hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 18:10:39 +01:00
Code Issues Packages Projects Releases Wiki Activity
74,247 Commits 1,671 Branches 157 Tags
codeql-cli-2.20.1
Commit Graph

3912 Commits

Author SHA1 Message Date
Rasmus Wriedt Larsen
0f242475f2 Merge branch 'main' into experimental-cleanup 2023-08-28 11:01:22 +02:00
Rasmus Lerchedahl Petersen
ad49eada48 Python: Do not alter codeql-workspaces.yml 
And remove the qlpack referred to therein.
Instead we rename and duplicate the extesion file
that this qlpack pointed to.
These two extension files are kept in sync by `identical-files.json`.
 2023-08-25 11:46:41 +02:00
Rasmus Lerchedahl Petersen
68cd422788 Python: Fix test expectations 2023-08-25 11:27:53 +02:00
Rasmus Lerchedahl Petersen
d3c24ba110 PythonÆ fix test expectations 2023-08-24 21:21:49 +02:00
Rasmus Lerchedahl Petersen
88fc96e8d7 Python: Add test with prefix 2023-08-24 21:21:49 +02:00
Rasmus Lerchedahl Petersen
7ad1a21c2d Python: make mode characters not be characters 
They are simply considered part of the group start.
 2023-08-24 21:21:49 +02:00
yoff
a834703195 Merge pull request #13779 from geoffw0/pythonparsemode 
Python: Understand multiple parse mode flags specified in a regular expression string
 2023-08-24 21:20:45 +02:00
Geoffrey White
f07f97a94e Python: Accept test changes. I think these reflect the 'parse mode chars should not be considered chars' issue. 2023-08-24 10:52:52 +01:00
Rasmus Wriedt Larsen
f33359bd5c Python: Fix tests 2023-08-23 15:37:55 +02:00
yoff
00c0ebe9e4 Merge pull request #13738 from RasmusWL/path-steps 
Python: Include all assignments in data flow paths
 2023-08-22 11:58:11 +02:00
Rasmus Wriedt Larsen
c8c69aac9b Merge pull request #13561 from amammad/amammad-python-WebAppsConstatntSecretKeys 
Python: Flask & Django Constant Secret Key initialization
 2023-08-21 11:39:19 +02:00
Rasmus Wriedt Larsen
b579ab0694 Python: Accept .expected change 2023-08-18 11:12:55 +02:00
Rasmus Wriedt Larsen
38577e6a5c Python: Remove duplicated SSTI tests 
Besides the Cheetah tests, which were missing from the query tests.
 2023-08-18 10:20:16 +02:00
Rasmus Wriedt Larsen
33f8998c2e Python: Minor fix in test 2023-08-18 10:19:44 +02:00
Rasmus Wriedt Larsen
843f2681bb Python: Apply suggestions from code review 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2023-08-18 10:09:45 +02:00
Rasmus Wriedt Larsen
cf54d3f4ca Python: Move paramiko tests to own folder 2023-08-17 15:45:28 +02:00
Rasmus Wriedt Larsen
4c693b4fc3 Python: Port py/xslt-injection to new data-flow 2023-08-17 15:45:07 +02:00
Rasmus Wriedt Larsen
ef139f2ee9 Python: Delete XsltSinks.ql test 2023-08-17 15:45:07 +02:00
Rasmus Wriedt Larsen
779fe6498c Python: Rename to XsltInjection.ql 2023-08-17 15:45:07 +02:00
Rasmus Wriedt Larsen
0336c76871 Python: Rename template injection tests 2023-08-17 15:45:04 +02:00
Rasmus Wriedt Larsen
91edde72c4 Python: Port py/template-injection to new data-flow 
I kept all the modeling in _one_ file, since that makes it easy to work
with such an external contribution... and I would certainly propose this
file setup for the future 👍
 2023-08-17 15:44:26 +02:00
yoff
7f2f6f14e7 Merge pull request #13729 from yoff/python/model-aws-lambdas 
Python/JavaScript: Shared module for serverless functions
 2023-08-16 15:14:08 +02:00
Rasmus Wriedt Larsen
0443057608 Merge branch 'main' into amammad-python-WebAppsConstatntSecretKeys 2023-08-16 15:06:08 +02:00
Rasmus Wriedt Larsen
c55b0982f7 Merge pull request #13819 from yoff/python/relax-module-resolution 
Python: Relax module resolution
 2023-08-16 12:04:49 +02:00
Rasmus Lerchedahl Petersen
e6943ce98e Python: use standard test format 2023-08-15 15:26:18 +02:00
Erik Krogh Kristensen
6a3b9e10eb Merge pull request #13914 from erik-krogh/escape-unicode 
ReDoS: escape unicode chars in the output for the ReDoS queries
 2023-08-15 11:21:21 +02:00
Rasmus Wriedt Larsen
d12743d7c3 Merge pull request #13941 from yoff/python/test-nice-location 
Python: fix nice locations for import aliases
 2023-08-14 21:37:23 +02:00
Rasmus Wriedt Larsen
1c3cc1fa29 Python: Remove flow through stdlib 
This means tests can pass on any machine now 👍
 2023-08-14 11:55:22 +02:00
Rasmus Wriedt Larsen
0fba38c6d8 Merge branch 'main' into amammad-python-WebAppsConstatntSecretKeys 2023-08-14 11:29:56 +02:00
Rasmus Wriedt Larsen
ca93f4d223 Python: Accept .expected changes 2023-08-11 10:36:05 +02:00
Rasmus Lerchedahl Petersen
e5cd3e8f64 Python: nice locations for import aliases 
These were computed wrongly before.
 2023-08-10 20:27:06 +02:00
Rasmus Lerchedahl Petersen
eac44e89d9 Python: test nice locations 
there are errors both on lines 2 and 3 due to
locations being computed wrongly.
 2023-08-10 14:21:16 +02:00
Rasmus Wriedt Larsen
46af77c1af Python: Include all assignments in data flow paths 
Like Ruby did in https://github.com/github/codeql/pull/12566
 2023-08-10 11:45:29 +02:00
Rasmus Wriedt Larsen
9bd5694c3f Python: Add tests of path-graph for dataflow/taint-tracking 
Although this is actually using taint-tracking (so we can use the +=
statement), I would personally forget to check under the
dataflow/tainttracking folder to look for such a test, so I'm opting to
keep it under the dataflow/ folder.
 2023-08-10 11:44:17 +02:00
Rasmus Lerchedahl Petersen
dbc60140e0 Python: move tests to data extensions 
For these tests, we cannot use the same mechanism, as we want the
data extensions to be available for both tests.

Instead, we create a ql-pack for the test directory and point to
the data entensions from there. This makes the extensions
available for all tests in the directory.
 2023-08-10 09:17:34 +02:00
Rasmus Lerchedahl Petersen
168a1e01a4 Python: move test to data extensions 
For this test, we can simply use the convention,
that a file called `[ql-file-stem].ext.yml` will be used
as data extensions exactly for the test represented by `ql-file`.
 2023-08-09 21:22:17 +02:00
Rasmus Wriedt Larsen
51a05286fa Merge pull request #13731 from pwntester/py/aiohttp_improvements 
Python: Aiohttp improvements
 2023-08-09 16:37:20 +02:00
Rasmus Lerchedahl Petersen
f33aff42ad Python: missing result was fixed 2023-08-08 12:14:57 +02:00
Rasmus Wriedt Larsen
4f47461f60 Python: Add requested test 2023-08-08 10:44:48 +02:00
erik-krogh
92db7b047c escape unicode chars in the output for the ReDoS queries 2023-08-08 00:15:54 +02:00
Asger F
c38cbe859d Merge pull request #13737 from asgerf/dynamic/fuzzy-models 
Dynamic: add Fuzzy token
 2023-08-03 09:58:24 +02:00
jorgectf
8f8c064632 Modify test 2023-07-24 17:50:22 +02:00
jorgectf
55648ac4de Add shlex.quote as sanitizer 2023-07-20 15:34:54 +02:00
Geoffrey White
bb16731b86 Python: Fix for multiple parse mode flags. 2023-07-20 11:16:14 +01:00
Geoffrey White
dbde99df91 Python: Add test cases. 2023-07-20 11:06:00 +01:00
Maiky
a1782182dd Python: Add unsafe deserialization sinks (CWE-502) 2023-07-20 03:26:22 +02:00
Geoffrey White
cb6276e5e2 Python: Test layout. 2023-07-19 18:44:15 +01:00
Anders Schack-Mulligen
ae24d68b5d C/C++/C#/Java/Python/Ruby/Swift: Adjust expected output. 2023-07-19 11:41:15 +02:00
yoff
d032bf5c0e Merge pull request #13685 from RasmusWL/captured-variables-default-param-value 
Python: Model parameter with default value as `DefinitionNode`
 2023-07-17 14:25:13 +02:00
Rasmus Wriedt Larsen
aa8ed91993 Python: Accept .expected changes 
but it's kinda bad, since it has paths to stdlib in there :(
 2023-07-14 14:47:27 +02:00