hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 09:43:15 +01:00
Code Issues Packages Projects Releases Wiki Activity
81,788 Commits 1,672 Branches 157 Tags
codeql-cli-2.22.4
Commit Graph

9380 Commits

Author SHA1 Message Date
Taus
cb1efa915e Python: Add Flask response model 2023-12-08 11:27:50 +01:00
Taus
7b1c6b0dd6 Python: Add Django response models 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
d622d873d9 Python: Enable auto-model for Django Model 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
bff7ae20e1 Python: Enable auto-model for cgi.FieldStorage 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
1e69762242 Python: More import fixes 
:thinkies: turns out that .getASubclass*() had to be applied everywhere...
 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
af6c5ccead Python: Enable auto-model BaseHttpRequestHandler 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
ba19f95d3e Python: Improve SelfRefMixin 
This is important to model mixins correctly, for example when they help
handle incoming requests, and therefore need to know that `self.kwargs`
contains data controlled by a user.
 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
dfdb66f723 Python: Allow any results.bqrs file 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
77a4d81a08 Python: Improve import * handling 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
ec384649e8 Python: Automodel for WSGIServer 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
eb97a7989f Python: Automodel for tornado 2023-12-08 11:27:50 +01:00
Rasmus Wriedt Larsen
d6fec9e4a7 Python: Make Django use auto-modeling 
Ooops
 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
734dcb156a Python: Sort MaD rows 
(makes future diffing much easier)
 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
1c43d11c54 FIXME already fixed 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
5e98ff48ff Python: Add script to process results from MRVA (bqrs files) 
Also makes `empty.model.yml` empty once again
 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
451a210916 Python: Remove query predicate annotation 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
b1f5dea70c Python: Add query metadata 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
b66dd23a68 Python: Streamline what modules to allow for now 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
ba0a5b1c23 Python: Adjust test-code predicate 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
bb3ced02e3 Python: Improve docs/names around already modeled classes 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
f06bbd2263 WIP rest of modeling done so far 2023-12-08 11:27:49 +01:00
Rasmus Wriedt Larsen
2f17d2f3ac WIP: Flask View class modeling for restplus 
Based on some DBs I had that contained dependencies
 2023-12-08 11:27:49 +01:00
amammad
5795c72a99 added inline tests 2023-12-07 14:04:33 +01:00
amammad
6ebdae3bab Merge branch 'main' into amammad-python-bombs 2023-12-07 13:50:20 +01:00
amammad
2d0067d618 fix some qldocs, change Sink extenstion model, deduct some not necessarily checks :) 2023-12-07 13:45:28 +01:00
github-actions[bot]
92af5f5386 Post-release preparation for codeql-cli-2.15.4 2023-12-06 22:59:22 +00:00
Rasmus Lerchedahl Petersen
263c0aade7 Python: adjust test expectations 
mostly removing of nodes from the graph.
One result lost:
```
check("submodule.submodule_attr", submodule.submodule_attr, "submodule_attr", globals()) #$ MISSING:prints=submodule_attr
```
 2023-12-06 23:00:51 +01:00
github-actions[bot]
c04457e9e7 Release preparation for version 2.15.4 2023-12-06 21:11:50 +00:00
Rasmus Lerchedahl Petersen
8c5ca3f564 Python: remove control flow nodes 
for module entry definitions from the dataflow graph.
 2023-12-06 21:47:03 +01:00
Rasmus Lerchedahl Petersen
9e1c818db6 Python: address review comments 2023-12-04 17:49:26 +01:00
yoff
f5c176bd12 Apply suggestions from code review 
Co-authored-by: Taus <tausbn@github.com>
 2023-12-04 17:41:00 +01:00
Rasmus Wriedt Larsen
c952f6a648 Python: Update rest of tests to new dataflow lib 
I had missed these originally, since I had just fixed the ones that were
highlighted in the actions logs, thinking they had covered everything :(
 2023-12-04 14:49:40 +01:00
Rasmus Lerchedahl Petersen
e091ae84ab Merge branch 'main' of https://github.com/github/codeql into python/remove-ssa-nodes-from-dataflow-graph 2023-12-04 14:05:40 +01:00
Rasmus Wriedt Larsen
2fed0adde7 Merge pull request #8457 from RasmusWL/add-dataflow-consistency-query 
Python: Add dataflow consistency query
 2023-12-04 12:50:46 +01:00
Rasmus Wriedt Larsen
4dd3ea3798 Python: Update tests to new dataflow lib 
Avoids some deprecation warnings :)
 2023-12-04 12:36:57 +01:00
Anders Schack-Mulligen
67f0529cda Dataflow: Sync. 2023-12-04 12:36:57 +01:00
Taus
4ef1fe49e3 Merge pull request #14918 from github/tausbn/python-support-tarslip-extraction-filters 
Python: Add support for extraction filters
 2023-11-30 22:55:09 +01:00
Taus
6e279183d9 Python: Remove unused unsafeFilter predicates 2023-11-28 13:54:17 +00:00
Taus
91643ad08f Python: Update hasUnsafeFilter to use API graph 
This will probably break the tests in the short run. I'll fix the remaining issues in a follow-up commit.

Co-authored-by: Rasmus Wriedt Larsen <rasmuswl@github.com>
 2023-11-28 14:48:26 +01:00
Rasmus Wriedt Larsen
2c10160ad4 Python: Highlight we actually want post-update nodes for *args and **kwargs arguments 2023-11-28 14:07:03 +01:00
Rasmus Wriedt Larsen
02f2031239 Python: Ensure other call for super().foo 2023-11-28 14:04:51 +01:00
Rasmus Wriedt Larsen
3c82653b63 Python: Highlight missing post-update flow for *args and **kwargs 2023-11-28 10:59:48 +01:00
Taus
ad1a86879e Python: Add change note 2023-11-27 14:39:32 +00:00
Taus
95e9284d08 Python: Add support for extraction filters 
Adds support for extraction filters as defined in
https://peps.python.org/pep-0706/
and implemented in Python 3.12.

By my reading, setting the filter to `'data'` or `'tar'` is probably
safe, whereas `'fully_trusted'` or the default (which is the same as
`None`) is not.

For now, I have just added this modelling to the tarslip query. We could
also share it with the modelling of `shutil.unpack_archive` (which has also
gained a `filter` argument), but it was unclear to me where we should put
this modelling in that case. Perhaps the best solution would be to merge
the experimental `py/tarslip-extended` query into the existing query (in
which case the current location is perhaps not too bad).
 2023-11-27 14:11:17 +00:00
Rasmus Wriedt Larsen
4e0cca9a41 Merge pull request #14353 from GeekMasher/py-restframework 
Python: support `*args` and `**kwargs` in request handlers
 2023-11-23 14:04:36 +01:00
Rasmus Wriedt Larsen
d056706af5 Merge pull request #14725 from RasmusWL/re-modeling 
Python: Add taint-flow modeling for `re` module
 2023-11-23 11:35:36 +01:00
Rasmus Wriedt Larsen
3d46129bbf Python: Remove intermediary steps from taint-test 
These were leftovers from old way of propagating taint
 2023-11-23 10:40:25 +01:00
Rasmus Wriedt Larsen
4a98ed903e Python: Fix consistency for bound-methods used in list-comp 2023-11-22 14:07:40 +01:00
Rasmus Wriedt Larsen
67b1414177 Python: Highlight even more cases for multipleArgumentCallExclude 2023-11-22 11:25:23 +01:00
Rasmus Wriedt Larsen
30891ca4aa Merge pull request #14861 from yoff/python/demonstrate-def-use-explosion 
Python: test demonstrating the need for phi nodes
 2023-11-22 09:57:10 +01:00