yoff
8ab5617b51
Merge pull request #10539 from yoff/python/improve-API-graphs
...
Python: add subscript to API graphs
2022-09-29 21:05:22 +02:00
Rasmus Lerchedahl Petersen
84ab860600
python: rewrite type tracker for ldap operations
...
There are several other clean ups I would like to do in this file,
but this can wait until we promote the query.
2022-09-29 20:32:19 +02:00
Rasmus Wriedt Larsen
0cb8e121e9
Python: Fix flask request modeling
...
This takes us part of the way. We still get multiple paths for the same
alert, but that will be fixed in a different PR.
2022-09-29 17:41:21 +02:00
Rasmus Lerchedahl Petersen
63ee51a4e2
Python: inline mongoCollectionMethod
2022-09-28 11:40:06 +02:00
Rasmus Lerchedahl Petersen
441fc1bb28
Python: type trackers to API graph
...
base on new subscript in the API graph
There are a few more uses of type tracking
through `SubscriptNode`s, but these start
from an instance given by a data flow node.
2022-09-26 15:05:50 +02:00
Rasmus Lerchedahl Petersen
9b1ec03d70
Python: type tracking to API graph
...
using the new subscript node
2022-09-26 13:39:59 +02:00
github-actions[bot]
6cef0af5df
Post-release preparation for codeql-cli-2.11.0
2022-09-23 21:01:40 +00:00
github-actions[bot]
f5cf8cffa3
Release preparation for version 2.11.0
2022-09-22 20:14:12 +00:00
Henry Mercer
f8f99af8b7
Bump the minor version of packs we regularly release
2022-09-22 12:14:19 +01:00
Andrew Eisenberg
58e4861b45
Merge branch 'main' into rc/3.7
2022-09-20 12:43:20 -07:00
yoff
ea743173d5
Merge pull request #8781 from yoff/python-dataflow/flow-summaries-from-scratch
...
Python dataflow: flow summaries restart
2022-09-20 14:08:31 +02:00
Erik Krogh Kristensen
a4cd913aea
Merge pull request #10312 from erik-krogh/fix-caseDiff
...
ensure consistent casing of names
2022-09-19 10:43:12 +02:00
CodeQL CI
b48808778f
Merge pull request #10264 from yoff/python/port-RaisesTuple
...
Approved by tausbn
2022-09-19 00:51:29 -07:00
CodeQL CI
ed4b64b1c4
Merge pull request #10265 from yoff/python/port-UnguardedNextInGenerator
...
Approved by tausbn
2022-09-19 00:50:52 -07:00
CodeQL CI
36f8b0554d
Merge pull request #10266 from yoff/python/port-CatchingBaseException
...
Approved by tausbn
2022-09-19 00:50:05 -07:00
github-actions[bot]
67ce442674
Post-release preparation for codeql-cli-2.10.5
2022-09-16 14:23:44 +00:00
Rasmus Lerchedahl Petersen
efc5cfb852
Merge branch 'main' of github.com:github/codeql into python-dataflow/flow-summaries-from-scratch
2022-09-12 19:56:16 +02:00
Rasmus Lerchedahl Petersen
0f95992b2f
Python: remove NonLibraryDataFlowCallable
...
this required managing parameters and their pre-update nodes a bit
2022-09-12 15:17:29 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
github-actions[bot]
a9d80a5a48
Release preparation for version 2.10.5
2022-09-08 11:35:54 +00:00
Taus
8b8e74cc9a
Merge pull request #10314 from RasmusWL/revert-alert-msgs-change
2022-09-08 13:00:47 +02:00
Ahmed Farid
64bb022adf
Add www-authenticate to sensitiveheaders()
2022-09-07 11:12:53 +01:00
Rasmus Lerchedahl Petersen
0cfb49102b
Python: fix non-US spelling
2022-09-07 09:30:42 +02:00
Rasmus Wriedt Larsen
5f6e3dcc2e
Python: Revert changes to sensitive data query alert messages
...
This partly reverts the changes from https://github.com/github/codeql/pull/10252
Although consistency is nice, the new messages didn't sound as natural.
New alert message would read
> Insecure hashing algorithm (md5) depends on sensitive data (password). (...)
I'm not sure what it means that a hashing algorithm depends on data. So
for me, the original text below is much easier to understand.
> Sensitive data (password) is used in a hashing algorithm (md5) that is insecure (...)
Same goes for the other sensitive data queries.
2022-09-06 12:01:24 +02:00
Rasmus Wriedt Larsen
a9e1e72196
Merge branch 'main' into shared-http-client-request
2022-09-06 10:52:27 +02:00
Ahmed Farid
23871b3f5a
Update Concepts.qll
2022-09-05 18:26:56 +01:00
Taus
c19574b9a4
Merge pull request #10267 from yoff/python/port-EmptyExcept
...
python: Rewrite EmptyExcept from `points-to` to API graph
2022-09-05 14:11:34 +02:00
Rasmus Lerchedahl Petersen
5fc1bbc8c5
Python: Only alert on Python 2 code
...
since
- Python 3 is ok from 3.7 onwards
- support for Python 3.6 was just dropped
- we do not actually know the minor version of the analysed code
(only of the extractor)
2022-09-05 13:38:14 +02:00
erik-krogh
0de0325c8e
change the alert-message for py/modification-of-default-value
2022-09-05 13:30:56 +02:00
Rasmus Lerchedahl Petersen
afb50212a0
Python: update version check
...
doc said 3.5 experience says 3.7
2022-09-05 10:50:53 +02:00
Ahmed Farid
f84331f5a5
Provides classes for modeling HTTP Header APIs
2022-09-05 00:53:10 +01:00
Ahmed Farid
94b91536f9
Replacing getParameter by getArg and getArgByName
2022-09-03 14:05:07 +01:00
Ahmed Farid
a50c226ca9
Autoformat
2022-09-03 12:10:55 +01:00
erik-krogh
089ce5a8a4
change alert messages of path queries to use the same template
2022-09-02 14:45:40 +02:00
Erik Krogh Kristensen
6cee635cb5
Merge pull request #10180 from erik-krogh/fixTags
...
Add missing security tags
2022-09-02 08:04:57 +02:00
Rasmus Lerchedahl Petersen
0599e8ac35
python: add version check
...
and attempt to set version for tests
2022-09-01 23:47:07 +02:00
Rasmus Lerchedahl Petersen
1d2d28be76
python: replace points-to with API graph
2022-09-01 23:24:10 +02:00
Rasmus Lerchedahl Petersen
d102a84e02
python: replace points-to with API graph
2022-09-01 22:58:46 +02:00
Rasmus Lerchedahl Petersen
163bfc4f71
python: replace points-to with API graph
...
- values are identified via `API::builtin`
- `points-to` is approximated by `getAValueReachableFromSource`
2022-09-01 22:47:32 +02:00
Rasmus Lerchedahl Petersen
93fcaf24c1
python: RaisingTuple.ql to not use poins-to
...
Use local dataflow instead and simply check for tuple literals.
2022-09-01 21:45:57 +02:00
Edoardo Pirovano
8f332714f4
Merge pull request #10260 from github/edoardo/3.7-mergeback
...
Merge `rc/3.7` into `main`
2022-09-01 15:44:17 +01:00
Ahmed Farid
0fd684cde8
Add more source of crypto call
2022-08-31 17:13:43 +01:00
Ahmed Farid
cf83b07aae
Add more source of crypto call
2022-08-31 17:04:02 +01:00
Ahmed Farid
daff7775ca
Update TimingAttack.qll
2022-08-31 16:09:22 +01:00
Ahmed Farid
a42cb20b86
Update TimingAttack.qll
2022-08-31 16:07:58 +01:00
Ahmed Farid
13d1a4fdc1
Update TimingAttackAgainstHeaderValue.ql
2022-08-31 12:46:17 +01:00
Ahmed Farid
12960fd00f
Update TimingAttack.qll
2022-08-31 12:39:46 +01:00
Ahmed Farid
f2688c4a02
Update select statement
2022-08-31 12:39:00 +01:00
Ahmed Farid
275ed0d6e5
Update select statement
2022-08-31 12:37:36 +01:00
Ahmed Farid
740bf716cb
Update TimingAttack.qll
2022-08-31 12:22:01 +01:00
