Joe Farebrother
eeef062f7c
Implement sinks for wsgiref + allow lists in bulk header updates + local flow
2024-04-24 14:05:39 +01:00
Joe Farebrother
9d56f3eb68
Fix qldoc formatting
2024-04-24 14:05:39 +01:00
Joe Farebrother
cf8db4e425
Update instances of experimental concept to the main one, and anotate missing experimental test results.
2024-04-24 14:05:39 +01:00
Joe Farebrother
daa31b5bb7
Add documentation
2024-04-24 14:05:38 +01:00
Joe Farebrother
8636a50190
Fix qldoc + remove deprecation from experimental concepts (as they are still used in another experimental query)
2024-04-24 14:05:38 +01:00
Joe Farebrother
fa28d94363
Added a sanitizer for replacing newlines.
2024-04-24 14:05:38 +01:00
Joe Farebrother
dbbc944f32
Correct spelling
2024-04-24 14:05:38 +01:00
Joe Farebrother
a88ad62c00
Implemented sinks for bulk header updates, and added corresponding tests.
2024-04-24 14:05:38 +01:00
Joe Farebrother
3e9341ff8a
Model class instantiation for werkzueg headers
2024-04-24 14:05:37 +01:00
Joe Farebrother
b9984beb16
Add test cases
2024-04-24 14:05:37 +01:00
Joe Farebrother
68d90918cf
Add to header write concept a specification of whether the name or value arg allows newlines.
...
Ported sink defenitions from Flask and Werzeug from experimental to main.
Removed experimental sink definitions for Django, as neither name nor value are vulnerable.
2024-04-24 14:05:37 +01:00
Joe Farebrother
25ffcb2fde
Split into customizations file
2024-04-24 14:05:37 +01:00
Joe Farebrother
6021d9238c
Move headers injection query and concept from experimental to main
2024-04-24 14:05:37 +01:00
Nick Rolfe
af72c0848e
Merge pull request #16306 from github/nickrolfe/js-sensitive
...
JS: do fewer regexp matches in SensitiveActions
2024-04-24 09:49:44 +01:00
Nick Rolfe
003d208574
JS: do fewer regexp matches in SensitiveActions
2024-04-23 15:31:38 +01:00
Anders Schack-Mulligen
b2f09949df
Merge pull request #15599 from aschackmull/dataflow/fieldflowbranchlimit-v2
...
Dataflow: update fieldFlowBranchLimit semantics
2024-04-23 10:08:05 +02:00
Rasmus Wriedt Larsen
1bc085c8f7
Python: Fixup for callGraphConfig
2024-04-23 09:42:35 +02:00
Rasmus Wriedt Larsen
bb00d6919a
Python: Move dataflow TestUtil to importable location
2024-04-23 09:40:59 +02:00
Rasmus Wriedt Larsen
e0e405bb31
Python: replace dataflow-test location in files
2024-04-23 09:40:59 +02:00
Rasmus Wriedt Larsen
ce711f7d2f
Python: Move dataflow tests out of experimental
2024-04-23 09:40:44 +02:00
Joe Farebrother
f85ee38e04
Add instance taint steps for requests
2024-04-22 16:03:39 +01:00
Joe Farebrother
88e3227ed0
Add pyramid models
2024-04-22 13:27:18 +01:00
Taus
81246cd41a
Python: Add missing QLDoc for isUnicode
2024-04-22 12:08:53 +00:00
Taus
bab461ffd1
Python: Add change note
2024-04-22 12:00:09 +00:00
Taus
58eaddf627
Python: Update all .expected files
...
I'm beginning to realise why I didn't do the `toString` overriding way
back when. Thankfully, now that all of our tests are in the same place,
this is actually not a terrible ordeal.
2024-04-22 12:00:09 +00:00
Taus
d51fcd4f2a
Python: Change Str to StringLiteral
...
As far as I can tell, this was the only occurrence of `Str` as a type
throughout the entire library.
2024-04-22 12:00:09 +00:00
Taus
b484aee39e
Python: Autoformat everything
...
Of course, `StringLiteral` being much longer than `StrConst` meant a
bunch of files changed formatting.
2024-04-22 12:00:09 +00:00
Taus
1c68c987b0
Python: Change all remaining occurrences of StrConst
...
Done using
```
git grep StrConst | xargs sed -i 's/StrConst/StringLiteral/g'
```
2024-04-22 12:00:09 +00:00
Taus
f6487d7b13
Python: Rename StrConst to StringLiteral
...
Does a few things:
- Renames `StrConst` to `StringLiteral`, and deprecates the former.
- Also deprecates `Str`.
- Adds an override of `StringLiteral::toString` making it output
`"StringLiteral"` rather than the inherited `"Str"`. This ensures that
the AST viewer shows these nodes as the former type, not the latter.
There are a large number of uses of `StrConst` in the codebase. These
will be fixed in a later commit.
2024-04-22 12:00:09 +00:00
Asger F
decd576a6b
Merge pull request #15386 from asgerf/js/graph-export
...
JS: Add library for exporting graphs as type models
2024-04-18 11:56:17 +02:00
Alexander Eyers-Taylor
da3fa22cbd
Merge pull request #16228 from github/post-release-prep/codeql-cli-2.17.1
...
Post-release preparation for codeql-cli-2.17.1
2024-04-17 11:24:34 +01:00
Asger F
93a9c62e29
Merge branch 'main' into js/graph-export
2024-04-17 09:19:59 +02:00
Taus
bf8307f78d
Python: Fix flags test
...
In 25cb52aa52
2024-04-16 21:17:34 +02:00
Asger F
3335d48154
Sync files
2024-04-16 20:26:41 +02:00
Asger F
be64daf265
Merge branch 'main' into js/graph-export
2024-04-16 20:23:33 +02:00
Taus
48e367cb11
Python: Remove test with CRLF line endings
...
These were causing `git` to behave strangely, leaving files that were
impossible to reset. In the future we should probably generate these
problematic test files on the fly, so that they don't have to exist in
the repo, but in the short run, it's easier to just remove them so as to
not block other users of the repo.
2024-04-16 17:18:20 +00:00
Cornelius Riemenschneider
4cb0695646
Merge pull request #16229 from github/criemen/rules-pkg
...
Upgrade rules_pkg to 0.10.1.
2024-04-16 18:03:00 +02:00
Taus
c647f30576
Merge pull request #16212 from github/tausbn/python-add-copy-of-internal-tests
...
Python: Add copy of internal tests
2024-04-16 16:32:31 +02:00
Cornelius Riemenschneider
6ba27dc863
Upgrade rules_pkg to 0.10.1.
2024-04-16 16:29:56 +02:00
github-actions[bot]
622e176a16
Post-release preparation for codeql-cli-2.17.1
2024-04-16 14:21:32 +00:00
github-actions[bot]
9bfe4ea90a
Release preparation for version 2.17.1
2024-04-15 17:34:47 +00:00
Taus
82057e2e46
Python: Autoformat tests
...
I guess these were never considered back when we switched to
autoformatting everything.
2024-04-15 15:27:21 +00:00
Taus
25cb52aa52
Python: Fix inefficient string comparison
2024-04-15 15:23:07 +00:00
Anders Schack-Mulligen
2f0987e980
Dataflow: Add dummy DataFlowSecondLevelScope implementations.
...
These could be an empty type, but Unit was available and it probably
doesn't matter.
2024-04-15 15:16:30 +02:00
Taus
8ec414d454
Python: Add copy of internal Python 3 tests
...
Again, mostly extractor tests, and a single library test.
2024-04-15 12:30:01 +00:00
Taus
b22b4c5b85
Python: Add copy of internal Python 2 tests
...
These are mostly extractor tests, which now live in `2/extractor-tests`,
and a single library tests that was added to the existing directory.
2024-04-15 12:26:45 +00:00
Taus
e45f6e9b24
Python: Add copy of extractor tests
...
These get to live next to the existing library and query tests, and are
run as part of both the Python 2 and Python 3 language tests.
2024-04-15 12:22:07 +00:00
Tom Hvitved
e7dc120456
Add deprecation comments
2024-04-12 13:40:15 +02:00
Tom Hvitved
ceb5b4c56e
Python: No longer use models-as-data CSV interface
2024-04-12 13:40:15 +02:00
Tom Hvitved
fdb77457b3
Sync files
2024-04-12 13:40:14 +02:00
