Rasmus Wriedt Larsen
e569d7ae41
Merge branch 'master' into python-parse_qs
2020-04-30 17:05:17 +02:00
Rasmus Wriedt Larsen
e0b4518a3e
Merge branch 'master' into python-improve-file-taint
2020-04-30 11:24:29 +02:00
Rasmus Wriedt Larsen
fe50811bbf
Python: In taint test, list comprehension => for loop
...
Apparently they're not the same thing :(
2020-04-23 14:13:00 +02:00
Rasmus Wriedt Larsen
1fe0040086
Python: Don't use six in urllib.parse string related tests
...
Since this test inheriently has `--max-import-depth=1`, by using six, we would
never look at the actual source-code of urllib.parse/urlparse and therefore the
test would never show if we understood the library code good enough that we
could propagate taint out-of-the-box.
All tests moved by one line... that is why the diff is so big
2020-04-23 13:00:45 +02:00
Rasmus Wriedt Larsen
94ae2febe5
Python: Propagate taint through parse_qsl
2020-04-23 12:14:22 +02:00
Rasmus Wriedt Larsen
86630f1d6c
Python: Handle readline, readlines for ExternalFileObject
2020-04-23 10:40:16 +02:00
Rasmus Wriedt Larsen
7385ea5024
Python: Add tests for ExternalFileObject
2020-04-23 10:36:51 +02:00
Rasmus Wriedt Larsen
30e2592701
Python: Propagate taint through parse_qs
2020-04-22 08:55:35 +02:00
Rasmus Wriedt Larsen
b7145af447
Python: Handle all methods in StringKind.getTaintOfMethodResult
2020-04-20 16:07:30 +02:00
Rasmus Wriedt Larsen
10b36bb7a8
Python: Taint of string method reference isn't handled
2020-04-20 15:01:40 +02:00
Rasmus Wriedt Larsen
fd270cc02c
Python: Add basic taint support for urlsplit/urlparse
2020-02-19 16:31:10 +01:00
Rasmus Wriedt Larsen
74345b1c05
Python: Make library-tests/taint/strings tests more transparent
...
Following the setup I invented for library-tests/taint/unpacking.
TestStep is still a bit annoying, since the output is not easy to eyeball; but
for now I guess we can live with it :)
I honestly didn't get the point of DistinctStringKinds.ql, other than showing we
can handle multiple taint kinds
2020-02-19 16:24:22 +01:00
Rasmus Wriedt Larsen
772538ff46
Python: Move tests of collection-taint to own dir
2020-01-22 14:24:50 +01:00
Rasmus Wriedt Larsen
df8be438bb
Python: Show that list(tainted_string) works
2020-01-22 14:24:50 +01:00
Rasmus Wriedt Larsen
0da78f216a
Python: Show that e, f, g = tainted_list doesn't work
2020-01-22 14:24:50 +01:00
Rasmus Wriedt Larsen
a55c13e61c
Python: Improve tests for StringDictKind taint
...
+ show we handle dict.values()
+ show we don't handle dict.items()
2020-01-22 14:24:50 +01:00
Mark Shannon
05b69a1c0f
QL tests for Python queries and libraries.
2018-11-19 15:15:54 +00:00
