8 Commits

Author	SHA1	Message	Date
Rasmus Wriedt Larsen	baafd9f8ba	Python: Add an other path injection FP ... Along with the root cause, which is the `StringConstCompare` BarrierGuard, that does only allows `in <iterable literal>` and not `in <variable referencing iterable literal>`	2021-11-23 12:59:15 +01:00
Rasmus Wriedt Larsen	f70e4fea55	Python: Add interesting path-injection FP	2021-11-09 14:53:32 +01:00
Rasmus Wriedt Larsen	7afe3972d8	Revert "Merge pull request #5171 from RasmusWL/restructure-queries" ... This reverts commit 8caafb3710, reversing changes made to ec79094957.	2021-02-17 16:32:53 +01:00
Rasmus Wriedt Larsen	8494fcf45f	Python: Move query tests to reflect new file layout	2021-02-16 13:15:01 +01:00
Rasmus Wriedt Larsen	a9ce067e15	Python: Add examples of Path Injection FPs seen ... Not quite sure how to deal with these cases of safe if UNIX-only, otherwise not safe. If/when we actually try to deal with these, we also need to figure that out. We _could_ split this queyr into 3: (1) for path injection on any platform, (2) path injection on windows, (3) path injection on UNIX. Then UNIX-only projects could disable the path-injection on windows query. -- that's my best idea, if you have better ideas, DO tell 👍	2020-12-03 13:41:55 +01:00
Rasmus Wriedt Larsen	bd5cf80352	Python: Add Path Injection tests for realpath and abspath ... Not supported currently	2020-12-03 13:41:53 +01:00
Rasmus Wriedt Larsen	4d9f24a24c	Python: Rewrite path injection tests ... To match how you would normally structure your application code. In itself not that important, but makes it easier to add more tests :)	2020-12-03 13:41:26 +01:00
Taus Brock-Nannestad	b620b9b7c6	Python: Fixup CWE-022 tests ... This was a bit of a mess, since there was crosstalk between the TarSlip and PathInjection queries. (Also one of these needs the `options` file to be in one way, and the other not). To fix this, I split these out into separate directories.	2020-11-02 11:46:28 +01:00