Rasmus Lerchedahl Petersen
768d866e72
python: model urllib.parse.parse_qs
2024-10-03 12:20:40 +02:00
Rasmus Lerchedahl Petersen
5c68bad2f1
Python: add comments
2024-10-03 12:17:59 +02:00
yoff
56d0affe38
Update python/ql/lib/semmle/python/frameworks/Stdlib.model.yml
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-10-03 10:18:25 +02:00
Rasmus Lerchedahl Petersen
6d486f9931
Python: move change note to the right place
2024-10-03 10:15:55 +02:00
Rasmus Lerchedahl Petersen
9e808c17af
Python: add change note
2024-10-03 10:09:59 +02:00
Rasmus Lerchedahl Petersen
0dc036abd1
Python: Allow type tracking through comprehensions
...
- the subscript operator is extended to comprehensions
- the capture jump-step is extended to work for the functions generated inside comprehensions
2024-10-03 09:31:02 +02:00
Rasmus Lerchedahl Petersen
315890680c
Python: dict only has one positional argument
2024-10-01 16:48:43 +02:00
Rasmus Lerchedahl Petersen
38b1eb7c71
Python: just use ListElementContent for iterables
2024-10-01 16:24:15 +02:00
Rasmus Lerchedahl Petersen
f39dc41903
Python: use imprecise content in cp
...
We had accidentally used precise content leadingto blowup
2024-10-01 13:53:25 +02:00
Rasmus Lerchedahl Petersen
cef8744a37
Python: consolidate models in one file
2024-10-01 12:56:21 +02:00
yoff
7816f34d75
Merge branch 'main' into stdlib-optparse
2024-10-01 12:48:09 +02:00
Rasmus Lerchedahl Petersen
64890a1a6b
Python: valid change note
2024-10-01 12:37:45 +02:00
yoff
2b6aab108d
Update python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
...
Co-authored-by: Taus <tausbn@github.com >
2024-10-01 12:36:20 +02:00
yoff
2eac11edd6
Update python/ql/lib/change-notes/2024-09-24-std-lib-models.md
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-10-01 11:47:42 +02:00
Rasmus Lerchedahl Petersen
e0a3c8a1c4
Python: add change note
2024-10-01 10:12:39 +02:00
Rasmus Lerchedahl Petersen
9357762e06
Python: remove superflous code
...
This is handled by parameter-argument matching
2024-10-01 00:03:04 +02:00
github-actions[bot]
e97878ed63
Post-release preparation for codeql-cli-2.19.1
2024-09-30 19:49:00 +00:00
github-actions[bot]
455c8c5953
Release preparation for version 2.19.1
2024-09-30 17:59:48 +00:00
Rasmus Lerchedahl Petersen
dacc0ab8fe
Python: docs and a simplification
2024-09-30 16:06:30 +02:00
Rasmus Lerchedahl Petersen
438e664116
Python: add missing qldoc
...
More doc is needed, but this should turn the tests green
2024-09-30 15:43:19 +02:00
Rasmus Lerchedahl Petersen
7392d186bc
Python: use yield step also for taint
...
Using the comprehension store step meant that all comprehensions would receive taint.
This because comprehension flow now goes via a callable, meaning they share the return node.
2024-09-30 13:49:01 +02:00
Rasmus Lerchedahl Petersen
ded39749a7
Python: allow comp arg as argumentnode
2024-09-30 13:02:20 +02:00
Rasmus Lerchedahl Petersen
3ef05a628f
Python: add location to node
2024-09-30 11:56:36 +02:00
Rasmus Lerchedahl Petersen
310819d392
Python: fix dataflow inconsistencies
...
- adjust scope of argument, the argument is outside the called function
- add missing post-update nodes for the new arguments
2024-09-30 10:31:36 +02:00
Rasmus Lerchedahl Petersen
d4ea62edec
Python: flow through yield
...
- add yield as a dataflow return
- replace comprehension store step
with a store step to the yield
2024-09-30 09:01:29 +02:00
Rasmus Lerchedahl Petersen
72530a8312
Python: use synthetic node for comprehension capture argument
...
We used to use the CfgNode for the comprehension itself.
In cases where that is also an argument, say
```python
",".join([x for x in l])
```
that would be an argument to two different calls causing a dataflow consistency violation.
2024-09-27 12:15:03 +02:00
Rasmus Lerchedahl Petersen
294092b671
Python: use comprehension function argument
...
For a comprehension `[x for x in l]
- `l` is now a legal argument (in DataFlowPublic)
- `l` is the argument of the comprehension function (in DataFlowDispatch)
- the parameter of the comprehension function is being read rather than `l` (in IterableUnpacking)
Thus the read that used to cross callable boundaries is now split into a arg-param edge and a read from that param.
2024-09-27 09:44:39 +02:00
Rasmus Wriedt Larsen
431a1af628
Merge branch 'main' into threat-models
2024-09-26 11:44:24 +02:00
Rasmus Lerchedahl Petersen
fc2dc28f87
python: capture flow through comprehensions
...
- add comprehension functions as `DataFlowCallable`s
- add comprehension call as `DataFlowCall`
- create capture argument node for comprehension calls
2024-09-25 10:02:31 +02:00
Rasmus Lerchedahl Petersen
112e7c95fa
Python: all dict constructor args are relevant
2024-09-24 20:58:59 +02:00
yoff
e7f9b5bbbc
Merge branch 'main' into stdlib-optparse
2024-09-24 20:24:00 +02:00
Rasmus Lerchedahl Petersen
f95926e1a8
Python: add change note
2024-09-24 20:23:39 +02:00
Taus
8c015b0784
Merge pull request #17305 from Kwstubbs/CORSMiddleware-Starlette
...
Python: Add Support for CORS Middlewares
2024-09-24 15:51:49 +02:00
Kevin Stubbings
02a664319a
formatting
2024-09-23 15:10:25 -07:00
Kevin Stubbings
e6b775422d
Remove redundant imports
2024-09-23 15:08:24 -07:00
Kevin Stubbings
05765c4284
Formatting
2024-09-23 14:51:50 -07:00
Kevin Stubbings
5d12f7bd30
Pre formatting Bottle tests
2024-09-23 14:37:22 -07:00
Chuan-kai Lin
1cd8af54f2
Merge pull request #17190 from github/cklin/diff-informed-java-queries
...
Java: add support for alert location restrictions
2024-09-23 08:39:24 -07:00
Joe Farebrother
48f9e0efe5
Adress review comments: Add missing deprecation + additional test case
2024-09-23 10:57:04 +01:00
Rasmus Wriedt Larsen
535db98823
Python: Minor simplification of ActiveThreatModelSource
...
Co-authored-by: Taus <tausbn@github.com >
2024-09-23 11:21:55 +02:00
Rasmus Wriedt Larsen
4a21a85e73
Merge branch 'main' into threat-models
2024-09-23 11:19:58 +02:00
Joe Farebrother
7aa2816570
Add changenote
2024-09-20 15:19:54 +01:00
Anders Schack-Mulligen
3a1e50dcf9
Dataflow: Simplify diff-informed implementation and tweak flag name.
2024-09-20 07:07:10 -07:00
Joe Farebrother
3001a570b2
Replace uses of StringConstCompare
2024-09-20 14:47:22 +01:00
Joe Farebrother
164cf27e67
Add additional constant checks to constant barrier gaurd
2024-09-20 12:46:10 +01:00
github-actions[bot]
79be301984
Post-release preparation for codeql-cli-2.19.0
2024-09-16 14:09:32 +00:00
github-actions[bot]
acdafd9646
Release preparation for version 2.19.0
2024-09-16 10:56:10 +00:00
Dave Bartolomeo
485fc04029
Initial merge from main
2024-09-15 08:55:31 -04:00
Kevin Stubbings
c30332818f
Reorder and rename
2024-09-13 00:41:55 -07:00
Kevin Stubbings
03f375e436
missed some
2024-09-13 00:21:33 -07:00
