Rasmus Lerchedahl Petersen
ee45e79948
python: Create XML modulein Concepts
...
to prepare for XXE and other XML related modelling
2022-03-02 13:10:23 +01:00
Rasmus Lerchedahl Petersen
80be767a7a
python: implement stdlib xpath support
2022-03-02 12:59:34 +01:00
Rasmus Lerchedahl Petersen
06e0f140c5
python: add tests for stdlib xpath
2022-03-02 12:58:37 +01:00
Rasmus Wriedt Larsen
518e2aeebf
Merge branch 'main' into jorgectf/python/deserialization
2022-03-01 16:47:13 +01:00
Rasmus Wriedt Larsen
27d5349a74
Python: ORM: Remove imports from test code
...
These are no longer needed, as data-flow now has this import by default
2022-03-01 15:39:52 +01:00
Rasmus Wriedt Larsen
a1c7ec8c6d
Python: Accept .exepcted changes from importing frameworks from data-flow
...
Since `python.qll` has `private import
semmle.python.dataflow.new.DataFlow`, that means that all tests now
implicitly imports the frameworks modeling, and therefore any python
class is part of the DjangoViewClassHelper ql class.
de8ecb214f/python/ql/lib/python.qll (L44)
2022-03-01 15:37:16 +01:00
Rasmus Lerchedahl Petersen
f55d7d627e
python: model XPathEvaluator
2022-03-01 14:40:13 +01:00
Rasmus Lerchedahl Petersen
3bb17be389
python: add concept and library tests
2022-03-01 14:39:28 +01:00
Rasmus Wriedt Larsen
cd58c12bbe
Merge branch 'main' into orm
2022-03-01 12:01:54 +01:00
Arthur Baars
5ce6b847d1
Merge pull request #8166 from aibaars/regex-char-sequence-1
...
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-28 17:47:53 +01:00
Rasmus Wriedt Larsen
8afd560c64
Python: ORM: Handle load of PolymorphicModels
2022-02-28 16:38:41 +01:00
Rasmus Wriedt Larsen
48fba87273
Python: ORM: add flow to base-class
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
6b9dd49499
Python: ORM: Model polymorphic.models.PolymorphicModel as Django ORM class
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
e1191cf63c
Python: ORM: Add tests for inheritance
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
092cfceb18
Python: Add dataflow consistency checks to ORM tests
...
Luckily they passed :phew:
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
ed36ff1570
Python: ORM: Handle <Model>.objects.[<QuerySet>].update()
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
fea46b642d
Python: ORM: Handle <Model>.objects.create and friends
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
9b458b54aa
Python: ORM: Add flow to collection/dict queries
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
9cff4cbd1c
Python: ORM: Add a few more tests
...
There were a few methods I had overlooked
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
ae057c74cc
Python: ORM: Store step for constructor
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
f8a51bb994
Python: ORM: Add data-flow steps for Django ORM
...
Added dummy-whitespace to `orm_security_tests.py` so it would be
possible to see what the reflected XSS results are in the diff
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
d3f07cdc10
Python: ORM: Add qltests
...
Which shows that there is no flow yet, which is not really a surprise :D
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
c78fed6594
Python: ORM: Add raw python test files
...
no ql test files yet though, will come in next commit.
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
f89fb50eb5
Python: ORM: Add boilerplate django project
...
By doing
```
django-admin startproject testproj
django-admin startapp testapp
```
2022-02-28 16:38:40 +01:00
yoff
d953382df9
Merge pull request #7807 from RasmusWL/dataflow-improvements
...
Python: Dataflow improvements
2022-02-28 16:24:00 +01:00
haby0
be40b54b9f
add test
2022-02-28 20:34:58 +08:00
Rasmus Wriedt Larsen
0e0f159891
Python: Use Python 3 for investigation tests
...
Apparently there are minor differences with `test-6-max-import-depth-2`
where under Python 2 `isfile_no_problem.py` still works as before
2022-02-28 11:33:31 +01:00
Rasmus Wriedt Larsen
01d426dc58
Python: Replace rest of from testlib import *
...
I think we should write our tests in a way that puts points-to in the
best condition to resolve calls. Although this specific change did not
change much, it should help set us up for success in the future 👍
2022-02-28 10:58:44 +01:00
Rasmus Wriedt Larsen
ead0b658d2
Python: Fix fieldflow tests by increasing max-import-depth
2022-02-28 10:58:44 +01:00
Rasmus Wriedt Larsen
a0d1cea490
Python: Add investigation of field-flow problem
...
TL;DR; we used a too low value for `--max-import-depth` :(
2022-02-28 10:58:44 +01:00
jorgectf
67b672a467
Merge remote-tracking branch 'origin/main' into jty/python/emailInjection
2022-02-26 01:22:55 +01:00
Arthur Baars
5044f89105
Ruby/Python re-introduce normalCharacterSequence
2022-02-25 18:43:43 +01:00
Rasmus Wriedt Larsen
f988e1f0d8
Python: Improve field-flow by removing import *
...
Since that apparently impacts call graph resolution with points-to :O
Also interesting that global flow was only not working for those cases
because of the tricky ifs... still need to 100% figure out how those ifs
are messing up the analysis :|
2022-02-25 16:01:08 +01:00
Rasmus Wriedt Larsen
999af15bd5
Python: Show unresolved calls for field-flow tests
2022-02-25 15:58:07 +01:00
yoff
8b926f6859
Merge pull request #7873 from RasmusWL/fix-attribute-taint
...
Python: Fix attribute taint
2022-02-25 15:02:24 +01:00
Rasmus Wriedt Larsen
2d0034c40d
Python: Replicate global field-flow failures
2022-02-25 14:14:00 +01:00
Rasmus Wriedt Larsen
faaa63a73c
Python: Ensure no cross-talk in global tests
...
By giving all variables unique names
I also added a comment with the function name from the normal tests, so
its' easily visible what these tests are testing
2022-02-25 13:41:51 +01:00
Rasmus Wriedt Larsen
0642610ee9
Python: Global flow works when in own file???
...
This is very suspicious
2022-02-25 13:36:00 +01:00
Rasmus Wriedt Larsen
d83a9ef8d3
Python: Fix global field-flow for validTest.py
2022-02-25 13:35:43 +01:00
Rasmus Wriedt Larsen
abe4d8da62
Python: Accept global field-flow inconsistencies
...
Yikes
2022-02-24 15:07:18 +01:00
Rasmus Wriedt Larsen
94d23f3817
Python: Also do all field-flow tests in global scope
...
Notice that these tests don't pass, to show how they differ in the next
commit!
2022-02-24 15:06:40 +01:00
Rasmus Wriedt Larsen
2da4b39844
Python: Add global field-flow tests
...
I thought it was interesting that it did not propagate flow to the uses
inside the functions :O
2022-02-24 13:15:48 +01:00
Rasmus Wriedt Larsen
aeba497832
Merge pull request #7735 from yoff/python/promote-log-injection
...
Python: promote log injection
2022-02-23 16:21:12 +01:00
Taus
3ce7d47b5b
Merge pull request #7452 from jorgectf/python_jwt
...
Python: Add Python_JWT to JWT security query
2022-02-23 15:23:20 +01:00
jorgectf
4aa1c0a11e
Update .expected
2022-02-23 00:55:39 +01:00
jorgectf
7c108c7892
Polish test
2022-02-22 20:57:20 +01:00
Arthur Baars
69ed121ecb
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-22 16:15:33 +01:00
Rasmus Wriedt Larsen
d2cd77aefb
Merge branch 'main' into dataflow-improvements
2022-02-21 14:49:40 +01:00
Rasmus Wriedt Larsen
b59ab7f5f3
Merge branch 'main' into python/promote-log-injection
2022-02-21 09:59:31 +01:00
Rasmus Wriedt Larsen
9d81fd3b95
Python: Improve sanitizer/guards tests
...
Based on review conversation
2022-02-18 14:12:41 +01:00
