am0o0
c7adb32bc4
simply replace duplicate class references with classRef() in Fabric.qll
2024-05-14 09:51:47 +02:00
Rasmus Lerchedahl Petersen
52717f8500
python: The MaD token Instance now follows subclasses
2024-05-14 08:40:19 +02:00
am0o0
37d33186e5
revert classRef deletion, fix secondaryserverCmdInjection expected test results
2024-05-13 15:02:04 +02:00
am0o0
fb3d34ce11
format Torch.qll
2024-05-13 14:43:43 +02:00
Sylwia Budzynska
d6acea1d0c
Fix tests
2024-05-10 12:41:47 +02:00
Sylwia Budzynska
52ceb7fb89
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-05-10 12:07:32 +02:00
am0o0
0e80e867af
fix actions reviews
2024-05-10 08:32:45 +02:00
am0o0
f93d4a0dd5
fix Fabric query library
2024-05-10 01:27:31 +02:00
Joe Farebrother
da93a08639
Add change notes
...
No change note is needed for Swift, as the new heuristics are unused and thus should not affect any queries.
2024-05-09 10:03:20 +01:00
Joe Farebrother
9aff22c664
Fix typos in sensitive data regex
2024-05-09 09:39:03 +01:00
Joe Farebrother
ab23d0ad23
Merge branch 'main' into python-promote-header-injection
2024-05-08 13:49:00 +01:00
Sylwia Budzynska
944f8842b7
Change getASuccessor() to getASubscript()
2024-05-08 14:44:06 +02:00
Sylwia Budzynska
8bb4193704
Put GradioInterface models into GradioInput
2024-05-08 14:36:42 +02:00
Sylwia Budzynska
eaba798e34
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-05-08 14:26:34 +02:00
Joe Farebrother
5f4bc4197b
Add private category to sensitive data heuristics
2024-05-08 10:02:00 +01:00
am0o0
4a2ab49efb
better structure for pandas DataFrame, it is now much better readable and also we can find much more DataFrame objects
2024-05-06 14:36:10 +02:00
amammad
0a765cc94a
add jsonpickle and pexpect libs in case of unsafe decoding and secondary command execution, add proper test cases
2024-05-06 14:36:10 +02:00
amammad
4df73f9975
continue to convert paramiko query to a more general query,
...
the proxy command is not a secondary command execution
so we can add proxy command to SystemCommandExecution::Range, update QLDocs,
add a proper Paramiko test case
fix a typo
2024-05-06 14:36:10 +02:00
amammad
6520e2fdfb
update Fabric models, add new sink to Fabric, add proper test cases
2024-05-06 14:36:10 +02:00
amammad
2708e57e4b
add pyTorch :) code execution sinks, add proper tests
2024-05-06 14:36:10 +02:00
amammad
cffdc5b452
add panas code execution sinks, add proper tests
2024-05-06 14:36:10 +02:00
Chuan-kai Lin
535e6db40f
Python: Use entities in reorder directives
2024-05-03 11:17:41 -07:00
Owen Mansel-Chan
83249cd9c2
Fix grammar in comment
2024-05-02 09:59:48 +01:00
Owen Mansel-Chan
16dcc0969b
Standardise comment explaining why extensible predicates must be defined
2024-05-01 22:00:01 +01:00
Joe Farebrother
fd55713006
add changenote
2024-04-30 18:17:18 +01:00
Joe Farebrother
c6372d5822
Fix qldoc and remove PotentialViewCallable class
2024-04-30 18:13:06 +01:00
Joe Farebrother
ba054bd428
Manually specify subclasses for redirect models
2024-04-30 14:33:46 +01:00
github-actions[bot]
99928b82ed
Post-release preparation for codeql-cli-2.17.2
2024-04-30 12:15:35 +00:00
github-actions[bot]
5228d94d42
Release preparation for version 2.17.2
2024-04-30 10:25:51 +00:00
Joe Farebrother
7df8b1ba51
Don't rely on specific parameter names, add qldoc
2024-04-30 09:45:11 +01:00
erik-krogh
800d7546fa
change all the change-notes to breaking
2024-04-26 17:17:23 +02:00
erik-krogh
14d88eb3ce
add change-notes
2024-04-26 12:56:28 +02:00
erik-krogh
baa31e1469
delete outdated deprecations
2024-04-25 22:19:28 +02:00
Joe Farebrother
2a0459838b
Add models for responses
2024-04-25 15:55:59 +01:00
Joe Farebrother
86d1e5b646
Add additional type tracking for request attributes
2024-04-25 13:58:36 +01:00
Rasmus Wriedt Larsen
13ff9412a4
Merge pull request #16252 from RasmusWL/move-dataflow-tests
...
Python: Move dataflow tests out of experimental
2024-04-25 10:05:06 +02:00
Joe Farebrother
2b935e575a
Add concept tests + fix typo
2024-04-24 14:05:41 +01:00
Joe Farebrother
ec4c820391
Fix deprecation
2024-04-24 14:05:41 +01:00
Joe Farebrother
f3b27d611a
Add test case for validated wsgiref servers + fix typo
2024-04-24 14:05:40 +01:00
Joe Farebrother
d4a072818f
Add more tests
2024-04-24 14:05:40 +01:00
Joe Farebrother
eeef062f7c
Implement sinks for wsgiref + allow lists in bulk header updates + local flow
2024-04-24 14:05:39 +01:00
Joe Farebrother
8636a50190
Fix qldoc + remove deprecation from experimental concepts (as they are still used in another experimental query)
2024-04-24 14:05:38 +01:00
Joe Farebrother
fa28d94363
Added a sanitizer for replacing newlines.
2024-04-24 14:05:38 +01:00
Joe Farebrother
dbbc944f32
Correct spelling
2024-04-24 14:05:38 +01:00
Joe Farebrother
a88ad62c00
Implemented sinks for bulk header updates, and added corresponding tests.
2024-04-24 14:05:38 +01:00
Joe Farebrother
3e9341ff8a
Model class instantiation for werkzueg headers
2024-04-24 14:05:37 +01:00
Joe Farebrother
b9984beb16
Add test cases
2024-04-24 14:05:37 +01:00
Joe Farebrother
68d90918cf
Add to header write concept a specification of whether the name or value arg allows newlines.
...
Ported sink defenitions from Flask and Werzeug from experimental to main.
Removed experimental sink definitions for Django, as neither name nor value are vulnerable.
2024-04-24 14:05:37 +01:00
Joe Farebrother
25ffcb2fde
Split into customizations file
2024-04-24 14:05:37 +01:00
Joe Farebrother
6021d9238c
Move headers injection query and concept from experimental to main
2024-04-24 14:05:37 +01:00
