Commit Graph

4008 Commits

Author SHA1 Message Date
Mark Shannon
e21a863db9 Python points-to: Update sanity check. 2019-04-26 16:21:46 +01:00
Mark Shannon
03159bb31c Python points-to: Track 'unknown' value through simple iteration. 2019-04-26 16:21:46 +01:00
Mark Shannon
662aedcb13 Python points-to: Fix up module attributes and classmethods. 2019-04-26 16:21:46 +01:00
Mark Shannon
ef0a6b6713 Python points-to: Rationalize handling of expressions and conditions. Tweak API to be a bit more backward-compatible. 2019-04-26 16:21:46 +01:00
Mark Shannon
e3ed8c6abf Python points-to: Simplify handling of booleans and comparisons. 2019-04-26 16:21:45 +01:00
Mark Shannon
39b9723054 Python: Add support for bound-methods. 2019-04-26 16:21:45 +01:00
Mark Shannon
bf692f4aad Python: Add better class support, including inheritance. 2019-04-26 16:21:45 +01:00
Mark Shannon
5a46df2132 Python: Add ADTs for ints and strings. Add some global data-flow. 2019-04-26 16:21:45 +01:00
Mark Shannon
051683fadf Python: Break-up internal object modules. 2019-04-26 16:21:45 +01:00
Mark Shannon
c48d63f2ec Python: First draft of ADT based objects and attendant points-to. 2019-04-26 16:21:45 +01:00
Taus
7d2c17f27c Merge pull request #1271 from markshannon/python-fix-fp-http-prefix
Python: Fix false positive in 'Incomplete URL substring sanitization' query
2019-04-26 15:23:04 +02:00
Mark Shannon
28799441af Python: Fix false positive in 'Incomplete URL substring sanitization' query. 2019-04-25 18:11:01 +01:00
Mark Shannon
6a9bb5c5c9 Add test confirming correct handling of zope.interface.Interface in query. 2019-04-23 12:52:50 +01:00
Esben Sparre Andreasen
c80ee3df01 Mergeback: rc/1.20 into Semmle/master 2019-04-16 08:46:15 +02:00
Mark Shannon
d6ba729dce Python: Fix semantic merge conflict between #1206 and #1240. 2019-04-12 12:32:41 +01:00
Taus
707b73c3d0 Merge pull request #1240 from markshannon/python-avoid-ssa-defns-in-tests
Python: Remove callsite refinement ESSA definition in tests
2019-04-12 12:05:40 +02:00
Taus
607b5fb077 Merge pull request #1206 from markshannon/python-taint-flow-classless
Python taint-tracking: Better flow for "generic" taint.
2019-04-12 11:54:52 +02:00
Mark Shannon
ca6e03f597 Python: Remove callsite refinement ESSA definition when call in a test defining a pi-node. 2019-04-11 16:08:29 +01:00
Mark Shannon
df2000ea8e Python: Fix up dataflow configuration to act as expected. Keep undocumented for now. 2019-04-05 09:05:13 +01:00
Mark Shannon
2ba122373a Merge pull request #1128 from taus-semmle/python-paramiko-unsafe-host-key-validation
Python: Add query for insecure SSH host key policies in Paramiko.
2019-04-04 16:57:13 +01:00
Mark Shannon
e2a3d91a7d Python taint-tracking: If taint has no class allow it flow through both branches of isinstance test. 2019-04-04 14:29:34 +01:00
Jonas Jensen
eae2fe5a16 Merge pull request #1190 from Semmle/rc/1.20
Merge 1.20 into master
2019-04-02 15:29:12 +02:00
Arthur Baars
ba7fdddafb Change @kind to 'table' for test and sanity checks queries that don't select problems 2019-04-01 11:20:12 +02:00
Taus
702fc80054 Merge pull request #1166 from Semmle/rc/1.20
Merge rc/1.20 into master
2019-03-26 13:09:40 +01:00
Mark Shannon
2edde1fed8 Python taint-tracking. Handle early exit and 'not' correctly for 'falsey' taints. 2019-03-22 11:58:23 +00:00
Taus
36c7a8430a Merge pull request #1112 from markshannon/python-forward-compatible-points-to-extensions
Python: Allow points-to extensions to specify just the object.
2019-03-21 19:20:44 +01:00
Taus Brock-Nannestad
5eb63ae048 Fix false positive and add test. 2019-03-21 14:10:05 +01:00
Taus Brock-Nannestad
9cb35a8ca9 Use correct named argument for ssl.SSLContext. 2019-03-21 14:09:25 +01:00
Taus Brock-Nannestad
c7c6c83627 Address review comments. 2019-03-19 15:44:11 +01:00
Max Schaefer
6fbf487524 Merge remote-tracking branch 'upstream/rc/1.20' into mergeback-2019-03-19 2019-03-19 14:09:03 +00:00
Taus Brock-Nannestad
52278b25d9 Python: Add query for insecure SSH host key policies in Paramiko. 2019-03-18 16:45:54 +01:00
Mark Shannon
7213b72b9b Python: Allow points-to extensions to specify just the object, and infer the class. Allows points-to extensions to more easily compatible across versions. 2019-03-15 11:09:46 +00:00
Taus
af1c502b11 Merge pull request #1098 from markshannon/python-2-print
Python: Don't report Python 2 print statements as having no effect.
2019-03-15 11:40:32 +01:00
Taus
eec59c2c7d Merge pull request #1092 from markshannon/python-fix-2-tests
Python: Update python-2 specific tests for new parser/tokenizer.
2019-03-15 11:38:34 +01:00
Mark Shannon
e9a45268a8 Python: Don't report Python 2 print statements as having no effect. 2019-03-13 10:08:07 +00:00
Mark Shannon
ccd18b6c67 Python: Update python-2 specific tests for new parser/tokenizer. 2019-03-12 17:53:50 +00:00
Mark Shannon
28c20a3216 Python: Fix false positive for redundant comparison query when a complex comparison is negated. 2019-03-12 15:07:49 +00:00
Tom Hvitved
c5450128be Merge branch 'rc/1.20' into merge-rc 2019-03-12 09:14:38 +01:00
Mark Shannon
ef1c08e351 Python: Fix up OsGuard class. 2019-03-07 14:21:03 +00:00
Mark Shannon
38a5fb715a Python: Avoid cross-talk between unrelated sources in py/stack-trace-exposure query. 2019-03-05 16:52:28 +00:00
Mark Shannon
94190e76aa Python: Update py/modification-of-default-value to account for truthiness of default value. 2019-03-01 12:01:39 +00:00
Mark Shannon
ebd9bc3cb5 Python: Improve taint tracking to account for truthiness of the taint kind. 2019-03-01 11:24:07 +00:00
Taus Brock-Nannestad
64e6974aac Merge branch 'master' into python-mutable-default-with-flow 2019-03-01 11:10:56 +01:00
Mark Shannon
91a1cc9f0b Python: Add cherrypy handler function return values as taint sinks. 2019-02-28 15:25:13 +00:00
Mark Shannon
6c82be8bda Python: CherryPy web framework support -- requests. 2019-02-28 15:24:58 +00:00
Taus
b8b4216352 Merge pull request #979 from markshannon/python-falcon
Python: Add support for falcon web API framework.
2019-02-28 15:47:35 +01:00
Mark Shannon
1444b3976c Python: Add wsgi.environment as a kind of taint, and add suuport for env attribute of falcon request objects. 2019-02-28 13:06:11 +00:00
Taus
a83f33be33 Merge pull request #1001 from markshannon/python-delete-internal-tests
Python delete extractor tests. Duplicates of internal tests.
2019-02-28 11:04:52 +01:00
Mark Shannon
d605dfd542 Python delete extractor tests. Duplicates of internal tests. 2019-02-27 15:35:52 +00:00
Mark Shannon
f7d7b8eef2 Merge pull request #785 from taus-semmle/python-unsafe-use-of-mktemp
Python: Add query for unsafe use of `tempfile.mktemp`.
2019-02-27 15:01:06 +00:00