Arthur Baars
5044f89105
Ruby/Python re-introduce normalCharacterSequence
2022-02-25 18:43:43 +01:00
Arthur Baars
69ed121ecb
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-22 16:15:33 +01:00
Rasmus Wriedt Larsen
d2cd77aefb
Merge branch 'main' into dataflow-improvements
2022-02-21 14:49:40 +01:00
Rasmus Wriedt Larsen
2e788ea86e
Python: Accept deprecation warnings for old tests
2022-02-04 12:02:09 +01:00
Rasmus Wriedt Larsen
b2ce0fcb72
Python: Add post-update nodes to args of unresolved calls
...
Besides solving the problem with `setattr`, it also solved some old
problems with json library modeling (yay).
2022-02-04 11:51:53 +01:00
Erik Krogh Kristensen
5e23da813f
rename named-parameters to keyword-parameters
2022-02-03 23:10:39 +01:00
Erik Krogh Kristensen
3801a158a8
remove module exporst nodes from API graphs
2022-02-03 23:10:39 +01:00
Erik Krogh Kristensen
3be3da2eb6
add recursive API-graph test
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
ef5818e243
support import * in ApiGraphs
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
16774ba285
add support for named parameters in API graphs
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
095c73f1fe
redo the ApiGraph testing framework
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
66fd43fc3b
add def edge for function returns
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
d8eea7ba4c
property writes are def nodes
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
a908b219e9
more backtracking of def nodes, and lots of tests
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
038b032a43
get basic module exports to work in API-graphs
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
df9efbe778
get mimimal def nodes to work in python
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
52ca0d168b
move API-graph tests out of the experimental test folder
2022-02-03 23:10:37 +01:00
Rasmus Wriedt Larsen
f962d8e72c
Python: Move test to correct location
2022-01-28 11:33:21 +01:00
Rasmus Wriedt Larsen
4338c06b0d
Python: Support Django FileField.upload_to
2022-01-27 17:20:16 +01:00
Rasmus Wriedt Larsen
301318020f
Merge pull request #7455 from haby0/py/add-shutil-module-path-injection-sinks
...
Python: Add shutil module sinks for path injection query
2022-01-24 20:06:36 +01:00
Erik Krogh Kristensen
ddfc3bc00f
use set literals instead of big disjunctions
2022-01-21 11:46:33 +01:00
Rasmus Wriedt Larsen
95e935e9c1
Python: Support SQLAlchemy scoped_session
2022-01-18 14:34:31 +01:00
haby0
759ec31508
Delete shutil_path_injection.py file
2022-01-06 21:38:35 +08:00
haby0
05b0daa0b7
Add the test of shutil module in FileSystemAccess.py
2022-01-06 14:14:42 +08:00
Rasmus Wriedt Larsen
6ce1524192
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-12-16 15:19:37 +01:00
Rasmus Wriedt Larsen
f8fc583af3
Python: client request: getUrl => getAUrlPart
...
I think `getUrl` is a bit too misleading, since from the name, I would
only ever expect ONE result for one request being made.
`getAUrlPart` captures that there could be multiple results, and that
they might not constitute a whole URl.
Which is the same naming I used when I tried to model this a long time ago
a80860cdc6/python/ql/lib/semmle/python/web/Http.qll (L102-L111)
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
6f81685f48
Python: Add modeling of http.client.HTTPResponse
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
a5bae30d81
Python: Add tests of http.client.HTTPResponse
2021-12-15 20:39:46 +01:00
Rasmus Wriedt Larsen
cf2ee0672f
Python: Model requests Responses
2021-12-13 15:09:46 +01:00
Rasmus Wriedt Larsen
35cba17642
Python: Consider taint of client http requests
2021-12-13 14:56:16 +01:00
Rasmus Wriedt Larsen
b68d280129
Python: Add modeling of requests
2021-12-13 14:56:16 +01:00
Rasmus Wriedt Larsen
1ff56d5143
Python: Add tests of requests
...
Also adjusts test slightly. Writing
`clientRequestDisablesCertValidation=False` to mean that certificate
validation was disabled by the `False` expression is just confusing, as
it easily reads as _certificate validate was NOT disabled_ :|
The new one ties to each request that is being made, which seems like
the right setup.
2021-12-13 14:07:32 +01:00
yoff
d8857c7ce8
Merge pull request #7246 from tausbn/python/import-star-flow
...
Python: Support flow through `import *`
2021-12-10 16:34:32 +01:00
yoff
8e11c2c476
Merge pull request #7259 from RasmusWL/even-more-path-injection-sinks
...
Python: Add more path-injection sinks from `os` and `tempfile` modules
2021-12-09 14:46:41 +01:00
Nick Rolfe
05415768c9
Merge remote-tracking branch 'origin/main' into nickrolfe/regexp_g_anchor
2021-12-02 12:07:13 +00:00
yoff
f10f053c36
Merge pull request #7228 from RasmusWL/fastapi-improvements
...
Python: FastAPI improvements
2021-12-02 12:58:53 +01:00
yoff
19802ccb73
Merge pull request #7046 from RasmusWL/django-own-json-response
...
Python: Add test with custom django json response (FP)
2021-11-29 16:05:20 +01:00
Rasmus Wriedt Larsen
cbd7434a7e
Python: Add modeling of tempfile module
2021-11-29 15:08:36 +01:00
Rasmus Wriedt Larsen
b68538376c
Python: Add tests of tempfile module
2021-11-29 15:08:36 +01:00
Rasmus Wriedt Larsen
58f92764f7
Python: Model more file access from os module
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
e79b8f3e23
Python: Treat os.exec*, os.spawn*, and os.posix_spawn* as FileSystemAccess
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
d2d5cce787
Python: Recognize keyword arguments for os.*spawn* calls
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
14590436f9
Python: Expand tests for os.exec*, os.spawn*, and os.posix_spawn*
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
50d3592ad3
Python: Add more complete tests of os module
...
I went through https://docs.python.org/3.10/library/os.html in order,
and added all the functions that works on paths.
`lstat` and `statvfs` were already modeled, but did not have any tests.
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
a91208fd2c
Python: Fix kwarg modeling for os.path.isdir
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
36f14b31bc
Python: Add explicit tests for kwargs
...
I also renamed the arguments to match what the keyword argument is
called. It doesn't matter too much for these specific tests, but for the
tests I'm about to add, it makes things a lot easier to get an overview
of.
Oh, and a test failure :O
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
82602014ad
Python: Minor refactor to use os.path.<func>
...
Since that's the idiomatic way to use this module
2021-11-29 14:54:02 +01:00
Taus
09a11f4166
Python: Update ImpliesDataflow test
...
Turns out that now we can resolve the convoluted imports. Hurray!
2021-11-26 14:47:25 +00:00
Rasmus Wriedt Larsen
7dde52ced2
Merge pull request #7131 from RasmusWL/wsgiref.simple_server
...
Python: Model `wsgiref.simple_server` applications
2021-11-24 14:22:23 +01:00
Rasmus Wriedt Larsen
1411804e58
Python: Allow custom fastapi.APIRouter subclasses
2021-11-24 13:46:38 +01:00
