Rasmus Wriedt Larsen
7e87e18b32
Python: Adjust name/description/select of PamAuthorization.ql
...
Thought that calling out the actual vulnerability would make things
easier for our end users :)
2022-05-10 18:02:17 +02:00
yoff
da3634188d
python: variaous fixes
...
- sync summary files
- format files
- fix compilation
2022-05-10 12:48:42 +00:00
yoff
f14ee0e794
python: Flow summaries based on type tracking
...
Two classes have been inserted into the hierarchies:
- `NonLibraryDataFlowCallable` with a method `getACall2`.
This method implements "get a call, not considering flow summaries".
For `NonLibraryDataFlowCallable`s, `getACall` will defer to `getACall2`.
While you could have a synthesised call to such a callable,
it would not correspond to a `CallNode`.
- `NonLibraryDataFlowSourceCall` with methods
`getArg2` and `getCallable2`. These also refer to a call graph that
does not consider flow summaries.
`getArg2` is used to synthesise pre-update nodes for arguments.
`getCallable2` is used in `connects` to compute argument passing.
This is used to define data flow nodes for overflow arguments.
`getACall2` ensures that `LibraryCallableValue::getACall` is not called
when the charpred of `FunctionCall` is evaluated.
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
506efcf051
python: refactor TDataFlowCall
...
- Branch predicates are made simple. In particular, they do not try to detect library calls.
- All branches based on `CallNode`s are gathered into one.
- That branch has been given a class `NonSpecialCall`, which is the new parent of call classes based on `CallNode`s. (Those classes now have more involved charpreds.)
- A new such class, 'LambdaCall` has been split out from `FunctionCall` to allow the latter to replace its
general `CallNode` field with a specific `FunctionValue` one.
- `NonSpecialCall` is not an abstract class, but it has some abstract overrides. Therefor, it is not
considered a resolved call in the test `UnresolvedCalls.qll`.
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
177dea5307
python: use new syntax for flow summaries
...
also convert to inline tests
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
4024ce4777
python: some summary flows
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
828db3a392
python: Add summary nodes
...
allowing more `OutNode`s (not restricting to `CallNode`s),
gives more flow in the `classesCallGraph` test
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
80175a9af5
Python: Compiles and mostly pass tests
...
- add flowsummaries shared files
- register in indentical files
- fix initial non-monotonic recursions
- add DataFlowSourceCall
- add resolvedCall
- add SourceParameterNode
failing tests:
- 3/library-tests/with/test.ql
2022-05-10 12:48:42 +00:00
Rasmus Wriedt Larsen
2b6e0cfb44
Merge pull request #8340 from yoff/python/simple-csrf
...
python: minimal CSRF implementation
2022-05-10 13:36:38 +02:00
Rasmus Wriedt Larsen
cb17e2a649
Merge pull request #8595 from porcupineyhairs/pypam
...
Python : Add query to detect PAM authorization bypass
2022-05-10 13:35:12 +02:00
Rasmus Lerchedahl Petersen
aa3d7babf4
python: fix bad merge
...
caused by an optimistic attempt at solving a
merge conflict in the online GUI.
2022-05-10 11:37:41 +02:00
Rasmus Wriedt Larsen
2421076d2f
Merge pull request #8696 from RasmusWL/new-nosql-examples
...
Python: Improve experimental modeling for `pymongo`
2022-05-10 11:03:05 +02:00
yoff
6c3e2db7fd
Merge branch 'main' into python/simple-csrf
2022-05-10 10:55:28 +02:00
yoff
b6605bc330
Merge pull request #8634 from RasmusWL/promote-xxe
...
Python: Promote XXE and XML-bomb queries
2022-05-09 21:54:55 +02:00
Rasmus Wriedt Larsen
c218162104
Merge branch 'main' into pypam
2022-05-09 14:20:05 +02:00
Erik Krogh Kristensen
fc1ab06c1c
autoformat
2022-05-09 12:39:38 +02:00
Rasmus Wriedt Larsen
de05b108fa
Python: Fix singleton set
2022-05-09 11:01:13 +02:00
Erik Krogh Kristensen
efe306733e
move path-injection MaD to PathInjectionCustomizations.qll
2022-05-05 16:51:39 +02:00
yoff
6169ac6122
Merge pull request #7776 from RasmusWL/django-filefield-uploadto
...
Python: Support Django FileField.upload_to
2022-05-05 14:25:08 +02:00
Rasmus Wriedt Larsen
dfe99b0b51
Python: Apply suggestions from code review
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2022-05-05 14:14:44 +02:00
Rasmus Wriedt Larsen
0a589bed4e
Python: Add inline test of MaD sinks
...
This enables us to keep the framework modeling tests under `/frameworks`
folder
I had hoped to use `mad-sink[<kind>]` syntax, but that was not allowed
:(
Maybe it oculd be allowed in the future, but for now I'll stick with the
more ugly solution of `mad-sink__<kind>`
2022-05-05 13:11:43 +02:00
Rasmus Wriedt Larsen
6ae5ef9f3b
Revert "move most of asyncpg test into SqlInjection after moving MaD sql-injection sink"
...
This reverts commit 4b9c9b0c8d
2022-05-05 10:20:41 +02:00
Erik Krogh Kristensen
4b9c9b0c8d
move most of asyncpg test into SqlInjection after moving MaD sql-injection sink
2022-05-04 10:59:02 +02:00
Erik Krogh Kristensen
571fc3e73b
Revert "deprecate SqlConstruction"
...
This reverts commit c0eca0d09a
2022-05-04 10:59:02 +02:00
Erik Krogh Kristensen
1062aae21c
add test that the foo.bar package syntax works
2022-05-04 10:58:59 +02:00
Erik Krogh Kristensen
8ffc05c84b
count both named and positional arguments in the WithArity filter
2022-05-03 21:21:57 +02:00
yoff
56ed68b3eb
Merge pull request #9001 from RasmusWL/files-refactoring
...
Python: Flask: Improve `request.files` modeing
2022-05-03 12:19:55 +02:00
Rasmus Wriedt Larsen
fb0133d276
Python: Fix Flask request.files modeling
2022-05-02 14:14:58 +02:00
Rasmus Wriedt Larsen
0c62916af5
Python: Highlight problem with Flask request.files modeling
2022-05-02 14:14:53 +02:00
Erik Krogh Kristensen
c0eca0d09a
deprecate SqlConstruction
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
6c67e51ec3
add test for the .Call token
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
9c3d45a16a
last test of taint steps
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
894252dfa7
third test of taint steps
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
0f1e070d82
second test of taint steps
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
649df1dd31
simple taint-flow test
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
a8790412dd
add support for the Argument[any] and Argument[any-named] tokens
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
b1fa7f86a8
add support for the any argument tokens
2022-05-02 12:58:15 +02:00
Erik Krogh Kristensen
413d182bcf
add support for named parameters
2022-05-02 12:56:44 +02:00
Erik Krogh Kristensen
547047ef19
add self parameters to API-graphs, and add support for self parameters in MaD
2022-05-02 12:50:31 +02:00
Erik Krogh Kristensen
dc38aa8a96
add support for the Method[name] token
2022-05-02 12:50:29 +02:00
Erik Krogh Kristensen
ea01bcf5ec
have the Instance token be an alias for Subclass.ReturnValue
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
46acce0ad4
add support for the Subclass token
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
a02e812de8
add test for the Instance token
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
682cab3737
add test for awaited
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
48408ca45d
Add TODO list
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
8d60336396
add tests for callsite filters
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
20992af037
add test for parameter syntax
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
35b143a1a5
add tests for argument syntax
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
86a9bc6aca
add test for keyword arguments
2022-05-02 12:45:21 +02:00
Erik Krogh Kristensen
d4b882519a
convert most of the asyncpg model to MaD
2022-05-02 12:45:21 +02:00
