932 Commits

Author	SHA1	Message	Date
Mark Shannon	90bbfd3b16	Python: Add library tests for django.	2019-04-26 16:21:46 +01:00
Mark Shannon	4a03fd03cd	Update test to reflect new true positive.	2019-04-26 16:21:46 +01:00
Taus	7d2c17f27c	Merge pull request #1271 from markshannon/python-fix-fp-http-prefix ... Python: Fix false positive in 'Incomplete URL substring sanitization' query	2019-04-26 15:23:04 +02:00
Mark Shannon	28799441af	Python: Fix false positive in 'Incomplete URL substring sanitization' query.	2019-04-25 18:11:01 +01:00
Mark Shannon	6a9bb5c5c9	Add test confirming correct handling of zope.interface.Interface in query.	2019-04-23 12:52:50 +01:00
Mark Shannon	2ba122373a	Merge pull request #1128 from taus-semmle/python-paramiko-unsafe-host-key-validation ... Python: Add query for insecure SSH host key policies in Paramiko.	2019-04-04 16:57:13 +01:00
Taus	702fc80054	Merge pull request #1166 from Semmle/rc/1.20 ... Merge rc/1.20 into master	2019-03-26 13:09:40 +01:00
Mark Shannon	2edde1fed8	Python taint-tracking. Handle early exit and 'not' correctly for 'falsey' taints.	2019-03-22 11:58:23 +00:00
Taus Brock-Nannestad	5eb63ae048	Fix false positive and add test.	2019-03-21 14:10:05 +01:00
Taus Brock-Nannestad	9cb35a8ca9	Use correct named argument for ssl.SSLContext.	2019-03-21 14:09:25 +01:00
Taus Brock-Nannestad	c7c6c83627	Address review comments.	2019-03-19 15:44:11 +01:00
Taus Brock-Nannestad	52278b25d9	Python: Add query for insecure SSH host key policies in Paramiko.	2019-03-18 16:45:54 +01:00
Taus	af1c502b11	Merge pull request #1098 from markshannon/python-2-print ... Python: Don't report Python 2 print statements as having no effect.	2019-03-15 11:40:32 +01:00
Mark Shannon	e9a45268a8	Python: Don't report Python 2 print statements as having no effect.	2019-03-13 10:08:07 +00:00
Mark Shannon	28c20a3216	Python: Fix false positive for redundant comparison query when a complex comparison is negated.	2019-03-12 15:07:49 +00:00
Mark Shannon	38a5fb715a	Python: Avoid cross-talk between unrelated sources in py/stack-trace-exposure query.	2019-03-05 16:52:28 +00:00
Mark Shannon	94190e76aa	Python: Update py/modification-of-default-value to account for truthiness of default value.	2019-03-01 12:01:39 +00:00
Taus Brock-Nannestad	64e6974aac	Merge branch 'master' into python-mutable-default-with-flow	2019-03-01 11:10:56 +01:00
Mark Shannon	6c82be8bda	Python: CherryPy web framework support -- requests.	2019-02-28 15:24:58 +00:00
Taus	b8b4216352	Merge pull request #979 from markshannon/python-falcon ... Python: Add support for falcon web API framework.	2019-02-28 15:47:35 +01:00
Mark Shannon	f7d7b8eef2	Merge pull request #785 from taus-semmle/python-unsafe-use-of-mktemp ... Python: Add query for unsafe use of `tempfile.mktemp`.	2019-02-27 15:01:06 +00:00
Mark Shannon	742c1d0fa7	Python: Add test skeleton for falcon web framework.	2019-02-27 09:53:20 +00:00
Taus	dcaf0f8ba8	Merge pull request #978 from markshannon/python-turbogears ... Python: Add support for turbogears; requests and responses.	2019-02-26 21:46:01 +01:00
Taus Brock-Nannestad	e47b391329	Fix interpolation.	2019-02-26 16:27:04 +01:00
Taus Brock-Nannestad	7daaf77183	Make query alert refer to AST nodes rather than CFG nodes.	2019-02-26 15:56:37 +01:00
Taus Brock-Nannestad	8d774cd354	Merge branch 'master' into python-unsafe-use-of-mktemp	2019-02-26 13:23:38 +01:00
Mark Shannon	26c5ebde54	Python: Basic support for TurboGears: requests and responses.	2019-02-26 10:15:36 +00:00
Mark Shannon	c1b8f500c7	Python: Make sure packages have locations, so they can be displayed, even if those locations are meaningless.	2019-02-21 12:53:59 +00:00
Mark Shannon	aab0a243dc	Python: Add redirects to bottle framework support.	2019-02-12 14:26:06 +00:00
Mark Shannon	8d525e5295	Python: Add support for bottle framework routing and requests.	2019-02-12 14:26:06 +00:00
Taus	90eccbdf76	Merge pull request #836 from markshannon/python-mutating-descriptor ... Python: Fix up mutating-descriptor query	2019-02-08 15:10:30 +01:00
Taus Brock-Nannestad	895b237e3c	Python: Make "Modification of parameter with default" flow-sensitive.	2019-02-04 19:05:04 +01:00
Mark Shannon	24d678b869	Python: Points-to; let values with no boolean constant value flow through pi-nodes.	2019-01-31 15:15:49 +00:00
Taus Brock-Nannestad	edd4468d08	Fix tests by stubbing relevant os functions.	2019-01-29 17:27:14 +01:00
Taus	6f7c96db54	Merge branch 'master' into python-unsafe-use-of-mktemp	2019-01-29 16:12:53 +01:00
Taus Brock-Nannestad	9a9d902cfb	Add support for os.tempnam and os.tmpnam.	2019-01-29 16:08:32 +01:00
Mark Shannon	7fe3c3d516	Merge branch 'master' into python-mutating-descriptor	2019-01-29 14:46:33 +00:00
Taus	9adb19f3a9	Merge branch 'master' into python-incomplete-url-sanitize	2019-01-29 14:17:37 +01:00
Taus	0f5b21e392	Merge pull request #807 from markshannon/python-insecure-file-permission ... Python: Weak file permissions query.	2019-01-28 23:21:10 +01:00
Mark Shannon	6d553ae2be	Python: Check os.open as well as os.chmod for weak file permissions.	2019-01-28 14:26:16 +00:00
Mark Shannon	3992346add	Python: Fix up mutating-descriptor query to only flag mutation when they occur during descriptor protocol.	2019-01-28 12:57:18 +00:00
Mark Shannon	5da209f876	Python: add failing test for comparison using 'is' and enum members.	2019-01-28 12:19:54 +00:00
Taus	fc00e0a64a	Merge pull request #796 from markshannon/python-import-used-in-doctest ... Python: Fix 'unused import' for doctests and typehints.	2019-01-25 16:14:08 +01:00
Mark Shannon	88d8cb514c	Python: Two new queries for URL and hostname sanitization (CWE-020).	2019-01-24 12:57:14 +00:00
Mark Shannon	547b3eb973	Python: Fix 'unused import' to no longer give alerts for imported modules used in typehints.	2019-01-22 17:38:09 +00:00
Mark Shannon	a3b5769c2c	Python: Weak file permissions query.	2019-01-22 11:33:19 +00:00
Mark Shannon	261cd36b8c	Merge pull request #781 from kevinbackhouse/HashedButNoHash ... Python: fix false positive result.	2019-01-18 21:56:12 +00:00
Mark Shannon	9f93bf8d17	Python: Fix 'unused import' to no longer give alerts for imported modules used in doctests.	2019-01-18 11:08:53 +00:00
Kevin Backhouse	5fc056beb3	Add regression test for false positive result.	2019-01-17 16:22:19 +00:00
Taus Brock-Nannestad	ad429f5ae1	Add tests.	2019-01-17 14:45:25 +01:00