Taus
6f2cfa0ba8
Python: Update CopySummary to use getMaDRepresentation
...
Demonstrates the somewhat more ergonomic way to use
`getMaDRepresentation` when specifying summaries.
Note that this slightly extends the previous definition, in that
`DictionaryContentAny` is now _also_ propagated by a call to the
`.copy()` method, but I think this is correct.
2024-10-15 11:52:37 +00:00
Taus
ce914019c5
Python: Add getMaDRepresentation()
...
This adds a convenient way of getting the Models-as-Data representation
of a particular type of content. This avoids repeating the same
construction over and over in our various summaries. Currently this is
defined for all types of content except the captured variable content,
which to my knowledge doesn't have any representation in Models-as-Data.
2024-10-15 11:50:38 +00:00
Taus
d905010aa8
Python: Add change note
2024-10-15 11:22:34 +00:00
Taus
8630f57710
Python: Add up-/downgrade scripts
...
Adds up- and downgrade scripts for the support for type parameter
defaults.
In the upgrade direction we do nothing, matching the behaviour of
`getDefault` not having a result for old databases.
In the downgrade direction, we explicitly remove the relevant child (via
the `py_exprs` database relation) for `TypeVar`, `TypeVarTuple`, and
`ParamSpec` parameters.
2024-10-15 11:22:33 +00:00
Taus
182a192cc0
Python: Regenerate dbscheme/AST
2024-10-15 11:22:33 +00:00
Arthur Baars
9ba8045837
Fix typos in changelog entries
2024-10-15 11:06:20 +00:00
github-actions[bot]
255f55cf1a
Release preparation for version 2.19.2
2024-10-15 10:29:25 +00:00
Rasmus Lerchedahl Petersen
6bd46148e7
Python: add change note
2024-10-09 16:27:52 +02:00
Rasmus Lerchedahl Petersen
0ac4a10345
Python: model that finditer returns iterable of re.Match objects
2024-10-09 12:42:38 +02:00
Rasmus Lerchedahl Petersen
494b8bd7e1
python: model string property of resultof finditer
2024-10-09 12:40:47 +02:00
yoff
1f1b1b7aab
Merge pull request #17653 from yoff/python/typetracking-through-comprehensions
2024-10-08 19:39:21 +02:00
Rasmus Lerchedahl Petersen
6f5b949ec8
Python: adjust test expectations
...
note that we do retain precision in
`test_dict_from_keyword()`
2024-10-04 15:30:02 +02:00
Rasmus Lerchedahl Petersen
a4c1a622b7
Merge branch 'main' of https://github.com/github/codeql into python/add-comprehension-capture-flow
2024-10-04 14:53:03 +02:00
yoff
306b087b6e
Merge pull request #17566 from yoff/python/dict-can-take-multiple-args
...
Python: All dict constructor args are relevant
2024-10-04 14:30:10 +02:00
Rasmus Lerchedahl Petersen
977767b0d6
Python: comment around dictionary comprehensions
2024-10-04 14:14:30 +02:00
Rasmus Lerchedahl Petersen
201c4aad13
Python: add comment
2024-10-04 14:09:33 +02:00
yoff
c064a9e092
Update python/ql/lib/semmle/python/frameworks/Stdlib.qll
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-10-04 14:01:18 +02:00
Rasmus Lerchedahl Petersen
768d866e72
python: model urllib.parse.parse_qs
2024-10-03 12:20:40 +02:00
Rasmus Lerchedahl Petersen
5c68bad2f1
Python: add comments
2024-10-03 12:17:59 +02:00
yoff
56d0affe38
Update python/ql/lib/semmle/python/frameworks/Stdlib.model.yml
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-10-03 10:18:25 +02:00
Rasmus Lerchedahl Petersen
6d486f9931
Python: move change note to the right place
2024-10-03 10:15:55 +02:00
Rasmus Lerchedahl Petersen
9e808c17af
Python: add change note
2024-10-03 10:09:59 +02:00
Rasmus Lerchedahl Petersen
0dc036abd1
Python: Allow type tracking through comprehensions
...
- the subscript operator is extended to comprehensions
- the capture jump-step is extended to work for the functions generated inside comprehensions
2024-10-03 09:31:02 +02:00
Rasmus Lerchedahl Petersen
315890680c
Python: dict only has one positional argument
2024-10-01 16:48:43 +02:00
Rasmus Lerchedahl Petersen
38b1eb7c71
Python: just use ListElementContent for iterables
2024-10-01 16:24:15 +02:00
Rasmus Lerchedahl Petersen
f39dc41903
Python: use imprecise content in cp
...
We had accidentally used precise content leadingto blowup
2024-10-01 13:53:25 +02:00
Rasmus Lerchedahl Petersen
cef8744a37
Python: consolidate models in one file
2024-10-01 12:56:21 +02:00
yoff
7816f34d75
Merge branch 'main' into stdlib-optparse
2024-10-01 12:48:09 +02:00
Rasmus Lerchedahl Petersen
64890a1a6b
Python: valid change note
2024-10-01 12:37:45 +02:00
yoff
2b6aab108d
Update python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
...
Co-authored-by: Taus <tausbn@github.com >
2024-10-01 12:36:20 +02:00
yoff
2eac11edd6
Update python/ql/lib/change-notes/2024-09-24-std-lib-models.md
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-10-01 11:47:42 +02:00
Rasmus Lerchedahl Petersen
e0a3c8a1c4
Python: add change note
2024-10-01 10:12:39 +02:00
Rasmus Lerchedahl Petersen
9357762e06
Python: remove superflous code
...
This is handled by parameter-argument matching
2024-10-01 00:03:04 +02:00
github-actions[bot]
e97878ed63
Post-release preparation for codeql-cli-2.19.1
2024-09-30 19:49:00 +00:00
github-actions[bot]
455c8c5953
Release preparation for version 2.19.1
2024-09-30 17:59:48 +00:00
Rasmus Lerchedahl Petersen
dacc0ab8fe
Python: docs and a simplification
2024-09-30 16:06:30 +02:00
Rasmus Lerchedahl Petersen
438e664116
Python: add missing qldoc
...
More doc is needed, but this should turn the tests green
2024-09-30 15:43:19 +02:00
Rasmus Lerchedahl Petersen
7392d186bc
Python: use yield step also for taint
...
Using the comprehension store step meant that all comprehensions would receive taint.
This because comprehension flow now goes via a callable, meaning they share the return node.
2024-09-30 13:49:01 +02:00
Rasmus Lerchedahl Petersen
ded39749a7
Python: allow comp arg as argumentnode
2024-09-30 13:02:20 +02:00
Rasmus Lerchedahl Petersen
3ef05a628f
Python: add location to node
2024-09-30 11:56:36 +02:00
Rasmus Lerchedahl Petersen
310819d392
Python: fix dataflow inconsistencies
...
- adjust scope of argument, the argument is outside the called function
- add missing post-update nodes for the new arguments
2024-09-30 10:31:36 +02:00
Rasmus Lerchedahl Petersen
d4ea62edec
Python: flow through yield
...
- add yield as a dataflow return
- replace comprehension store step
with a store step to the yield
2024-09-30 09:01:29 +02:00
Rasmus Lerchedahl Petersen
72530a8312
Python: use synthetic node for comprehension capture argument
...
We used to use the CfgNode for the comprehension itself.
In cases where that is also an argument, say
```python
",".join([x for x in l])
```
that would be an argument to two different calls causing a dataflow consistency violation.
2024-09-27 12:15:03 +02:00
Rasmus Lerchedahl Petersen
294092b671
Python: use comprehension function argument
...
For a comprehension `[x for x in l]
- `l` is now a legal argument (in DataFlowPublic)
- `l` is the argument of the comprehension function (in DataFlowDispatch)
- the parameter of the comprehension function is being read rather than `l` (in IterableUnpacking)
Thus the read that used to cross callable boundaries is now split into a arg-param edge and a read from that param.
2024-09-27 09:44:39 +02:00
Rasmus Wriedt Larsen
431a1af628
Merge branch 'main' into threat-models
2024-09-26 11:44:24 +02:00
Rasmus Lerchedahl Petersen
fc2dc28f87
python: capture flow through comprehensions
...
- add comprehension functions as `DataFlowCallable`s
- add comprehension call as `DataFlowCall`
- create capture argument node for comprehension calls
2024-09-25 10:02:31 +02:00
Rasmus Lerchedahl Petersen
112e7c95fa
Python: all dict constructor args are relevant
2024-09-24 20:58:59 +02:00
yoff
e7f9b5bbbc
Merge branch 'main' into stdlib-optparse
2024-09-24 20:24:00 +02:00
Rasmus Lerchedahl Petersen
f95926e1a8
Python: add change note
2024-09-24 20:23:39 +02:00
Taus
8c015b0784
Merge pull request #17305 from Kwstubbs/CORSMiddleware-Starlette
...
Python: Add Support for CORS Middlewares
2024-09-24 15:51:49 +02:00
