Rasmus Wriedt Larsen
a5834c4d78
Python: Fix py/polynomial-redos
2021-07-15 14:16:19 +02:00
Rasmus Wriedt Larsen
76caf43b54
Python: Add tests for py/polynomial-redos
2021-07-15 14:15:44 +02:00
Rasmus Wriedt Larsen
1be0dc0876
Python: Move test for ReDoS
2021-07-15 14:15:24 +02:00
Erik Krogh Kristensen
383b5f2ff2
implement RegExpSubPattern.getOperand in the Python regexp implementation
2021-07-15 09:41:53 +02:00
Taus
5a9fca48e8
Python: Fix ExceptStmt::getType
...
We were not supporting `except` statements handling multiple exception
types (specified as a tuple) correctly, instead just returning the
tuple itself as the "type" (which makes little sense).
To fix this, we explicitly extract the elements of this node, in the
case where it _is_ a tuple.
This is a change that can potentially affect many queries (as `getType`
is used in quite a few places), so some care should be taken to
ensure that this does not adversely affect performance.
2021-07-14 14:03:49 +00:00
Taus
ec9063b4a5
Python: Add test case for github/codeql#6227
2021-07-14 13:52:32 +00:00
${sleep,5}
51a6140258
Change variable name to correct sanitized input variable
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-07-13 14:04:06 -04:00
Taus
df8a6b984a
Python: Add import * tests
...
Moves the current test out of `test.py`, as otherwise any unknown global
(like, say, `sink`) would _also_ be considered to be something
potentially defined in `unknown`.
2021-07-13 17:46:59 +00:00
Erik Krogh Kristensen
440e4b9a92
enable unicode support in the Python ReDoS query
2021-07-11 21:28:40 +02:00
haby0
e8d0827916
Add tornado source
2021-07-05 10:42:15 +08:00
Taus
a65d40e36f
Merge branch 'main' into python-add-typetrackingnode
2021-07-02 20:55:37 +02:00
Taus
55d822cc56
Python: Add TypeTrackingNode
...
Splits `ModuleVariableNode` away from `LocalSourceNode`, instead
creating a class `TypeTrackingNode` that encapsulates both of these.
This means we no longer have module variable nodes as part of
`LocalSourceNode` (which is good, since they have no "local" aspect to
them), and hence we can have `LocalSourceNode` inherit directly from
`ExprNode` (which makes the API a bit nicer).
Unfortunately these are breaking changes, so we can't actually fulfil
the above two desiderata until the `track` and `backtrack` methods on
`LocalSourceNode` have been fully deprecated. For this reason, we
preserve the present implementation of `LocalSourceNode`, and instead
lay the foundation for switching over in the future, by deprecating
`track` and `backtrack` on `LocalSourceNode`.
2021-07-02 18:00:33 +00:00
CodeQL CI
a25933aa56
Merge pull request #5926 from RasmusWL/small-cleanups
...
Approved by tausbn
2021-07-02 04:59:54 -07:00
haby0
b866f1b21e
Add CWE-348 ClientSuppliedIpUsedInSecurityCheck
2021-07-02 19:30:33 +08:00
jorgectf
7fb44470ee
Add .expected results
2021-07-01 17:53:04 +02:00
jorgectf
07422a1dce
Move tests under test/
2021-07-01 17:51:00 +02:00
Rasmus Wriedt Larsen
b0309dd321
Python: Limit SensitiveDataSources to prevent _some_ cross-talk
2021-07-01 12:08:12 +02:00
Rasmus Wriedt Larsen
d7e3ebb15c
Python: Add tests showing sensitive data cross-talk
2021-07-01 12:05:51 +02:00
Taus
e4af14638b
Merge pull request #6175 from yoff/python-port-ReDoS
...
Python: port ReDoS queries from Javascript
2021-06-30 16:26:07 +02:00
yoff
6a77b890af
Merge pull request #6155 from RasmusWL/port-cleartext-queries
...
Python: Port cleartext queries
2021-06-30 15:52:34 +02:00
Rasmus Lerchedahl Petersen
651f8abba0
Python: Avoid multiple results for toString
2021-06-30 14:39:49 +02:00
Rasmus Wriedt Larsen
c2708176b1
Python: Support %-style formatting for MarkupSafe
2021-06-30 14:15:41 +02:00
Rasmus Wriedt Larsen
0a4efd0e86
Python: Add %-style formatting tests for MarkupSafe
2021-06-30 14:13:59 +02:00
Rasmus Wriedt Larsen
075953860b
Merge branch 'main' into markupsafe-modeling
2021-06-30 13:55:08 +02:00
Rasmus Lerchedahl Petersen
52d91917aa
Merge branch 'python-port-ReDoS' of github.com:yoff/codeql into python-port-ReDoS
2021-06-30 12:25:59 +02:00
Rasmus Lerchedahl Petersen
09e71cfdfd
Python: update test expectations
2021-06-30 12:25:29 +02:00
yoff
c19522e921
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-06-30 11:49:45 +02:00
jorgectf
e02a63a27a
Delete trivial *_good.py tests
2021-06-29 23:03:41 +02:00
jorgectf
621a810b7b
Update .expected
2021-06-29 16:53:53 +02:00
jorgectf
9a8d1f8e0f
Take back non-trivial tests
2021-06-29 16:53:44 +02:00
Rasmus Lerchedahl Petersen
e778a65464
Python: Adjust test expectations
...
so we can see the light go green.
But we should perhaps do something about those duplicate results.
2021-06-29 11:29:42 +02:00
Rasmus Lerchedahl Petersen
fbfe415162
Python: Limit test files
2021-06-29 11:18:24 +02:00
Rasmus Wriedt Larsen
a5a7f3e38a
Python: Add taint-step for sqlalchemy.text
2021-06-29 11:06:25 +02:00
Rasmus Wriedt Larsen
ef48734206
Python: Add taint-tests for SQLAlchemy
2021-06-29 11:03:40 +02:00
Rasmus Wriedt Larsen
cb112395f8
Python: Fixup after merging main
2021-06-29 11:02:43 +02:00
Rasmus Wriedt Larsen
684f51ae5f
Merge branch 'main' into python-use-sqlalchemy
2021-06-29 10:58:51 +02:00
Rasmus Wriedt Larsen
eac1c5d109
Python: Fix concepts-tests for SQLAlchemy
2021-06-29 10:58:28 +02:00
jorgectf
68c683189a
Polish documentation, mongoCollectionMethod() and update .expected
2021-06-28 20:55:49 +02:00
jorgectf
3fd1129895
Delete trivial tests
2021-06-28 20:18:31 +02:00
jorgectf
0ca4f240d9
Merge tests and update .expected
2021-06-28 20:13:53 +02:00
Rasmus Lerchedahl Petersen
40ac91eecd
Python: Add some tests for exponential ReDoS
...
- `KnownCVEs` contain the currently triaged Python CVEs
- `unittest.py` contains some tests constructed by @erik-krogh
- `redos.py` contains a port of `tst.js` from javascript
The expected file has been ported as well with some fixups by @tausbn
2021-06-28 17:04:49 +02:00
Rasmus Lerchedahl Petersen
21007d21f4
Python: track if qualifiers allow unbounded
...
repeats. This in preparation for ReDoS
2021-06-28 17:04:48 +02:00
Rasmus Lerchedahl Petersen
74ca1d00b9
Python: More precise regex parsing
2021-06-28 17:04:48 +02:00
Rasmus Lerchedahl Petersen
e5f07cc4d3
Python: inline test of regex components
...
- Added naive implementation of `charRange` so the test can run.
- Made predicates public as needed.
2021-06-28 17:04:48 +02:00
jorgectf
1d432af498
Update .expected
2021-06-28 14:18:27 +02:00
jorgectf
1d4d8ab6e0
Fix tests
2021-06-28 14:16:52 +02:00
Rasmus Wriedt Larsen
b33f6a315c
Python: Fix select for py/improper-ldap-auth
2021-06-28 10:54:21 +02:00
Rasmus Wriedt Larsen
dfe16aae4c
Python: Handle both positional and keyword args for LDAP bind
2021-06-28 10:46:13 +02:00
Rasmus Wriedt Larsen
97571e0b4f
Python: Add modeling of peewee
2021-06-25 17:50:59 +02:00
Rasmus Wriedt Larsen
c476c89de5
Python: Add tests for peewee
2021-06-25 16:08:57 +02:00
