Rasmus Wriedt Larsen
8f7dec07b8
Python: Remove 'response' from default threat-models
...
I didn't want to put the configuration file in
`semmle/python/frameworks/**/*.model.yml`, so created `ext/` as in other
languages
2024-08-19 10:54:48 +02:00
Rasmus Wriedt Larsen
617ab27c75
Python: Add test showing default active threat-models
2024-08-19 10:54:48 +02:00
Joe Farebrother
62c2fe6b17
Merge pull request #16933 from joefarebrother/python-cookie-concept-promote
...
Python: Promote the insecure cookie query from experimental
2024-08-07 09:06:05 +01:00
Anders Schack-Mulligen
377301a55a
Merge pull request #17108 from aschackmull/dataflow/flowthrough-provenance
...
Dataflow: Propagate provenance correctly for flow-through wrappers.
2024-08-01 09:35:56 +02:00
yoff
251036c6b4
Merge pull request #17080 from sylwia-budzynska/streamlit
...
Python: Add Streamlit models
2024-07-31 18:20:11 +02:00
Anders Schack-Mulligen
9724516c84
C#/Go/Java/Python/Ruby: Accept qltest .expected changes.
2024-07-31 14:45:10 +02:00
yoff
123dcc75d1
Merge pull request #16971 from RasmusWL/mad-dict-source
...
Python: Add MaD support for DictionaryElement/DictionaryElementAny for sources
2024-07-31 13:40:07 +02:00
Sylwia Budzynska
9bd00c9e1e
Change Gradio rfs test to use shared rfs test module
2024-07-31 13:25:32 +02:00
Sylwia Budzynska
9741ddb926
Add remoteflowsoucre test
2024-07-30 17:20:14 +02:00
Sylwia Budzynska
bfd2e4350b
Add StreamlitConnection model
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-30 12:58:49 +02:00
Joe Farebrother
e68ef87662
update inline tests for rest_framework tests
2024-07-29 23:35:36 +01:00
Joe Farebrother
f10d007496
Add additional test for kwargs case
2024-07-29 23:27:22 +01:00
Joe Farebrother
68512eea14
Remove remaining files from experimental tests
2024-07-29 11:19:33 +01:00
Joe Farebrother
1127b08635
Merge branch 'main' into python-cookie-concept-promote
2024-07-29 10:26:03 +01:00
Joe Farebrother
58689c90fb
Merge pull request #16893 from joefarebrother/python-cookie-injectio-promote
...
Python: Promote cookie injection query from experimental
2024-07-29 10:17:01 +01:00
yoff
d23d138e7d
Merge pull request #16923 from RasmusWL/impossible-isinstance
...
Python: Add test for impossible isinstance flow
2024-07-29 09:33:30 +02:00
Sylwia Budzynska
358a1b3a20
Fix tests
2024-07-26 14:19:06 +02:00
Sylwia Budzynska
6d1c00742f
Add tests and change note
2024-07-26 14:15:43 +02:00
Joe Farebrother
db27fd934a
Add tests for tornado and twisted
2024-07-23 13:21:37 +01:00
Joe Farebrother
93f70b3ad9
Add unit tests
2024-07-23 10:15:23 +01:00
Joe Farebrother
b28d79960b
Update ConceptsTests and make a fix
2024-07-23 10:15:09 +01:00
Joe Farebrother
a73d675e6e
Remove experimental query versions
2024-07-23 10:14:55 +01:00
Joe Farebrother
32fbe52f0f
Model cookie attributes for Django and Flask
2024-07-23 10:14:33 +01:00
Rasmus Lerchedahl Petersen
3434c38da7
Python: update test expectations
...
This is MaD...
2024-07-22 17:03:29 +02:00
Joe Farebrother
070d67816d
Remove experimental version
2024-07-16 16:50:10 +01:00
Joe Farebrother
8d93c3a852
Move to cwe-20
2024-07-16 16:50:08 +01:00
Joe Farebrother
983bdb92a1
Add test cases + remove redundant import
2024-07-16 16:50:00 +01:00
Rasmus Wriedt Larsen
db8a5306cf
Python: Add MaD support for DictionaryElement/DictionaryElementAny for sources
2024-07-12 15:19:40 +02:00
Rasmus Wriedt Larsen
eed8b3e87b
Python: Add more tests for MaD sources
2024-07-12 15:10:23 +02:00
Rasmus Wriedt Larsen
f41d2a896c
Merge pull request #16771 from porcupineyhairs/js2py
...
Python : Arbitrary code execution due to Js2Py
2024-07-11 15:31:57 +02:00
Joe Farebrother
8152ec7472
Merge pull request #16696 from joefarebrother/python-cookie-write-headers
...
Python: Model CookieWrites from HeaderWrites
2024-07-11 14:25:54 +01:00
Rasmus Wriedt Larsen
5ecde387af
Python: Fix .expected
2024-07-11 14:42:26 +02:00
Rasmus Wriedt Larsen
173cd13ded
Python: Add test for impossible isinstance flow
2024-07-08 12:06:53 +02:00
Porcupiney Hairs
808af28618
Python : Arbitrary codde execution due to Js2Py
...
Js2Py is a Javascript to Python translation library written in Python. It allows users to invoke JavaScript code directly from Python.
The Js2Py interpreter by default exposes the entire standard library to it's users. This can lead to security issues if a malicious input were directly.
This PR includes a CodeQL query along with a qhelp and testcases to detect cases where an untrusted input flows to an Js2Py eval call.
This query successfully detects CVE-2023-0297 in `pyload/pyload`along with it's fix.
The databases can be downloaded from the links bellow.
```
https://file.io/qrMEjSJJoTq1
https://filetransfer.io/data-package/a02eab7V#link
```
2024-07-03 19:06:34 +05:30
Rasmus Wriedt Larsen
ce177c3450
Merge pull request #15655 from yoff/python/support-model-editor
...
Python: Support model editor
2024-07-02 16:28:58 +02:00
Rasmus Wriedt Larsen
dc33f0de1d
Python: Additional tests for model-editor
...
We currently have some problems with these files, that we should fix
later down the line. See PR comment for more details.
2024-07-02 14:28:46 +02:00
Joe Farebrother
b81d41ba7b
Add django header write models for direct subscript write
2024-07-01 11:26:54 +01:00
Rasmus Lerchedahl Petersen
e40ae2e52d
Python: adjust test expectations
...
MaD row numbers in provenance column
2024-06-28 21:56:11 +02:00
Rasmus Lerchedahl Petersen
77a00873a9
Python: add tests for loggers
2024-06-28 15:25:17 +02:00
Rasmus Lerchedahl Petersen
9cca1b294c
Python: Add test cases
2024-06-27 16:33:23 +02:00
Rasmus Lerchedahl Petersen
27301edc28
Python: address more review comments
2024-06-27 16:05:21 +02:00
yoff
c2141b62e0
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-06-27 14:53:03 +02:00
Rasmus Lerchedahl Petersen
a3076f4f72
Python: fix test expectations, add missing sanitizer
2024-06-26 13:27:32 +02:00
Joe Farebrother
6538d22d3f
Fix tornado model of httheaders.add.
2024-06-26 09:21:53 +01:00
yoff
58b6b3f601
Merge pull request #16789 from yoff/python/document-models-as-data
...
python: Document MaD format
2024-06-25 15:46:28 +02:00
Rasmus Lerchedahl Petersen
aa4fd1992e
Python: compact types in type models
2024-06-25 11:59:55 +02:00
Joe Farebrother
d0f735ac28
Update tests for restframework
2024-06-24 20:52:09 +01:00
Joe Farebrother
c404f00a9b
Add additional header write models for aiohttp and tornado + added qldoc
2024-06-24 17:27:25 +01:00
Joe Farebrother
79c0ed6074
Add additional fastapi mheader write models
2024-06-24 17:27:21 +01:00
Joe Farebrother
5ced5c010c
Add django header writes
2024-06-24 17:27:15 +01:00
