Sim4n6
3d8868a6c3
Add routes for bad_5 and bad_6, and fix routes for good_3 and good_4
2024-03-15 14:17:23 +01:00
Sim4n6${{7*'7'}}
658b88e62f
Update python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql
...
update the Config API
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-03-15 14:17:23 +01:00
Sim4n6
1f767b887e
Add some comments and docs
2024-03-15 14:17:23 +01:00
Sim4n6
5cc9170249
Add UnicodeDoS sink for werkzeug secure_filename
2024-03-15 14:17:23 +01:00
Sim4n6
342465057c
Add Unicode DoS (CWE-770)
2024-03-15 14:17:23 +01:00
Rasmus Wriedt Larsen
7eb4419342
Python: Restrict type-tracking content to only be precise
...
At least for now :)
2024-03-15 10:24:57 +01:00
Rasmus Wriedt Larsen
6babb2ff90
Python: Accept .expected for typetracking-summaries
2024-03-15 10:24:33 +01:00
Rasmus Wriedt Larsen
00f2a6a65e
Python: Update ssa-compute test expectations
2024-03-15 10:14:45 +01:00
Rasmus Wriedt Larsen
7a3ee0f5f8
Python: Make IterableSequenceNode LocalSourceNode
...
We do this to remove the inconsistencies, and to be ready for a future
where type-tracking support content tracker of depth > 1.
It works because targets of loadSteps needs to be LocalSourceNodes
predicate loadStep(Node nodeFrom, LocalSourceNode nodeTo, Content content) {
2024-03-14 10:46:29 +01:00
Rasmus Wriedt Larsen
6ffaad1bc8
Python: Expand type-tracking tests with nested tuples
...
I was initially surprised to see that this didn't work, until I
remembered that type-tracking only works with content of depth 1.
2024-03-14 10:44:25 +01:00
Rasmus Wriedt Larsen
af8cef5b53
Python: Fixup deprecated type-tracker API
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
2b09b084e0
Python: Add change-note
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
7de304bf16
Python: Add proper type-tracking tests for content
...
Instead of just relying on the call-graph tests
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
fa0c4e18fc
Python: Expand dict-content tt test even more
...
While it might be useful to track content to any lookup, it's not
something we do right now.
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
4d78762ba8
Python: Ignore consistency failure
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
8a7ffac19c
Python: Accept consistency failure
2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
92729dbbd6
Python: Support iterable unpacking in type-tracking
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
0cf3fe4a4c
Python: Expand dict update tests
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
dac2b57bb0
Python: type-track through dict-updates
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
73fe596753
Python: type-tracking through dictionary construction
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
ece8245a4b
Python: type-track through tuple content
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
a95bb7c86b
Python: Expand function reference in content test
2024-03-14 10:42:38 +01:00
Rasmus Wriedt Larsen
7721fb3331
Python: Setup shared read/store steps
2024-03-14 10:42:37 +01:00
Rasmus Wriedt Larsen
636cf611ae
Python: Allow general content in type-tracker
...
This should not result in many changes, since store/load steps are still
only implemented for attributes.
2024-03-14 10:42:37 +01:00
Rasmus Wriedt Larsen
fc8caa66c8
Python: Prepare for general content in type-tracker
...
Due to the char-pred of Content, this change should keep exactly the
same behavior as before.
2024-03-14 10:42:37 +01:00
Rasmus Lerchedahl Petersen
533b63743b
Python: test MaD syntax for keyword argument
...
use the combined positional/keyword syntax as
that is what we will probably mostly use.
2024-03-13 15:28:34 +01:00
Tom Hvitved
6c0ed28e6b
Python: Implement new data flow interface
2024-03-13 14:41:57 +01:00
yoff
b5c0fbb827
Merge pull request #15776 from RasmusWL/tt-consistency
...
Python: Add type-tracking consistency query
2024-03-13 11:11:07 +01:00
Tom Hvitved
dddba3228b
Merge pull request #15867 from hvitved/dataflow/ap-limit
...
Data flow: Add `ConfigSig::accessPathLimit`
2024-03-12 14:57:51 +01:00
Henry Mercer
c325ff8a23
Mark lines of code queries as telemetry queries
...
The new file coverage metrics are available in all supported GHES
versions. This PR tags lines of code queries as telemetry queries. Lines
of code information will still be available in the SARIF file, but it
will no longer be displayed in the logging output of the CLI.
The one exception is the metric queries for Java/Kotlin that provides
separate lines of code information for Java and Kotlin. I've kept these
since separate file coverage information for languages like Java and
Kotlin is only available for GHES 3.12 and later.
2024-03-11 16:40:31 +00:00
Rasmus Wriedt Larsen
800351c7b7
Merge branch 'main' into tt-consistency
2024-03-11 14:12:09 +01:00
yoff
e6e6a4e9c8
Merge pull request #15841 from RasmusWL/missing-use-use2
...
Python: Add example of missing use-use flow
2024-03-11 13:59:57 +01:00
yoff
adbcbefaa9
Merge pull request #15551 from yoff/python/avoid-duplicate-model-inclusions
...
python: Remove `TaintStepFromSummary`
2024-03-11 13:52:20 +01:00
Tom Hvitved
da66281fef
Sync files
2024-03-11 13:02:04 +01:00
Rasmus Wriedt Larsen
4ac8dd72a7
Merge pull request #15855 from yoff/python/add-MaD-test-tuple-output
...
Python: Add test for `ReturnValue.TupleElement[n]`
2024-03-11 12:05:31 +01:00
Rasmus Wriedt Larsen
42acd9c22c
Merge pull request #15695 from github/tausbn/python-add-copy-method-as-copy-step
...
Python: Add `.copy()` method call as copy step
2024-03-11 09:43:34 +01:00
Rasmus Lerchedahl Petersen
3601773856
python: support encoding lower bound
2024-03-08 14:59:28 +01:00
Rasmus Wriedt Larsen
adf5a4b1e4
Python: Fix internal consistency failures
2024-03-08 14:13:47 +01:00
Rasmus Wriedt Larsen
87b6592dbc
Python: Accept inconsistency for missing use-use flow
...
At least until we have a proper fix
2024-03-08 13:34:26 +01:00
Rasmus Wriedt Larsen
8fe483d9d8
Python: Add example of missing use-use flow
...
(see PR for more detailed description)
2024-03-08 13:26:01 +01:00
Rasmus Lerchedahl Petersen
6d8d106d91
Python: add test for ReturnValue.TupleElement[n]
2024-03-08 11:18:51 +01:00
Tom Hvitved
24e35f6f3d
Update expected test output
2024-03-08 10:00:43 +01:00
Taus
5202792163
Merge pull request #15754 from github/tausbn/python-copy-extractor-to-external-repo
...
Python: Copy Python extractor to `codeql` repo
2024-03-07 15:15:28 +01:00
Taus
4b0689b6ba
Python: Add warnOnImplicitThis: true to qlpack.yml
2024-03-07 13:59:16 +00:00
Taus
6dec323cfc
Python: Copy Python extractor to codeql repo
2024-03-07 13:59:16 +00:00
Rasmus Wriedt Larsen
4dd8f6e618
Python: Add example of missing use-use flow
...
(see PR for more detailed description)
2024-03-07 14:25:55 +01:00
github-actions[bot]
dc9092c9ec
Post-release preparation for codeql-cli-2.16.4
2024-03-06 22:19:33 +00:00
github-actions[bot]
2f058ffb4d
Release preparation for version 2.16.4
2024-03-06 20:56:51 +00:00
Angela P Wen
ce31f8641a
Revert "Release preparation for version 2.16.4"
2024-03-06 12:07:33 -08:00
github-actions[bot]
661e68dab5
Release preparation for version 2.16.4
2024-03-05 18:13:58 +00:00
