Geoffrey White
8bb12d1507
Merge pull request #22005 from github/dependabot/pip/misc/codegen/pip-02f7ad5a4b
...
Bump the pip group across 2 directories with 2 updates
2026-07-08 14:37:05 +01:00
Owen Mansel-Chan
5497f2c5fe
Convert Python qlref tests to inline expectations
2026-06-19 12:22:40 +01:00
dependabot[bot]
880011ce13
Bump the pip group across 2 directories with 2 updates
...
Bumps the pip group with 1 update in the /misc/codegen directory: [pytest](https://github.com/pytest-dev/pytest ).
Bumps the pip group with 1 update in the /python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC directory: [pymongo](https://github.com/mongodb/mongo-python-driver ).
Updates `pytest` from 8.3.5 to 9.0.3
- [Release notes](https://github.com/pytest-dev/pytest/releases )
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pytest-dev/pytest/compare/8.3.5...9.0.3 )
Updates `pymongo` from 3.9 to 4.6.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases )
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst )
- [Commits](https://github.com/mongodb/mongo-python-driver/compare/3.9.0...4.6.3 )
---
updated-dependencies:
- dependency-name: pytest
dependency-version: 9.0.3
dependency-type: direct:production
dependency-group: pip
- dependency-name: pymongo
dependency-version: 4.6.3
dependency-type: direct:production
dependency-group: pip
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-06-18 10:24:33 +00:00
Rasmus Wriedt Larsen
9b73bbfc31
Python: Add keyword argument support
...
and a fair bit of refactoring
2023-09-29 13:54:21 +02:00
Rasmus Lerchedahl Petersen
4ec8b3f02f
Python: Model map_reduce
2023-09-20 15:44:12 +02:00
Rasmus Lerchedahl Petersen
7c085ecc61
Python: Add test for map_reduce
...
Also log requirement for old versions of `pymongo`
2023-09-20 15:23:18 +02:00
Rasmus Lerchedahl Petersen
30c37ca8cb
Python: model §accumulator
...
also slightly rearrange the modelling
2023-09-19 22:21:14 +02:00
Rasmus Lerchedahl Petersen
5611bda7ee
Python: add test for $accumulator
2023-09-19 17:04:28 +02:00
Rasmus Lerchedahl Petersen
a063d7d510
Python: sinks -> decodings
...
Query operators that interpret JavaScript
are no longer considered sinks.
Instead they are considered decodings
and the output is the tainted dictionary.
The state changes to `DictInput` to reflect
that the user now controls a dangerous dictionary.
This fixes the spurious result and moves the error reporting
to a more logical place.
2023-09-11 16:33:20 +02:00
Rasmus Lerchedahl Petersen
d9f63e1ed3
Python: Split modelling of query operators
...
`$where` and `$function` behave quite differently.
2023-09-11 15:54:00 +02:00
Rasmus Lerchedahl Petersen
154a36934d
Python: Add test for function
2023-09-11 14:49:03 +02:00
Rasmus Lerchedahl Petersen
d91cd21204
Python: rename file
2023-09-08 13:37:54 +02:00
Rasmus Lerchedahl Petersen
b07d085157
Python: make test PoC a proper package
2023-09-07 15:04:27 +02:00
Rasmus Lerchedahl Petersen
c0b3245a53
Python: Enrich the NoSql concept
...
This allows us to make more precise modelling
The query tests now pass.
I do wonder, if there is a cleaner approach, similar to
`TaintedObject` in JavaScript. I want the option to
get this query in the hands of the custumors before
such an investigation, though.
2023-09-07 10:22:37 +02:00
Rasmus Lerchedahl Petersen
114984bd8c
Python: Added tests based on security analysis
...
currently we do not:
- recognize the pattern
`{'author': {"$eq": author}}` as protected
- recognize arguements to `$where` (and friends)
as vulnerable
2023-09-07 10:22:37 +02:00
