Erik Krogh Kristensen
50bfc8eaa0
refactor uses of API::Node::getAUse() that should have been something else
2022-04-07 13:52:13 +02:00
Rasmus Wriedt Larsen
7728b6cf1b
Python: Change XmlBomb vulnerability kind
2022-04-07 10:56:35 +02:00
Rasmus Wriedt Larsen
23637fd691
Merge branch 'main' into promote-xxe
2022-04-06 12:56:31 +02:00
Rasmus Wriedt Larsen
4d2a3b38d2
Merge pull request #8511 from RasmusWL/use-query-suffix
...
Python: Use `Query.qll` suffix for dataflow configuration definitions
2022-04-06 11:59:29 +02:00
Ahmed Farid
29f69bde75
Update zipslip_bad.py
2022-04-05 12:46:51 +00:00
Rasmus Wriedt Larsen
1f285b8983
Python: Rename to XmlParsingVulnerabilityKind
...
To keep up with style guide
2022-04-05 11:07:12 +02:00
Rasmus Wriedt Larsen
ab59d5c786
Python: Rename to XmlParsing
...
To follow our style guide
2022-04-05 11:06:22 +02:00
Tom Hvitved
57f2a74636
Python: Implement ContentSet
2022-04-04 13:51:44 +02:00
Rasmus Wriedt Larsen
4abab22066
Python: Promote XXE and XML-bomb queries
...
Need to write a change-note as well, but will do that tomorrow
2022-03-31 18:47:50 +02:00
Rasmus Wriedt Larsen
b8d3c5e96f
Python: Remove last bits of experimental XML modeling
2022-03-31 18:40:26 +02:00
Rasmus Wriedt Larsen
5083023aa8
Python: Move XML parsing PoC
...
Since the folder where it used to live is now empty otherwise :O
2022-03-31 18:37:47 +02:00
Rasmus Wriedt Larsen
673220b231
Python: Minor cleanup of XmlParsingTest
2022-03-31 18:18:35 +02:00
Rasmus Wriedt Larsen
b4c0065aeb
Python: Extend FileSystemAccess for xml.sax and xml.dom.* parsing
2022-03-31 18:08:47 +02:00
Rasmus Wriedt Larsen
e11269715d
Python: Promote xml.sax and xml.dom.* modeling
2022-03-31 17:44:00 +02:00
Rasmus Wriedt Larsen
05bb0ef976
Python: Align xml.etree.ElementTree modeling
...
I didn't find a good way to actually share the stuff, so we kinda just
have 2 things that look very similar :|
2022-03-31 17:24:16 +02:00
Rasmus Wriedt Larsen
db43d043c4
Python: Add test showing misalignment of xml.etree modeling
2022-03-31 11:55:46 +02:00
Rasmus Wriedt Larsen
543454eff2
Python: Model file access from XML parsing
2022-03-31 11:47:29 +02:00
Rasmus Wriedt Larsen
386ff53614
Python: Model lxml.iterparse
2022-03-31 11:32:22 +02:00
Rasmus Wriedt Larsen
12cbdcde28
Python: Model lxml.etree.XMLID
2022-03-31 11:21:24 +02:00
Rasmus Wriedt Larsen
64aa503cc3
Python: Promote xml.etree modeling
2022-03-31 11:12:02 +02:00
Rasmus Wriedt Larsen
7f5f7679f8
Python: Promote xmltodict modeling
2022-03-31 10:28:34 +02:00
Rasmus Wriedt Larsen
80b5cde3a2
Python: Promote lxml parsing modeling
2022-03-31 10:19:08 +02:00
Rasmus Wriedt Larsen
c4473c5f65
Python: Rename lxml XPath tests
2022-03-31 10:08:02 +02:00
Rasmus Wriedt Larsen
1ea4bcc59f
Python: Make XMLParsing a Decoding subclass
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
35ccba2ec1
Python: Promote XMLParsing concept test
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e45288e812
Python: => XMLParsingVulnerabilityKind
...
Since there are other XML vulnerabilities that are not about parsing,
this is more correct.
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e005a5c0ab
Python: Promote XMLParsing concept
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
b00766b054
Python: Adjust XXE qhelp
...
and remove the old copy, we don't need it anymore :)
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
c365337867
Python: Delete XmlEntityInjection.ql
...
Kept the test of SimpleXmlRpcServer, and kept the qhelp so it can be
used to write the new qhelp files
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
769f5691d0
Python: Add taint for StringIO and BytesIO
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
57b9780428
Python: XXE: Add example of exfiltrating data through dtd-retrival
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
a1d88e39a7
Python: Adjust XXE PoC for newer lxml versions
...
Which doesn't raise that syntax error (at least not on my laptop)
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
91795b8577
Python: Add simple test of Xxe/XmlBomb
...
Note that most of the testing happens in the framework specific tests,
with an inline-expectation test
2022-03-31 09:52:54 +02:00
Sebastian Bauersfeld
a3c3a7fe0d
Python: Identify alternative body argument in invocations of Response constructor.
2022-03-30 19:34:54 +07:00
Porcupiney Hairs
92033047a5
Python : Add query to detect PAM authorization bypass
...
Using only a call to `pam_authenticate` to check the validity of a login can
lead to authorization bypass vulnerabilities. A `pam_authenticate` only
verifies the credentials of a user. It does not check if a user has an
appropriate authorization to actually login. This means a user with a
expired login or a password can still access the system.
This PR includes a qhelp describing the issue, a query which detects instances where a call to
`pam_acc_mgmt` does not follow a call to `pam_authenticate` and it's
corresponding tests.
This PR has multiple detections. Some of the public one I can find are :
* [CVE-2022-0860](https://nvd.nist.gov/vuln/detail/CVE-2022-0860 ) found
in [cobbler/cobbler](https://www.github.com/cobbler/cobbler )
* [fredhutch/motuz](https://www.huntr.dev/bounties/d46f91ca-b8ef-4b67-a79a-2420c4c6d52b/ )
2022-03-30 00:47:58 +05:30
Erik Krogh Kristensen
36db492aa2
move the polynomialbacktracking-test to the test folder
2022-03-28 13:22:26 +02:00
Erik Krogh Kristensen
c5fb19c377
update the JS API-graph labels toString() to print the predicate calls on the API-graphs
2022-03-28 13:19:16 +02:00
Ahmed Farid
53f756b078
Update ZipSlip.expected
2022-03-28 08:54:44 +00:00
yoff
5efc19c39d
Merge pull request #7806 from erik-krogh/pyDef
...
Python: Add def nodes to API graphs
2022-03-28 08:09:14 +02:00
Rasmus Lerchedahl Petersen
774c811e97
python: move CSRF concepts inside HTTP::Server
2022-03-28 07:35:13 +02:00
Ahmed Farid
a50f051cdd
Update zipslip_bad.py
2022-03-28 01:38:58 +00:00
Ahmed Farid
f364e41dbe
Update ZipSlip.expected
2022-03-28 01:02:38 +00:00
Ahmed Farid
a8c14ed6c3
Update zipslip_bad.py
2022-03-28 01:00:38 +00:00
Rasmus Lerchedahl Petersen
1e9840d779
python: broaden local protection concept
2022-03-25 12:28:33 +01:00
Ahmed Farid
8dea7248ea
Update zipslip_bad.py
2022-03-24 00:34:52 +01:00
Ahmed Farid
a05318f10c
Update zipslip_good.py
2022-03-24 00:32:11 +01:00
Ahmed Farid
1836723ecb
Merge branch 'main' into ZipSlip
2022-03-23 19:27:12 -04:00
Rasmus Lerchedahl Petersen
6c2449564a
python: add concept tests
2022-03-23 12:05:09 +01:00
Taus
f9120167b4
Python: Fix syntax error in with test output
...
Depends on an internal PR. The two lines in question were caused by
the insertion of an extra node due to the failure to parse a trailing
comma corrcetly.
2022-03-22 16:22:03 +00:00
yoff
47e062cfb9
Merge pull request #8486 from aibaars/incomplete-hostname-python
...
Python: switch to shared implementation of IncompleteHostnameRegExp.ql
2022-03-22 15:06:14 +01:00
