erik-krogh
1cbf28358c
deprecate unused code inside the points-to library
2022-09-07 07:39:16 +02:00
erik-krogh
46b7aa92ae
deprecate predicates in protocols.qll that were only retained for backwards compatibility
2022-09-07 07:37:51 +02:00
Rasmus Lerchedahl Petersen
b2fbbc6ac5
Python: add a flow summary
...
we could consider adding non-value-preserving flow from input to output
2022-09-06 21:29:58 +02:00
Rasmus Lerchedahl Petersen
f6d807aec0
Python: Add summary test append_to_list
2022-09-06 18:42:32 +02:00
Taus
0b8bdc0f85
Python: Fix broken test
2022-09-06 16:37:43 +00:00
Taus
3bb7e28712
Merge pull request #10176 from RasmusWL/import-problem
...
Python: Add testcase for import problem
2022-09-06 18:12:37 +02:00
Rasmus Lerchedahl Petersen
744fbf0c1b
Python: qldoc for inject
2022-09-06 17:46:14 +02:00
Rasmus Lerchedahl Petersen
67710eaed7
Python: Comment to highlight convention
2022-09-06 17:43:34 +02:00
Rasmus Lerchedahl Petersen
a496d10126
Python: qldoc to highlight source code aspect
2022-09-06 17:39:20 +02:00
Rasmus Lerchedahl Petersen
e7400e90e5
Python: add qldoc
2022-09-06 17:29:27 +02:00
Rasmus Lerchedahl Petersen
4cd41c24c7
Python: remove comments and start design document
2022-09-06 17:23:40 +02:00
Rasmus Lerchedahl Petersen
67c3a9b2f4
Python: resolve library calls in the CFG
...
rather than in the AST
2022-09-06 17:00:28 +02:00
Asger F
95c60858d4
Export as DataFlow instead of DF
2022-09-06 15:02:48 +02:00
Rasmus Lerchedahl Petersen
e5f087518e
Python: stay in control flow layer
2022-09-06 14:16:48 +02:00
Rasmus Wriedt Larsen
5f6e3dcc2e
Python: Revert changes to sensitive data query alert messages
...
This partly reverts the changes from https://github.com/github/codeql/pull/10252
Although consistency is nice, the new messages didn't sound as natural.
New alert message would read
> Insecure hashing algorithm (md5) depends on sensitive data (password). (...)
I'm not sure what it means that a hashing algorithm depends on data. So
for me, the original text below is much easier to understand.
> Sensitive data (password) is used in a hashing algorithm (md5) that is insecure (...)
Same goes for the other sensitive data queries.
2022-09-06 12:01:24 +02:00
Rasmus Wriedt Larsen
a9e1e72196
Merge branch 'main' into shared-http-client-request
2022-09-06 10:52:27 +02:00
Rasmus Wriedt Larsen
07457b2b5f
Python: Apply suggestions from code review
...
Co-authored-by: Taus <tausbn@github.com >
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
d708abfc80
Python: Accept more .expected changes
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
c9cd809ef2
Python: Add change-note
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
e979dffc08
Python: Fix variable access from extractor-change
...
These changes are from internal PR.
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
985e87ccde
Python: Add variable scope example with subclass
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
0e3d520712
Python: Add variables regression test
...
As illustrated when running the python file, the non qualified reads in
the `use` method all refer to the global variables, whereas `ex =
func(baz)` are to the things defined on the class.
The important part of the .expected changes is that the _global_
variable `bar` is used inside the function, whereas it's the local
variable for `foo` (on class scope) that is used inside the function
(which is wrong).
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
98db1af898
Python: Also show variable access
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
fd4f60dd1b
Python: Adjust variables tests
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
ebd97f4496
Python: Add type-tracking regession example
2022-09-06 10:11:36 +02:00
Asger F
c7c3ad29cd
Python: sync with Python
2022-09-06 09:30:02 +02:00
Rasmus Lerchedahl Petersen
af08c6eb08
Python: remove repeated test file
2022-09-05 20:44:55 +02:00
Ahmed Farid
23871b3f5a
Update Concepts.qll
2022-09-05 18:26:56 +01:00
Rasmus Lerchedahl Petersen
d31d763328
Python: adjust test expectations
...
We now locate a `DataFlow::Node` rather than an 'AstNode`.
2022-09-05 16:45:43 +02:00
Taus
c19574b9a4
Merge pull request #10267 from yoff/python/port-EmptyExcept
...
python: Rewrite EmptyExcept from `points-to` to API graph
2022-09-05 14:11:34 +02:00
Rasmus Lerchedahl Petersen
5fc1bbc8c5
Python: Only alert on Python 2 code
...
since
- Python 3 is ok from 3.7 onwards
- support for Python 3.6 was just dropped
- we do not actually know the minor version of the analysed code
(only of the extractor)
2022-09-05 13:38:14 +02:00
erik-krogh
0de0325c8e
change the alert-message for py/modification-of-default-value
2022-09-05 13:30:56 +02:00
erik-krogh
a86a940df7
add getRepr() and toString() on RelevantState
2022-09-05 13:27:34 +02:00
erik-krogh
3f1cb04f3e
sync files
2022-09-05 11:22:34 +02:00
Rasmus Lerchedahl Petersen
afb50212a0
Python: update version check
...
doc said 3.5 experience says 3.7
2022-09-05 10:50:53 +02:00
Ahmed Farid
f84331f5a5
Provides classes for modeling HTTP Header APIs
2022-09-05 00:53:10 +01:00
Rasmus Lerchedahl Petersen
a8a042db57
python: remove illegal option
2022-09-03 20:33:48 +02:00
Ahmed Farid
94b91536f9
Replacing getParameter by getArg and getArgByName
2022-09-03 14:05:07 +01:00
Asger F
f22de8a3b7
Python: Sync with Python
2022-09-03 13:51:02 +02:00
Asger F
296aa52ef0
Python: Add API::EntryPoint
...
Python: add EntryPoint test
2022-09-03 13:24:46 +02:00
Ahmed Farid
a50c226ca9
Autoformat
2022-09-03 12:10:55 +01:00
erik-krogh
c38062ce93
convert RelevantState to a class in the PrefixConstruction module
2022-09-02 20:26:31 +02:00
erik-krogh
089ce5a8a4
change alert messages of path queries to use the same template
2022-09-02 14:45:40 +02:00
Erik Krogh Kristensen
6cee635cb5
Merge pull request #10180 from erik-krogh/fixTags
...
Add missing security tags
2022-09-02 08:04:57 +02:00
Rasmus Lerchedahl Petersen
0599e8ac35
python: add version check
...
and attempt to set version for tests
2022-09-01 23:47:07 +02:00
Rasmus Lerchedahl Petersen
1d2d28be76
python: replace points-to with API graph
2022-09-01 23:24:10 +02:00
Rasmus Lerchedahl Petersen
d102a84e02
python: replace points-to with API graph
2022-09-01 22:58:46 +02:00
Rasmus Lerchedahl Petersen
163bfc4f71
python: replace points-to with API graph
...
- values are identified via `API::builtin`
- `points-to` is approximated by `getAValueReachableFromSource`
2022-09-01 22:47:32 +02:00
Rasmus Lerchedahl Petersen
93fcaf24c1
python: RaisingTuple.ql to not use poins-to
...
Use local dataflow instead and simply check for tuple literals.
2022-09-01 21:45:57 +02:00
Edoardo Pirovano
8f332714f4
Merge pull request #10260 from github/edoardo/3.7-mergeback
...
Merge `rc/3.7` into `main`
2022-09-01 15:44:17 +01:00
