023-02-15 14:10:37 +01:00
erik-krogh
759854991a
fix various nits based on feedback
2023-02-15 11:10:43 +01:00
Rasmus Wriedt Larsen
9e2eb56032
Python: Remove support for late *args arguments
...
I found this to cause bad performance, so the implementation of this has
to be thought out more carefully.
2023-02-15 09:42:11 +01:00
Taus
1b30043422
Python: Move change note to correct directory
2023-02-14 13:48:55 +00:00
Taus
4f7c598ffc
Python: Add change note
2023-02-14 13:22:48 +00:00
Taus
39516862c1
Merge remote-tracking branch 'origin/main' into tausbn/python-clean-up-version-handling
2023-02-14 13:07:40 +00:00
Rasmus Wriedt Larsen
1c7fe97427
Python: Add modeling of hmac
2023-02-13 15:39:43 +01:00
Anders Schack-Mulligen
e877b161d8
Merge pull request #12124 from hvitved/dataflow/stage1-dispatch
...
Data flow: Call context virtual dispatch pruning in stage 1
2023-02-13 13:13:43 +01:00
Rasmus Wriedt Larsen
b2e79e2948
Python/Ruby/JS Crypto: Add a few algorithms + block modes
...
I have tried to add a few links to support the claim that these
algorithms are strong/safe. It wasn't always super easy, so in some
cases I have ended up just linking to the documentation of the
`cryptography` Python package.
Co-authored-by: REDMOND\brodes <brodes@microsoft.com >
2023-02-13 10:40:47 +01:00
Tom Hvitved
f7a5a33474
Address review comment
2023-02-13 09:01:15 +01:00
Rasmus Wriedt Larsen
5c23b47ef4
Python: Fix typo in QLDoc
...
Co-authored-by: Taus <tausbn@github.com >
2023-02-08 16:27:06 +01:00
Rasmus Wriedt Larsen
8bb1d8631a
Python: Add call-graph hotfix for sympy
2023-02-08 16:19:29 +01:00
Rasmus Wriedt Larsen
23144f584a
Merge branch 'main' into call-graph-code
2023-02-08 16:17:34 +01:00
Taus
49a3dd6131
Python: Clean up version handling
...
Depends on an internal PR.
2023-02-07 16:21:15 +00:00
Tom Hvitved
8e8897b08b
Data flow: Sync files
2023-02-07 15:15:04 +01:00
Erik Krogh Kristensen
9360ae9638
Merge pull request #12076 from erik-krogh/poly-sink-track
...
PY: add tracking of strings to compile-sites for poly-redos
2023-02-06 14:21:04 +01:00
Mathias Vorreiter Pedersen
00fe448e3a
Merge pull request #12072 from aschackmull/dataflow/stage3-perf
...
Dataflow: Fix join in `fwdFlowRead` (take 2)
2023-02-06 10:43:11 +00:00
Alex Ford
7768026e70
Merge branch 'main' into js-use-shared-cryptography
2023-02-03 15:18:30 +00:00
Alex Ford
6c35feaa98
ConceptsShared: add a default implementation of BlockMode CryptographicOperation#getBlockMode() for compatibility with external code
2023-02-03 14:39:32 +00:00
Alex Ford
b968b59afc
CryptoAlgorithms: make CryptographicAlgorithm#matchesName hold only if that algorithm is the most specific match
2023-02-03 14:15:32 +00:00
erik-krogh
8e05fdb369
make more imports private
2023-02-03 15:00:31 +01:00
erik-krogh
cf094c2f4f
adjust which folders are seen as exported to remove an FP
2023-02-03 14:47:55 +01:00
erik-krogh
ef44cb86c2
remove FPs related to parameters that are meant to be commands
2023-02-03 14:47:55 +01:00
erik-krogh
e9ebba3350
assume shell=False for subprocess calls, fixes FPs in e.g. youtube-dl
2023-02-03 14:47:55 +01:00
erik-krogh
d228cf0e7b
use more API-nodes to model subprocess.run (and friends)
2023-02-03 14:47:55 +01:00
erik-krogh
bce83bfc4e
add failing test for indirectly setting the shell=true flag for subprocess.run
2023-02-03 14:47:55 +01:00
erik-krogh
0a2c7d062c
add Fabric test, and add tracking of the shell flag in Fabric
2023-02-03 14:47:55 +01:00
erik-krogh
6bbc4f4a48
add more tests
2023-02-03 14:47:55 +01:00
erik-krogh
33c506d7fe
add minimal test for Array join as a sink, and learn that the order is flipped compared to JS. Thanks Copilot!
2023-02-03 14:47:55 +01:00
erik-krogh
5bddfc0d79
add test for f-strings as sink
2023-02-03 14:47:55 +01:00
erik-krogh
47a06d2824
add library inputs as a source, and get minimal test to work
2023-02-03 14:47:55 +01:00
erik-krogh
7fcc548665
add py/shell-command-constructed-from-input, but without a source.
...
It's a very direct port from Ruby, with only minor adjustments to fit the Python APIs
2023-02-03 14:47:55 +01:00
erik-krogh
187cfd7be7
add isShellInterpreted to the SystemCommandExecution concept
2023-02-03 14:47:54 +01:00
github-actions[bot]
faf21f3edb
Post-release preparation for codeql-cli-2.12.2
2023-02-02 23:01:04 +00:00
erik-krogh
6e712b293a
add tracking of strings to compile-sites for poly-redos, in the style of Ruby
2023-02-02 22:56:20 +01:00
Alex Ford
1435ef1862
CryptoAlgorithms: make CryptographicAlgorithm#matchesName split on underscores
2023-02-02 20:30:30 +00:00
Alex Ford
e5dfbe2c8d
ConceptsShared: Add BlockMode#matchesString(string) predicate
2023-02-02 20:27:52 +00:00
Alex Ford
61095b3c58
ConceptsShared: Add deprecated DataFlow::Node CryptographicOperation#getInput() predicate
2023-02-02 20:27:05 +00:00
Anders Schack-Mulligen
67d4ed53b9
Dataflow: Sync.
2023-02-02 16:33:00 +01:00
github-actions[bot]
a4fa984792
Release preparation for version 2.12.2
2023-02-02 14:34:55 +00:00
Rasmus Wriedt Larsen
db114bb104
Merge branch 'main' into call-graph-code
2023-02-02 11:56:55 +01:00
