Taus
e592fd60ff
Merge pull request #20495 from github/tausbn/python-fix-unmatchable-dollar-in-lookahead
...
Python: Fix false positive for unmatchable dollar/caret
2025-09-25 15:27:32 +02:00
Simon Friis Vindum
7d6e2060e5
Adapt all languages to changes in shared library
2025-09-22 14:18:58 +02:00
Joe Farebrother
463f79bed2
Merge pull request #20263 from joefarebrother/python-qual-exceptions
...
Python: Modernize the Unreachable Except Block query
2025-09-22 09:42:09 +01:00
Taus
95a84ad655
Python: Fix false positive for unmatchable dollar/caret
...
Our previous modelling did not account for the fact that a lookahead can
potentially extend all the way to the end of the input (and similarly,
that a lookbehind can extend all the way to the beginning).
To fix this, I extended `firstPart` and `lastPart` to handle lookbehinds
and lookaheads correctly, and added some test cases (all of which yield
no new results).
Fixes #20429 .
2025-09-19 15:06:46 +00:00
Taus
8fd62252fd
Python: Fix bad join in globalVariableNestedFieldJumpStep
2025-09-16 18:12:29 +02:00
Napalys Klicius
e82fe9d919
Python: Updated doc string and removed redundant predicate.
2025-09-16 18:08:53 +02:00
Taus
e228aac61f
Python: Use AttrWrite.writes
...
Also applies @napalys' fix to the base case.
2025-09-16 18:08:53 +02:00
Taus
6f9e06c59e
Python: Add AttrWrite.writes and AttrRead.reads
...
The latter of these is identical to `AttrRef.accesses`, but makes the
API a bit more intuitive.
2025-09-16 18:08:53 +02:00
Napalys Klicius
8393ccf39d
Python: Update globalVariableAttrPathAtDepth base case
2025-09-16 18:08:53 +02:00
Taus
6133f01c81
Python: Rewrite access path computation
2025-09-16 18:08:53 +02:00
Taus
69b5853477
Python: Keep track of access path
2025-09-16 18:08:53 +02:00
Napalys Klicius
e60d0c88f1
Python: Add global variable nested field jump steps
2025-09-16 18:08:53 +02:00
Joe Farebrother
869b7e09d7
Merge pull request #19932 from joefarebrother/python-qual-init-del-calls
...
Python: Modernize 4 queries for missing/multiple calls to init/del methods
2025-09-08 09:29:38 +01:00
Michael Nebel
31852985e5
Merge pull request #20335 from michaelnebel/shared/ql4ql
...
Shared and Sync: Fix some Ql4Ql violations.
2025-09-02 14:37:34 +02:00
Anders Schack-Mulligen
f833fe0e6e
Merge pull request #20300 from aschackmull/cfg/successortype
...
Shared: Add a shared SuccessorType implementation
2025-09-02 14:09:35 +02:00
Michael Nebel
d3d737b383
Merge pull request #20330 from michaelnebel/python/ql4ql
...
Python: Fix some Ql4Ql violations.
2025-09-02 14:01:54 +02:00
Michael Nebel
7490d8ddd2
Shared and Sync: Fix some Ql4Ql violations.
2025-09-02 13:54:22 +02:00
Michael Nebel
dbd31259b3
Python: Fix some Ql4Ql violations.
2025-09-01 15:16:25 +02:00
Joe Farebrother
d0daacd17e
Modernize multple calls to init/del
2025-09-01 14:10:22 +01:00
Anders Schack-Mulligen
144e34c669
Shared: Use shared SuccessorType in shared Cfg and BasicBlock libs.
2025-09-01 13:43:32 +02:00
Anders Schack-Mulligen
09b2c5abf0
BasicBlock: Replace entryBlock predicate with subclass.
2025-09-01 11:48:44 +02:00
Anders Schack-Mulligen
f459ddc40a
Languages: Adapt to api changes.
2025-09-01 11:26:33 +02:00
Anders Schack-Mulligen
bb3abc815f
SSA: Update input to use member predicates.
2025-09-01 11:19:48 +02:00
Taus
f89fae39c5
Merge pull request #20276 from github/tausbn/python-model-psycopg2-connection-pools
...
Python: Add support for Psycopg2 database connection pools
2025-08-29 13:52:59 +02:00
Napalys Klicius
bafe22c50c
Merge pull request #20048 from Napalys/js/xml_bomb_sinks
...
JS: Exclude patched libraries from `xml-bomb` sink
2025-08-29 08:10:55 +02:00
Joe Farebrother
bde143e4c1
Merge pull request #20038 from joefarebrother/python-qual-comparison
...
Python: Modernize 3 quality queries for comparison methods
2025-08-28 09:37:20 +01:00
Taus
d5e0298999
Python: Add support for Psycopg2 database connection pools
...
Our current modelling only treated `psycopg2` insofar as it implemented
PEP 249 (which does not define any notion of connection pool), which
meant we were missing database connections that arose from such pools.
With these changes, we add support for the three classes relating to
database pools that are defined in `psycopg2`. (Note that
`getAnInstance` automatically looks at subclasses, which means this
should also handle cases where the user has defined a new subclass that
inherits from one of these three classes.)
2025-08-25 12:35:57 +00:00
Tom Hvitved
bf7e3dabd6
Python: Only include relevant YAML in printAst.ql
2025-08-25 13:54:19 +02:00
Joe Farebrother
9edfd7a6fb
Use generator script directly
2025-08-21 14:12:26 +01:00
Joe Farebrother
f24f7d5146
Add builtin subclass models, incorporate into query
2025-08-21 13:50:26 +01:00
Napalys Klicius
638f6498f0
Removed lxml.etree.XMLParser from xml bomb sinks
2025-07-15 13:43:00 +02:00
Jeroen Ketema
cbde11ddc9
Properly share ConceptsShared.qll
2025-07-14 16:30:45 +02:00
Jeroen Ketema
f07d8ee493
Remove duplicate copies of CryptoAlgorithms and CryptoAlgorithmNames
2025-07-14 11:39:06 +02:00
Jeroen Ketema
f4ba2e1fd0
Properly share CryptoAlgorithms and CryptoAlgorithmNames
2025-07-14 11:39:00 +02:00
Jeroen Ketema
c582a9ccd6
Remove duplicate copies of SensitiveDataHeuristics
2025-07-14 11:38:52 +02:00
Jeroen Ketema
8b828cecf1
Use shared SensitiveDataHeuristics
2025-07-14 11:38:47 +02:00
Taus
c6c6a857df
Python: Add tests
...
Also fixes an issue with the return type annotations that caused these
to not work properly.
Currently, annotated assignments don't work properly, due to the fact
that our flow relation doesn't consider flow going to the "type" part of
an annotated assignment. This means that in `x : Foo`, we do correctly
note that `x` is annotated with `Foo`, but we have no idea what `Foo`
is, since it has no incoming flow.
To fix this we should probably just extend the flow relation, but this
may need to be done with some care, so I have left it as future work.
2025-07-11 12:03:14 +00:00
Taus
d1cf7f0624
Python: Support type annotations in call graph
...
Adds support for tracking instances via type annotations. Also adds a
convenience method to the newly added `Annotation` class,
`getAnnotatedExpression`, that returns the expression that is annotated
with the given type. For return annotations this is any value returned
from the annotated function in question.
Co-authored-by: Napalys Klicius <napalys@github.com >
2025-07-11 12:03:14 +00:00
Joe Farebrother
eb1b5a35d7
Modernize inconsistent equality
2025-07-09 14:14:30 +01:00
Asger F
4a2d795076
Shared: Make approximate location filtering the default behaviour
2025-07-02 14:41:02 +02:00
Asger F
a46b5f9529
Python: enable diff-informedness for poly redos using approximate related locations
2025-07-02 14:39:42 +02:00
Kasper Svendsen
2da8d61984
Run config/sync-files.py
2025-06-24 10:25:06 +02:00
Sylwia Budzynska
e66659276b
Fix formatting
2025-05-27 13:51:03 +02:00
Sylwia Budzynska
8a1c323a98
Change naming to PascalCase
2025-05-27 13:45:40 +02:00
Sylwia Budzynska
84228e0ec8
Add Pandas SQLi sinks
2025-05-27 13:10:39 +02:00
Napalys Klicius
f652686607
Merge pull request #19444 from Napalys/python/hdbcli
...
Python: modeling of `hdbcli`
2025-05-01 17:58:31 +02:00
Napalys Klicius
e1fc0ca051
Added implementation hdbcli as part of PEP249::PEP249ModuleApiNode
2025-05-01 14:18:02 +02:00
yoff
cf45e771f3
python: remove copied comment
2025-04-30 20:01:43 +02:00
yoff
531f2a15a4
python: model send_header from http.server
2025-04-30 19:58:14 +02:00
Chuan-kai Lin
6c1e80df3a
Python: disable diff-informed PolynomialReDoS.ql
...
This commit disabled diff-informed for PolynomialReDoS.ql because it
could miss some alerts within diff ranges.
2025-04-24 14:57:06 -07:00
