Rasmus Wriedt Larsen
|
4f47461f60
|
Python: Add requested test
|
2023-08-08 10:44:48 +02:00 |
|
Rasmus Wriedt Larsen
|
0f9ab8f53e
|
Python: Fixup tests
But notice that keyword argument is not handled yet
|
2023-07-13 13:57:08 +02:00 |
|
Alvaro Muñoz
|
ee1ba71e5d
|
add tests
|
2023-07-13 13:07:12 +02:00 |
|
Rasmus Lerchedahl Petersen
|
4b4b9bf9da
|
python: add missing summaries
For append/add:
The new results in the experimental tar slip query
show that we do not recognize the sanitisers.
|
2023-06-13 20:22:21 +02:00 |
|
Rasmus Lerchedahl Petersen
|
b72c93ff4f
|
python: remove remaining explicit taint steps
|
2023-06-13 20:22:20 +02:00 |
|
Rasmus Wriedt Larsen
|
38875ca0c7
|
Python: Improve handling of async methods
|
2021-07-22 14:17:07 +02:00 |
|
Rasmus Wriedt Larsen
|
6e9d9fcbbd
|
Python: Improve taint steps in for & iterable unpacking
These were written way before the ones in DataFlowPrivate, but
apparently didn't cover quite as much :|
|
2021-07-22 14:16:17 +02:00 |
|
Rasmus Wriedt Larsen
|
53f7633662
|
Python: Model await request.post() as MultiDictProxy
as highlight as being quite easy to do by @yoff 👍
|
2021-06-11 14:53:30 +02:00 |
|
Rasmus Wriedt Larsen
|
df67028a1d
|
Python: Model aiohttp.StreamReader
|
2021-06-11 12:06:53 +02:00 |
|
Rasmus Wriedt Larsen
|
2d31ef7016
|
Python: Fix last TODOs in aiohttp tests
|
2021-06-11 12:00:02 +02:00 |
|
Rasmus Wriedt Larsen
|
e9acea8643
|
Python: Improve multidict modeling
|
2021-06-03 11:50:49 +02:00 |
|
Rasmus Wriedt Larsen
|
2e851cd5f0
|
Python: Improve yarl.URL modeling
|
2021-06-03 11:38:15 +02:00 |
|
Rasmus Wriedt Larsen
|
c69b857662
|
Python: Add self.request as RemoteFlowSource for aiohttp View
Just like we do for Django in
7393443f8c/python/ql/src/semmle/python/frameworks/Django.qll (L1786-L1804)
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
c4b618dcf5
|
Python: Model view-classes in aiohttp.web
No taint modeling of them yet though
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
1aa222d7cc
|
Python: Add taint-test for class-based view
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
fb21bc04fa
|
Python: Add taint-steps for yarl.URL
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
72e6a1489c
|
Python: Add taint-steps for MultiDictProxy
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
dd131e6bf7
|
Python: Add taint-step for methods on aiohttp.web.Request
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
63c7fa0c2c
|
Python: aiohttp match_info should be tainted
Whoops
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
597a9dfc80
|
Python: Don't consider has_body tainted
Although it technically is, I think it belong in the section of things
that are unlikely to be exploitable
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
d953ea47d4
|
Python: Basic handling of tainted attributes in aiohttp
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
88158e7414
|
Python: Add basic model setup for aiohttp.web.Request
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
2b992a635a
|
Python: Add aiohttp taint tests
|
2021-06-03 10:55:34 +02:00 |
|
Rasmus Wriedt Larsen
|
85d9483c7b
|
Python: Add basic aiohttp tests
|
2021-06-03 10:55:33 +02:00 |
|