Taus
3d643c02be
Merge pull request #18921 from github/tausbn/python-fix-unused-global-variable-in-forward-annotation-fp
...
Python: Add support for forward references in unused var query
2025-03-13 16:37:25 +01:00
Taus
6546bb1b1d
Merge branch 'main' into tausbn/python-fix-match-pruning-logic
2025-03-06 14:37:58 +01:00
Taus
88615f427b
Python: Add support for forward declarations in unused var query
...
Fixes the false positive reported in
https://github.com/github/codeql/issues/18910
Adds a new `Annotation` class (subclass of `Expr`) which encompasses all
possible kinds of annotations in Python.
Using this, we look for string literals which are part of an annotation,
and which have the same content as the name of a (potentially) unused
global variable, and in that case we do not produce an alert.
In future, we may want to support inspecting such string literals more
deeply (e.g. to support stuff like "list[unused_var]"), but I think for
now this level of support is sufficient.
2025-03-04 14:41:45 +00:00
Taus
301ebcb12b
Python: Extend test cases for "unused global var" query
...
Adds two test cases having to do with type annotations. The first one
demonstrates that type annotations (even if they are never executed by
the Python interpreter) count as uses for the purposes of the unused
variable query. The second one demonstrates that this is _not_ the case
if all such uses are inside strings (i.e. forward declarations), as we
do not currently inspect the content of these strings.
2025-03-04 13:52:31 +00:00
Joe Farebrother
f46a2a1773
Exclude some decorators
2025-02-12 09:40:45 +00:00
Taus
918c05c538
Python: Don't prune any MatchLiteralPatterns
...
Extends the mechanism introduced in
https://github.com/github/codeql/pull/18030
to behave the same for _all_ `MatchLiteralPattern`s, not just the ones
that happen to be the constant `True` or `False`.
Co-authored-by: yoff <yoff@github.com >
2025-02-11 12:58:52 +00:00
Joe Farebrother
61d5a692fb
Refactor metaclass logic a bit, ensure lambdas are excluded
2025-02-07 21:46:30 +00:00
Joe Farebrother
e8adef18a3
Update to inline expectations + fixes
2025-02-04 14:45:59 +00:00
Joe Farebrother
aa2c84ea36
Move tests to separate folder
2025-02-04 14:45:56 +00:00
Paolo Tranquilli
4ab5650979
Python: add some more FP tests around match
2025-01-17 11:01:00 +01:00
Michael Nebel
2321ca59f6
Python: Update all test util paths to point to the new location.
2024-12-12 13:54:30 +01:00
Joe Farebrother
462be46be9
Update test output
2024-12-09 19:57:52 +00:00
Joe Farebrother
1cb01a286d
Add tests for jinja
2024-12-09 19:55:36 +00:00
Jeroen Ketema
c3ea883b11
Python: Update expected test results
2024-12-03 19:18:57 +01:00
Taus
e2530cf14f
Python: Update expected test output
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-11-19 14:10:50 +00:00
Paolo Tranquilli
147d66b587
Merge branch 'main' into redsun82/python-match-fps
2024-11-07 09:46:32 +01:00
Tom Hvitved
e5f2bbb6ec
Python: Post-processing query for inline test expectations
2024-10-29 13:35:37 +01:00
Rasmus Lerchedahl Petersen
bb78c2a67e
Python: update test expectations
2024-10-11 15:36:44 +02:00
Rasmus Lerchedahl Petersen
a4c1a622b7
Merge branch 'main' of https://github.com/github/codeql into python/add-comprehension-capture-flow
2024-10-04 14:53:03 +02:00
Rasmus Lerchedahl Petersen
a22ea6c1c8
Python: use known sanitiser
...
- also adjust test expectations in experimental
2024-09-30 14:22:17 +02:00
Rasmus Wriedt Larsen
431a1af628
Merge branch 'main' into threat-models
2024-09-26 11:44:24 +02:00
Taus
8c015b0784
Merge pull request #17305 from Kwstubbs/CORSMiddleware-Starlette
...
Python: Add Support for CORS Middlewares
2024-09-24 15:51:49 +02:00
Rasmus Wriedt Larsen
4a21a85e73
Merge branch 'main' into threat-models
2024-09-23 11:19:58 +02:00
Kevin Stubbings
7657b3e115
Fix tests
2024-09-12 21:30:32 -07:00
Rasmus Wriedt Larsen
a0b24d6194
Python: Add e2e threat-model test
2024-09-10 14:32:38 +02:00
Joe Farebrother
a8591c79c5
Update test
2024-08-28 09:11:34 +01:00
Joe Farebrother
fc24ca304d
Update tests
2024-08-27 14:18:50 +01:00
Kevin Stubbings
8bf8893307
Add support for vulnerable CORS middlewares
2024-08-26 21:30:48 -07:00
Joe Farebrother
1127b08635
Merge branch 'main' into python-cookie-concept-promote
2024-07-29 10:26:03 +01:00
Joe Farebrother
93f70b3ad9
Add unit tests
2024-07-23 10:15:23 +01:00
Joe Farebrother
8d93c3a852
Move to cwe-20
2024-07-16 16:50:08 +01:00
Joe Farebrother
983bdb92a1
Add test cases + remove redundant import
2024-07-16 16:50:00 +01:00
Paolo Tranquilli
daea773fce
Python: tests with false positives around match
2024-06-14 17:28:35 +02:00
Taus
b7b0f84e8b
Python: Handle @pytest.fixture decorations with arguments as well
...
Not the prettiest of solutions, but it seems to work well enough.
2024-06-14 15:11:25 +00:00
Paolo Tranquilli
1046d03486
Python: update unused import test case for pytest
2024-06-14 16:55:05 +02:00
Taus
2f00a0d323
Python: Also test pytest fixture factories
2024-06-14 13:11:00 +00:00
Taus
78729180ad
Python: Fix pytest fixture unused import FPs
2024-06-14 12:05:55 +00:00
Taus
f3a9c9a9dc
Python: Add tests for pytest fixture unused import FPs
2024-06-14 12:03:43 +00:00
Joe Farebrother
93f10fcf14
Add sanitizers for compiled regexes
2024-06-11 15:44:16 +01:00
Joe Farebrother
9331c2c33a
Add tests
2024-06-04 09:39:37 +01:00
Anders Schack-Mulligen
987d5712b8
Python: Accept qltest .expected file changes.
2024-05-22 15:43:49 +02:00
Joe Farebrother
01a6c5e82f
Merge pull request #16446 from joefarebrother/shared-sensitive-heuristics
...
Ruby/Python/JS/Swift: Add category of Private information to shared sensitive data heuristics
2024-05-21 09:07:13 +01:00
Rasmus Lerchedahl Petersen
a568873a8e
Python: update test expectations
2024-05-17 10:59:49 +02:00
Rasmus Lerchedahl Petersen
4378924785
Python: Example use of provenance for additional taint steps
2024-05-16 14:04:35 +02:00
Joe Farebrother
f1ab3f40f3
Add unit tests
2024-05-09 09:47:44 +01:00
Joe Farebrother
ab23d0ad23
Merge branch 'main' into python-promote-header-injection
2024-05-08 13:49:00 +01:00
Joe Farebrother
efda63d37a
Update test output
2024-05-07 10:49:55 +01:00
Joe Farebrother
0f7325ec68
Rename test directory and add comment to clarity on the purpose of splitting them.
2024-05-07 09:40:55 +01:00
Joe Farebrother
53f69d9966
Reduce query tests with cases covered by concept tests
2024-04-24 14:05:42 +01:00
Joe Farebrother
49e5f8a1a5
Add tests for instances of the header write concept
2024-04-24 14:05:40 +01:00
