hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-31 15:33:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
17,792 Commits 1,815 Branches 172 Tags
feature/service-stack
Commit Graph

17792 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Rasmus Wriedt Larsen
87f31a96d7 Python: Add flask_attr helper 2020-10-23 14:31:28 +02:00
Rasmus Wriedt Larsen
bfc29bb349 Python: Add annotations for flask response tests 
The fact that we need to add routeSetup and routeHandler annotations is sort of
annoying :|
 2020-10-23 14:31:27 +02:00
Rasmus Wriedt Larsen
47dcc09992 Python: Add tests for creating HTTP responses in flask 
Which is runnable, if you have flask installed locally
 2020-10-23 14:31:26 +02:00
Rasmus Wriedt Larsen
8aaa36bd99 Python: Port ReflectedXss query (and tests) 2020-10-23 14:31:25 +02:00
Rasmus Wriedt Larsen
df6fd53a7e Python: Add HttpResponse concept 
We might need to rework this a bit when we also start to handle redirects. I
could see a world where we simply allow http redirects to be subclasses of http
responses, and need to manually exclude them from queries (or create
HttpContentResponse to model the HttpResponses that will contain a body). Let us
see where the wind will take us.

I looked through JS and Go libraries, but I didn't feel their modeling would map
very well to Python.
 2020-10-23 14:31:25 +02:00
Rasmus Wriedt Larsen
0d6165883c Python: Fix spelling for Server::RouteSetup documentation 2020-10-23 14:31:24 +02:00
CodeQL CI
bbda22c769 Merge pull request #4534 from RasmusWL/python-update-flask-modeling 
Approved by tausbn
 2020-10-23 13:28:19 +01:00
Rasmus Wriedt Larsen
b3e53f8d0a Python: Model django.conf.urls.url (v 1.x) 2020-10-23 14:26:37 +02:00
Taus Brock-Nannestad
6d81ca12c4 Python: Fix bad join order in adjacentUseUseSameVar 2020-10-23 14:08:45 +02:00
Rasmus Wriedt Larsen
ed0fe29d7d Python: Fix grammar 
Co-authored-by: Taus <tausbn@github.com>
 2020-10-23 13:53:16 +02:00
Rasmus Wriedt Larsen
be166d9c02 Python: Expand Django 2/3 routing tests with 1.x way 
Added it to the `testapp` so it's easy to run the server to SEE that it works.

Added it to `routing_test` so it's obvious this is supported by our modeling
when we _know_ it's running Django 2/3.
 2020-10-23 13:43:27 +02:00
yoff
462e839a83 Update python/ql/src/experimental/Security-new-dataflow/CWE-022/PathInjection.ql 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2020-10-23 13:35:13 +02:00
luchua-bc
f5f7259937 Revamp the query to implement AdditionalTaintStep 2020-10-23 12:00:36 +01:00
luchua-bc
3c5c8494b1 Refine the query to check intents coming from outside only 2020-10-23 11:58:16 +01:00
luchua-bc
f86413a9b5 text changes 2020-10-23 11:58:12 +01:00
Bt2018
2ddeb0b169 Add method access qualifier as source 2020-10-23 11:57:02 +01:00
luchua-bc
f5ca459795 Add remote source of Android intent extra 2020-10-23 11:57:01 +01:00
Jonas Jensen
08bf464437 Merge pull request #4540 from criemen/printast-performance 
C++: Improve PrintAST performance if only individual files are printed
 2020-10-23 12:46:34 +02:00
Rasmus Wriedt Larsen
ae60ac211b Python: Annotate django v1 routing tests 
Again need to remove trailing $, since inline-expectation tests still don't
handle $
 2020-10-23 12:05:05 +02:00
Rasmus Wriedt Larsen
78ab637b54 Python: Port django v1 tests 2020-10-23 12:00:27 +02:00
Rasmus Lerchedahl Petersen
f88cc3c98e Python: Use custom PathGraph 2020-10-23 01:10:21 +02:00
Rasmus Wriedt Larsen
41ec4f8166 Python: Use FlaskModel as workaround name 
As suggested by Taus 👍
 2020-10-22 19:13:26 +02:00
Cornelius Riemenschneider
6b072686ab C++: Improve PrintAST performance. 
This improves the performance of the printAst.ql query by excluding a lot of string concatenations that happen in files unrelated to the one the user is interested in printing.
This is supposed to help the performance of the AST Viewer on bigger databases.
 2020-10-22 16:38:52 +02:00
Mathias Vorreiter Pedersen
a1b59e2d6c Merge pull request #4538 from geoffw0/taintbug 
C++: Add taint test for memcpy-ing into a vector
 2020-10-22 16:05:56 +02:00
Mathias Vorreiter Pedersen
90c027f291 Merge pull request #4532 from geoffw0/wrongtypeformaterr 
C++: Harden queries against ErroneousType
 2020-10-22 14:21:14 +02:00
Geoffrey White
ceea947f5e C++: Add another test case. 2020-10-22 12:41:23 +01:00
Mathias Vorreiter Pedersen
d0dd71ba10 Apply suggestions from code review 
Co-authored-by: hubwriter <54933897+hubwriter@users.noreply.github.com>
 2020-10-22 12:53:35 +02:00
Rasmus Lerchedahl Petersen
8ce5f41366 Python: Fix source of second part of path 2020-10-22 12:20:50 +02:00
Rasmus Lerchedahl Petersen
8549c9cfde Python: Rewrite logic to split on nomalization 2020-10-22 11:35:55 +02:00
Rasmus Lerchedahl Petersen
391925532d Python: PathCheck StartswithCall 
Should this use `Value::named`?
 2020-10-22 11:34:07 +02:00
Rasmus Lerchedahl Petersen
6e361c7793 Python: Make PathCheck a BarrierGuard 2020-10-22 11:32:18 +02:00
Calum Grant
7544bc872a Merge pull request #3974 from owen-mc/docs/query-classification-and-display 
Docs: Query classification and display
 2020-10-22 10:01:19 +01:00
Geoffrey White
3cca8443f8 C++: Add memcpy(vector test. 2020-10-22 09:46:07 +01:00
Geoffrey White
227bf91626 C++: Correct test annotation. 2020-10-22 09:45:09 +01:00
Erik Krogh Kristensen
e89e99deaa Merge pull request #4461 from erik-krogh/pyPrint 
Python: implement printAst for Python
 2020-10-22 09:37:10 +02:00
Rasmus Lerchedahl Petersen
f8dba85e0f Python: PathNormalization os.path.normpath 2020-10-21 22:21:40 +02:00
Rasmus Lerchedahl Petersen
17273dd27e Python: Add FileSystemAccess open 2020-10-21 22:01:49 +02:00
Rasmus Lerchedahl Petersen
4570c29a11 Python: port query 2020-10-21 21:40:42 +02:00
Rasmus Lerchedahl Petersen
eb5ed23354 Python: Add TaintTracking2 2020-10-21 21:39:50 +02:00
Rasmus Lerchedahl Petersen
da77cbb3d0 Python: concepts PathCheck and PathNormalization 
Should they be in a module?
 2020-10-21 21:37:43 +02:00
Cornelius Riemenschneider
9388448053 C++: Extend jump-to-def support to template instantiations. 
This commit extends developers ability to use jump-to-def in C/C++ files opened in the VSCode extension.
Before, jump-to-def starting with code in a template instantiation did not work.

Furthermore, this fixes a bug, as the list of all references of a location did not include template instantiations.
 2020-10-21 21:35:38 +02:00
Rasmus Wriedt Larsen
278c071fe6 Python: Modernise werkzeug FileStorage modeling 2020-10-21 20:36:40 +02:00
Rasmus Wriedt Larsen
d0fdb542e5 Python: Modernise werkzeug MultiDict modeling 2020-10-21 20:30:20 +02:00
Rasmus Wriedt Larsen
b6bd70a5da Python: Modernise flask library modeling 
Two interesting things happened while doing this:

1. I found out that you can't use the same name to define a submodule as any
parent module. So we need give unique names to the top-level module, and the
module for modeling the `flask.Flask` class. I randomly choose a new name for
the top-level module to get things moving (and not be stuck in bikeshedding
forever).

2. With this new setup, I wanted to expose the `route` and `add_url_rule`
methods on instances of `flask.Flask`. It wasn't quite obvious how to do so. I
simply lumped them next to `classRef()` and `instance()`, without too much
care. I did consider putting them inside a `instance` module, which would allow
you to access them by `flask::Flask::instance::route()`, but I wasn't quite
sure, and just did something easy to get moving.
 2020-10-21 20:30:14 +02:00
Rasmus Wriedt Larsen
62d665ecb3 Python: Fix shared QLDoc for InstanceSource 2020-10-21 19:55:40 +02:00
Rasmus Wriedt Larsen
047a326183 Python: Remove reference to old PR 
These have been added to internal tracking issue instead
 2020-10-21 19:53:25 +02:00
Rasmus Lerchedahl Petersen
2e8cbbd866 Python: Add concept FileSystemAccess 2020-10-21 17:35:21 +02:00
Mathias Vorreiter Pedersen
056a553976 C++: Fix broken qhelp links 2020-10-21 17:26:46 +02:00
Aditya Sharad
9ff5142529 Merge pull request #4525 from adityasharad/js/autobuild-github-hidden-folder 
JavaScript: Include .github hidden folders in autobuild
 2020-10-21 07:10:42 -07:00
Rasmus Wriedt Larsen
a6abee9b3a Merge pull request #4476 from yoff/python-port-sql-injection 
Python: Port SqlInjection
 2020-10-21 15:55:19 +02:00