Joe Farebrother
8152ec7472
Merge pull request #16696 from joefarebrother/python-cookie-write-headers
...
Python: Model CookieWrites from HeaderWrites
2024-07-11 14:25:54 +01:00
Rasmus Wriedt Larsen
5ecde387af
Python: Fix .expected
2024-07-11 14:42:26 +02:00
Rasmus Wriedt Larsen
173cd13ded
Python: Add test for impossible isinstance flow
2024-07-08 12:06:53 +02:00
Porcupiney Hairs
808af28618
Python : Arbitrary codde execution due to Js2Py
...
Js2Py is a Javascript to Python translation library written in Python. It allows users to invoke JavaScript code directly from Python.
The Js2Py interpreter by default exposes the entire standard library to it's users. This can lead to security issues if a malicious input were directly.
This PR includes a CodeQL query along with a qhelp and testcases to detect cases where an untrusted input flows to an Js2Py eval call.
This query successfully detects CVE-2023-0297 in `pyload/pyload`along with it's fix.
The databases can be downloaded from the links bellow.
```
https://file.io/qrMEjSJJoTq1
https://filetransfer.io/data-package/a02eab7V#link
```
2024-07-03 19:06:34 +05:30
Rasmus Wriedt Larsen
ce177c3450
Merge pull request #15655 from yoff/python/support-model-editor
...
Python: Support model editor
2024-07-02 16:28:58 +02:00
Rasmus Wriedt Larsen
dc33f0de1d
Python: Additional tests for model-editor
...
We currently have some problems with these files, that we should fix
later down the line. See PR comment for more details.
2024-07-02 14:28:46 +02:00
Joe Farebrother
b81d41ba7b
Add django header write models for direct subscript write
2024-07-01 11:26:54 +01:00
Rasmus Lerchedahl Petersen
e40ae2e52d
Python: adjust test expectations
...
MaD row numbers in provenance column
2024-06-28 21:56:11 +02:00
Rasmus Lerchedahl Petersen
77a00873a9
Python: add tests for loggers
2024-06-28 15:25:17 +02:00
Rasmus Lerchedahl Petersen
9cca1b294c
Python: Add test cases
2024-06-27 16:33:23 +02:00
Rasmus Lerchedahl Petersen
27301edc28
Python: address more review comments
2024-06-27 16:05:21 +02:00
yoff
c2141b62e0
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-06-27 14:53:03 +02:00
Rasmus Lerchedahl Petersen
a3076f4f72
Python: fix test expectations, add missing sanitizer
2024-06-26 13:27:32 +02:00
Joe Farebrother
6538d22d3f
Fix tornado model of httheaders.add.
2024-06-26 09:21:53 +01:00
yoff
58b6b3f601
Merge pull request #16789 from yoff/python/document-models-as-data
...
python: Document MaD format
2024-06-25 15:46:28 +02:00
Rasmus Lerchedahl Petersen
aa4fd1992e
Python: compact types in type models
2024-06-25 11:59:55 +02:00
Joe Farebrother
d0f735ac28
Update tests for restframework
2024-06-24 20:52:09 +01:00
Joe Farebrother
c404f00a9b
Add additional header write models for aiohttp and tornado + added qldoc
2024-06-24 17:27:25 +01:00
Joe Farebrother
79c0ed6074
Add additional fastapi mheader write models
2024-06-24 17:27:21 +01:00
Joe Farebrother
5ced5c010c
Add django header writes
2024-06-24 17:27:15 +01:00
Joe Farebrother
7704801e47
Change fastapi raw cookie header models to header write models
2024-06-24 17:27:12 +01:00
Joe Farebrother
a0201e9c4f
Update tests for new cookie write from headers
2024-06-24 17:27:06 +01:00
Joe Farebrother
6b8080a5b3
Update concept tests for header writes
2024-06-24 17:27:02 +01:00
Rasmus Lerchedahl Petersen
00fbada41d
Python: recognize fabric.operations
2024-06-24 10:54:59 +02:00
Taus
4a448f445e
Merge pull request #15715 from am0o0/am0o0-python-codeExec
...
Python: New command execution sinks
2024-06-21 14:26:33 +02:00
Rasmus Lerchedahl Petersen
280a9b4408
Python: Support Model Editor
2024-06-21 11:47:51 +02:00
Rasmus Lerchedahl Petersen
5cb37f5c4c
python: Document MaD format
...
- add a few tests reflecting the documentation
- make the mentioned sink-kinds have an effect on relevant queries
2024-06-19 17:00:15 +02:00
Paolo Tranquilli
b7a2ea8981
CI: accept other diagnostic format related test changes
2024-06-19 11:33:50 +02:00
am0o0
8a7fdfa6fe
fix conflict
2024-06-18 17:18:59 +02:00
Paolo Tranquilli
daea773fce
Python: tests with false positives around match
2024-06-14 17:28:35 +02:00
Taus
b7b0f84e8b
Python: Handle @pytest.fixture decorations with arguments as well
...
Not the prettiest of solutions, but it seems to work well enough.
2024-06-14 15:11:25 +00:00
Paolo Tranquilli
1046d03486
Python: update unused import test case for pytest
2024-06-14 16:55:05 +02:00
Taus
2f00a0d323
Python: Also test pytest fixture factories
2024-06-14 13:11:00 +00:00
Taus
78729180ad
Python: Fix pytest fixture unused import FPs
2024-06-14 12:05:55 +00:00
Taus
f3a9c9a9dc
Python: Add tests for pytest fixture unused import FPs
2024-06-14 12:03:43 +00:00
Joe Farebrother
93f10fcf14
Add sanitizers for compiled regexes
2024-06-11 15:44:16 +01:00
Joe Farebrother
9331c2c33a
Add tests
2024-06-04 09:39:37 +01:00
am0o0
b9edcb7943
rename secondary to remote :), complete the previous commit changes
2024-05-29 16:47:37 +02:00
Joe Farebrother
2db1fbc713
Merge branch 'main' into python-flask-session-interface
2024-05-22 21:48:01 +01:00
Anders Schack-Mulligen
987d5712b8
Python: Accept qltest .expected file changes.
2024-05-22 15:43:49 +02:00
yoff
358c7410c8
Merge pull request #16490 from yoff/python/rich-type-column-MaD
...
Python: Rich `type` column in MaD
2024-05-21 11:55:41 +02:00
Joe Farebrother
01a6c5e82f
Merge pull request #16446 from joefarebrother/shared-sensitive-heuristics
...
Ruby/Python/JS/Swift: Add category of Private information to shared sensitive data heuristics
2024-05-21 09:07:13 +01:00
Joe Farebrother
7727e465f4
Model Flask SessionInterface request parameter
2024-05-20 09:46:54 +01:00
Rasmus Lerchedahl Petersen
a568873a8e
Python: update test expectations
2024-05-17 10:59:49 +02:00
Rasmus Lerchedahl Petersen
d4d6b48f98
python: add test for subclass instance method
2024-05-17 00:03:01 +02:00
Rasmus Lerchedahl Petersen
3d0c42f44d
python: rewrite text models to use rich paths
2024-05-17 00:03:01 +02:00
Rasmus Lerchedahl Petersen
4378924785
Python: Example use of provenance for additional taint steps
2024-05-16 14:04:35 +02:00
yoff
ea3cc51286
Merge pull request #16194 from yoff/python/test-constructor-MaD-path
...
Python: test the MaD path for constructor calls
2024-05-16 13:52:30 +02:00
yoff
5076b1a214
Merge pull request #16135 from sylwia-budzynska/gradio-model
...
Python: Add Gradio models
2024-05-16 09:00:50 +02:00
yoff
538d556465
Merge branch 'main' into python/test-constructor-MaD-path
2024-05-14 21:30:58 +02:00
