Rasmus Wriedt Larsen
3bf2705668
Python: Move experimental TimingAttackAgainstHeaderValue to new dataflow API
2023-08-28 15:31:08 +02:00
Rasmus Wriedt Larsen
c88a0ccb7c
Python: Move experimental TimingAttackAgainstHash to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
a779547515
Python: Move experimental PossibleTimingAttackAgainstHash to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
8abd3430a2
Python: Move experimental TimingAttackAgainstSensitiveInfo to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
1a4e8d9464
Python: Move experimental PossibleTimingAttackAgainstSensitiveInfo to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
5fd3594f5f
Python: Move TimingAttack.qll to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
5d8329d9c8
Python: Move experimental ZipSlip to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
67cc3a3935
Python: Move experimental ReflectedXSS to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
a0d26741d0
Python: Move experimental TarSlipImprov to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
3cdd875e9f
Python: Move experimental UnsafeUnpack to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
3edb9d1011
Python: Move experimental TokenBuiltFromUUID to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
acde1920e7
Python: Move UntrustedDataToExternalAPI to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
657b1997cc
Python: Move FullServerSideRequestForgery and PartialServerSideRequestForgery to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
dbfe517555
Python: Move HardcodedCredentials to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
46322b717a
Python: Move XmlBomb to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
add1077532
Python: Move RegexInjection to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
c6caf83dfe
Python: Move PolynomialReDoS to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
4c336990e5
Python: Move XpathInjection to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
60e45335dd
Python: Move Xxe to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
4c76ca6127
Python: Move UrlRedirect to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
6f08e73dbc
Python: Move UnsafeDeserialization to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
dd074173d2
Python: Move WeakSensitiveDataHashing to new dataflow API
...
I adopted helper predicates to do the "heavy" lifting of .asPathNode1(), maybe I like this approach better... let me know what you think 😊
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
9d6b96dfd2
Python: Move CleartextStorage to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
70095446b6
Python: Move CleartextLogging to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
cca78f31ff
Python: Move PamAuthorization to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
dcd96083e8
Python: Move StackTraceExposure to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
f75e65c67d
Python: Move LogInjection to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
88cf9c99b0
Python: Move CodeInjection to new dataflow API
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
05573904a5
Python: Move LdapInjection to new dataflow API
...
We could have switched to a stateful config, but I tried to keep changes
as straight forward as possible.
2023-08-28 15:27:50 +02:00
Rasmus Wriedt Larsen
c360346e9e
Python: Move ReflectedXss to new dataflow API
2023-08-28 15:27:49 +02:00
Rasmus Wriedt Larsen
b30142c1d7
Python: Move CommandInjection to new dataflow API
2023-08-28 15:27:49 +02:00
Rasmus Wriedt Larsen
700841e9b0
Python: Move UnsafeShellCommandConstruction to new dataflow API
2023-08-28 15:27:49 +02:00
Rasmus Wriedt Larsen
d4e4e2d426
Python: Move TarSlip to new dataflow API
2023-08-28 15:27:49 +02:00
Rasmus Wriedt Larsen
e97032909a
Python: Move PathInjection to new dataflow API
2023-08-28 15:27:49 +02:00
Rasmus Wriedt Larsen
245c24077d
Python: Move SqlInjection to new dataflow API
2023-08-28 15:27:49 +02:00
yoff
2e981e330b
Merge pull request #14059 from RasmusWL/fix-loginjection-tests
...
Python: Fix stdlib sinks in LogInjection query
2023-08-28 14:44:51 +02:00
yoff
6e05246daa
Merge pull request #13935 from yoff/python/mad-on-externals
...
Python: MaD on externals
2023-08-28 14:04:54 +02:00
Rasmus Wriedt Larsen
c807ab4216
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2023-08-28 14:04:22 +02:00
yoff
826b8e6aa5
Merge pull request #14067 from RasmusWL/modern-dataflowquerytests
...
Python: Adopt tests to new `DataflowQueryTest`
2023-08-28 13:54:34 +02:00
Rasmus Wriedt Larsen
889cb7a95b
Python: Adopt tests to new DataflowQueryTest
...
Co-authored-by: Rasmus Lerchedahl Petersen <yoff@github.com >
2023-08-28 11:44:01 +02:00
Rasmus Wriedt Larsen
9c44235782
Python: Modernize DataflowQueryTest.qll
...
Co-authored-by: Rasmus Lerchedahl Petersen <yoff@github.com >
2023-08-28 11:40:41 +02:00
Rasmus Wriedt Larsen
7cba6cd1d8
Python: Update .expected files
...
Due to change in path-graph, and including LHS of assignments
2023-08-28 11:33:44 +02:00
Rasmus Wriedt Larsen
0f242475f2
Merge branch 'main' into experimental-cleanup
2023-08-28 11:01:22 +02:00
Rasmus Wriedt Larsen
0dca8a5d86
Python: Remove old points-to modeling file
...
Since all of this was ported already
2023-08-28 10:40:45 +02:00
Rasmus Wriedt Larsen
39e2b133e9
Python: Fix naming
2023-08-28 10:40:33 +02:00
Rasmus Wriedt Larsen
bf9a0dab2a
Python: Fix stdlib sinks in LogInjection query
2023-08-25 17:04:48 +02:00
Rasmus Wriedt Larsen
7852429df2
Python: Accept LogInjection .expected changes
...
I don't know how this had gone unnoticed for so long, but I realized when I tried to run this query locally
2023-08-25 17:04:40 +02:00
Rasmus Lerchedahl Petersen
ad49eada48
Python: Do not alter codeql-workspaces.yml
...
And remove the qlpack referred to therein.
Instead we rename and duplicate the extesion file
that this qlpack pointed to.
These two extension files are kept in sync by `identical-files.json`.
2023-08-25 11:46:41 +02:00
Rasmus Lerchedahl Petersen
68cd422788
Python: Fix test expectations
2023-08-25 11:27:53 +02:00
Rasmus Lerchedahl Petersen
137f9e7234
Python: Adress review comments
...
- make qldoc accurate
- fix ql4ql alert
2023-08-24 21:28:07 +02:00
