Rasmus Wriedt Larsen
aeba497832
Merge pull request #7735 from yoff/python/promote-log-injection
...
Python: promote log injection
2022-02-23 16:21:12 +01:00
Taus
3ce7d47b5b
Merge pull request #7452 from jorgectf/python_jwt
...
Python: Add Python_JWT to JWT security query
2022-02-23 15:23:20 +01:00
jorgectf
4aa1c0a11e
Update .expected
2022-02-23 00:55:39 +01:00
jorgectf
7c108c7892
Polish test
2022-02-22 20:57:20 +01:00
Rasmus Wriedt Larsen
b59ab7f5f3
Merge branch 'main' into python/promote-log-injection
2022-02-21 09:59:31 +01:00
Rasmus Wriedt Larsen
5a90214ece
Merge pull request #7783 from yoff/python/promote-ldap-injection
...
Python: promote LDAP injection query
2022-02-15 10:24:18 +01:00
jorgectf
3ccac4ed8a
Update .expected
2022-02-08 23:59:36 +01:00
jorgectf
7b51b91d13
Improve test
2022-02-08 23:33:43 +01:00
Jorge
f1fab98ea2
Merge branch 'github:main' into python_jwt
2022-02-08 23:12:58 +01:00
Rasmus Wriedt Larsen
eb109828c0
Merge pull request #7252 from museljh/feature/cwe-338
...
Python: CWE-338 insecureRandomness
2022-02-07 19:30:06 +01:00
Rasmus Lerchedahl Petersen
20d54543fd
python: move log injection out of experimental
...
- move from custom concept `LogOutput` to standard concept `Logging`
- remove `Log.qll` from experimental frameworks
- fold models into standard models (naively for now)
- stdlib:
- make Logger module public
- broaden definition of instance
- add `extra` keyword as possible source
- flak: add app.logger as logger instance
- django: `add django.utils.log.request_logger` as logger instance
(should we add the rest?)
- remove LogOutput from experimental concepts
2022-01-31 11:27:55 +01:00
Rasmus Lerchedahl Petersen
4c3c4deb34
python: Move over query and tests
2022-01-28 09:19:11 +01:00
Rasmus Lerchedahl Petersen
9aa4c4a6a7
python: Add missing input
...
also update test expectation
2022-01-21 13:55:33 +01:00
jorgectf
1f1b7a54f8
Update .expected
2021-12-19 18:58:43 +01:00
jorgectf
98c8503ebd
Fix test mismatch
2021-12-19 18:35:53 +01:00
jorgectf
f82ed8573e
Model python_jwt.process_jwt
2021-12-19 18:32:14 +01:00
liangjinhuang
1102f60f3e
add tests
2021-12-04 00:52:15 +08:00
jorgectf
3fe2a08376
Update .expected file
2021-11-16 15:03:49 +01:00
jorgectf
3dec222922
Merge remote-tracking branch 'origin/main' into jorgectf/python/jwt-queries
2021-10-28 13:11:46 +02:00
jorgectf
271e2e4c49
Update .expected
2021-10-16 13:12:33 +02:00
jorgectf
45146bc798
Merge branch 'main' into jorgectf/python/headerInjection
2021-10-16 12:46:57 +02:00
jorgectf
bf76d9cd8b
Fix django test
2021-10-16 10:45:25 +02:00
jorgectf
2db1ffef1e
Merge remote-tracking branch 'origin/main' into jorgectf/python/headerInjection
2021-10-16 10:40:52 +02:00
Rasmus Lerchedahl Petersen
61008fd3d0
Merge branch 'main' of github.com:github/codeql into python/promote-regex-injection
2021-10-12 11:28:12 +02:00
yoff
43f7eede0b
Merge pull request #6182 from haby0/python/LogInjection
...
Python: CWE-117 Log injection
2021-10-12 10:54:45 +02:00
yoff
0629ce00de
Merge pull request #6214 from haby0/python/ClientSuppliedIpUsedInSecurityCheck
...
[Python] CWE-348: Client supplied ip used in security check
2021-10-11 16:38:04 +02:00
haby0
c2d0fcfbe6
Update python/ql/test/experimental/query-tests/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.expected
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-10-11 16:46:02 +08:00
haby0
29ddc76e2f
Update python/ql/test/experimental/query-tests/Security/CWE-117/LogInjection.expected
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-10-11 16:43:30 +08:00
Rasmus Wriedt Larsen
547cbb6322
Merge pull request #6331 from porcupineyhairs/pythonXpath
...
Python : Improve Xpath Injection Query
2021-09-24 18:11:08 +02:00
Rasmus Wriedt Larsen
d39df18544
Python: Minor test cleanup
2021-09-24 16:11:27 +02:00
Rasmus Wriedt Larsen
26d2fbd217
Python: Fix new XPath injection query
...
Fixes the typo `ETXpath` => `ETXPath`
2021-09-24 15:11:34 +02:00
Rasmus Wriedt Larsen
913a679ef5
Python: Replace old XPath injection query
2021-09-24 15:10:41 +02:00
Rasmus Wriedt Larsen
ef6e502ff0
Python: Make LDAP global options test better
...
Before it didn't really showcase that we know it can make connections
secure.
2021-09-23 10:18:18 +02:00
haby0
c60eded2de
Fix conflicting
2021-09-15 11:07:43 +08:00
Rasmus Lerchedahl Petersen
1c7982b319
Python: Move query tests over
2021-09-14 13:29:21 +02:00
jorgectf
b505662ef9
Fix global test and update .expected
2021-09-14 10:20:50 +02:00
jorgectf
2ccc6dc092
Merge branch 'main' into jorgectf/python/ldapinsecureauth
2021-09-14 09:32:19 +02:00
jorgectf
18b05bc56e
Fix tests and add global option
2021-09-12 20:35:57 +02:00
jorgectf
eee9b3f39e
Merge remote-tracking branch 'origin/main' into jorgectf/python/headerInjection
2021-09-07 19:54:58 +02:00
Anders Schack-Mulligen
f30dad7705
Dataflow: Update test expected outputs.
2021-09-07 13:02:20 +02:00
jorgectf
64b305cf7a
Add .qhelp along with its example
2021-08-26 23:29:45 +02:00
jorgectf
786edb72df
Update .expected
2021-08-26 12:36:34 +02:00
jorgectf
e6ce10b5c5
Merge remote-tracking branch 'origin/main' into jty/python/nosqlInjection
2021-08-10 20:01:08 +02:00
jorgectf
f9b244ecad
Polish documentation
2021-07-24 01:06:05 +02:00
jorgectf
b03e75e3d1
Extend ldap3's start_tls and fix tests
2021-07-22 18:42:41 +02:00
jorgectf
a34d6d390e
Port to ApiGraphs and finish the query
2021-07-22 18:34:57 +02:00
jorgectf
68f79f054b
Update .expected
2021-07-21 21:32:08 +02:00
jorgectf
8d84d63b94
Add Python-Jose modeling and tests
2021-07-21 21:31:53 +02:00
jorgectf
ce507beed4
Add Authlib modeling and tests
2021-07-21 21:31:35 +02:00
jorgectf
e14b10370e
Add indeterminate test to pyjwt
2021-07-21 21:30:54 +02:00
