Rasmus Lerchedahl Petersen
cfbc3f73ec
Pyhton: add test for conflicting summaries
...
We noticed that when
- a function has more than one summary (with different charpred)
- one summary is subsumed by a subpath (or something happens around the function being extracted)
- the function is called multiple times(we needed at least three)
one of the summaries would no longer lead to flow.
2024-03-15 15:13:39 +01:00
Sim4n6
3acdd3382c
Update the expected file
2024-03-15 14:17:23 +01:00
Sim4n6
26a16b7857
use of a single var "op" of type Cmpop
2024-03-15 14:17:23 +01:00
Sim4n6
a717bf1b9d
Fix p tag in UnicodeDoS.qhelp
2024-03-15 14:17:23 +01:00
Sim4n6
af19a0342e
Fix UnicodeDoS vulnerability in CWE-770 code
2024-03-15 14:17:23 +01:00
Sim4n6
085d803b14
Fix UnicodeDoS vulnerability in CWE-770
2024-03-15 14:17:23 +01:00
Sim4n6
31dc542111
Update request parameter name in good_1() function
2024-03-15 14:17:23 +01:00
Sim4n6
70ebc58b4c
Refactor Unicode normalization code
2024-03-15 14:17:23 +01:00
Sim4n6
3d8868a6c3
Add routes for bad_5 and bad_6, and fix routes for good_3 and good_4
2024-03-15 14:17:23 +01:00
Sim4n6${{7*'7'}}
658b88e62f
Update python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql
...
update the Config API
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-03-15 14:17:23 +01:00
Sim4n6
1f767b887e
Add some comments and docs
2024-03-15 14:17:23 +01:00
Sim4n6
5cc9170249
Add UnicodeDoS sink for werkzeug secure_filename
2024-03-15 14:17:23 +01:00
Sim4n6
342465057c
Add Unicode DoS (CWE-770)
2024-03-15 14:17:23 +01:00
Rasmus Wriedt Larsen
7eb4419342
Python: Restrict type-tracking content to only be precise
...
At least for now :)
2024-03-15 10:24:57 +01:00
Rasmus Wriedt Larsen
6babb2ff90
Python: Accept .expected for typetracking-summaries
2024-03-15 10:24:33 +01:00
Rasmus Wriedt Larsen
00f2a6a65e
Python: Update ssa-compute test expectations
2024-03-15 10:14:45 +01:00
Rasmus Wriedt Larsen
7a3ee0f5f8
Python: Make IterableSequenceNode LocalSourceNode
...
We do this to remove the inconsistencies, and to be ready for a future
where type-tracking support content tracker of depth > 1.
It works because targets of loadSteps needs to be LocalSourceNodes
predicate loadStep(Node nodeFrom, LocalSourceNode nodeTo, Content content) {
2024-03-14 10:46:29 +01:00
Rasmus Wriedt Larsen
6ffaad1bc8
Python: Expand type-tracking tests with nested tuples
...
I was initially surprised to see that this didn't work, until I
remembered that type-tracking only works with content of depth 1.
2024-03-14 10:44:25 +01:00
Rasmus Wriedt Larsen
af8cef5b53
Python: Fixup deprecated type-tracker API
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
2b09b084e0
Python: Add change-note
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
7de304bf16
Python: Add proper type-tracking tests for content
...
Instead of just relying on the call-graph tests
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
fa0c4e18fc
Python: Expand dict-content tt test even more
...
While it might be useful to track content to any lookup, it's not
something we do right now.
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
4d78762ba8
Python: Ignore consistency failure
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
8a7ffac19c
Python: Accept consistency failure
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
92729dbbd6
Python: Support iterable unpacking in type-tracking
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
0cf3fe4a4c
Python: Expand dict update tests
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
dac2b57bb0
Python: type-track through dict-updates
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
73fe596753
Python: type-tracking through dictionary construction
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
ece8245a4b
Python: type-track through tuple content
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
a95bb7c86b
Python: Expand function reference in content test
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
7721fb3331
Python: Setup shared read/store steps
2024-03-14 10:42:37 +01:00
Rasmus Wriedt Larsen
636cf611ae
Python: Allow general content in type-tracker
...
This should not result in many changes, since store/load steps are still
only implemented for attributes.
2024-03-14 10:42:37 +01:00
Rasmus Wriedt Larsen
fc8caa66c8
Python: Prepare for general content in type-tracker
...
Due to the char-pred of Content, this change should keep exactly the
same behavior as before.
2024-03-14 10:42:37 +01:00
Rasmus Lerchedahl Petersen
533b63743b
Python: test MaD syntax for keyword argument
...
use the combined positional/keyword syntax as
that is what we will probably mostly use.
2024-03-13 15:28:34 +01:00
Tom Hvitved
6c0ed28e6b
Python: Implement new data flow interface
2024-03-13 14:41:57 +01:00
yoff
b5c0fbb827
Merge pull request #15776 from RasmusWL/tt-consistency
...
Python: Add type-tracking consistency query
2024-03-13 11:11:07 +01:00
Tom Hvitved
dddba3228b
Merge pull request #15867 from hvitved/dataflow/ap-limit
...
Data flow: Add `ConfigSig::accessPathLimit`
2024-03-12 14:57:51 +01:00
Henry Mercer
c325ff8a23
Mark lines of code queries as telemetry queries
...
The new file coverage metrics are available in all supported GHES
versions. This PR tags lines of code queries as telemetry queries. Lines
of code information will still be available in the SARIF file, but it
will no longer be displayed in the logging output of the CLI.
The one exception is the metric queries for Java/Kotlin that provides
separate lines of code information for Java and Kotlin. I've kept these
since separate file coverage information for languages like Java and
Kotlin is only available for GHES 3.12 and later.
2024-03-11 16:40:31 +00:00
Rasmus Wriedt Larsen
800351c7b7
Merge branch 'main' into tt-consistency
2024-03-11 14:12:09 +01:00
yoff
e6e6a4e9c8
Merge pull request #15841 from RasmusWL/missing-use-use2
...
Python: Add example of missing use-use flow
2024-03-11 13:59:57 +01:00
yoff
adbcbefaa9
Merge pull request #15551 from yoff/python/avoid-duplicate-model-inclusions
...
python: Remove `TaintStepFromSummary`
2024-03-11 13:52:20 +01:00
Tom Hvitved
da66281fef
Sync files
2024-03-11 13:02:04 +01:00
Rasmus Wriedt Larsen
4ac8dd72a7
Merge pull request #15855 from yoff/python/add-MaD-test-tuple-output
...
Python: Add test for `ReturnValue.TupleElement[n]`
2024-03-11 12:05:31 +01:00
Rasmus Wriedt Larsen
42acd9c22c
Merge pull request #15695 from github/tausbn/python-add-copy-method-as-copy-step
...
Python: Add `.copy()` method call as copy step
2024-03-11 09:43:34 +01:00
Rasmus Lerchedahl Petersen
3601773856
python: support encoding lower bound
2024-03-08 14:59:28 +01:00
Rasmus Wriedt Larsen
adf5a4b1e4
Python: Fix internal consistency failures
2024-03-08 14:13:47 +01:00
Rasmus Wriedt Larsen
87b6592dbc
Python: Accept inconsistency for missing use-use flow
...
At least until we have a proper fix
2024-03-08 13:34:26 +01:00
Rasmus Wriedt Larsen
8fe483d9d8
Python: Add example of missing use-use flow
...
(see PR for more detailed description)
2024-03-08 13:26:01 +01:00
Rasmus Lerchedahl Petersen
6d8d106d91
Python: add test for ReturnValue.TupleElement[n]
2024-03-08 11:18:51 +01:00
Tom Hvitved
24e35f6f3d
Update expected test output
2024-03-08 10:00:43 +01:00
