yoff
a5101bdae6
Merge pull request #18855 from Kwstubbs/ssrf_documentation
...
Python: Add more documentation in regards to SSRF
2025-03-12 15:27:01 +01:00
Taus
a9ab39da1b
Merge pull request #18448 from github/tausbn/python-add-type-annotation-metrics-query
...
Python: Add metrics query for type annotations
2025-03-06 13:52:26 +01:00
Joe Farebrother
a06de21f45
Python: Include py/not-named-self and py/not-named-cls in the CCR suite.
2025-03-05 15:13:20 +00:00
Taus
5d3b40d514
Python: Add change note
2025-03-04 14:47:03 +00:00
Taus
88615f427b
Python: Add support for forward declarations in unused var query
...
Fixes the false positive reported in
https://github.com/github/codeql/issues/18910
Adds a new `Annotation` class (subclass of `Expr`) which encompasses all
possible kinds of annotations in Python.
Using this, we look for string literals which are part of an annotation,
and which have the same content as the name of a (potentially) unused
global variable, and in that case we do not produce an alert.
In future, we may want to support inspecting such string literals more
deeply (e.g. to support stuff like "list[unused_var]"), but I think for
now this level of support is sufficient.
2025-03-04 14:41:45 +00:00
github-actions[bot]
58f355ae5a
Post-release preparation for codeql-cli-2.20.6
2025-03-03 18:18:15 +00:00
github-actions[bot]
fa850cccb1
Release preparation for version 2.20.6
2025-03-03 17:13:19 +00:00
Kevin Stubbings
04476ca5f4
Add more choices to SSRF remediation
2025-02-25 00:16:48 -08:00
github-actions[bot]
ad24f94a77
Post-release preparation for codeql-cli-2.20.5
2025-02-17 17:58:24 +00:00
github-actions[bot]
6f4562f3bd
Release preparation for version 2.20.5
2025-02-17 16:55:54 +00:00
Joe Farebrother
180e45d66a
Merge pull request #18599 from joefarebrother/python-qual-not-named-self-cls
...
Python: Modernize py/not-named-self and py/not-named-cls queries
2025-02-17 08:58:34 +00:00
Joe Farebrother
f46a2a1773
Exclude some decorators
2025-02-12 09:40:45 +00:00
Asger F
eedfa4dbb2
Merge pull request #18341 from asgerf/py/diff-informed
...
Python: enable diff-informed data flow queries
2025-02-11 13:15:44 +01:00
Joe Farebrother
61d5a692fb
Refactor metaclass logic a bit, ensure lambdas are excluded
2025-02-07 21:46:30 +00:00
Asger F
d3ee658399
Python: resolve remaining TODOs
2025-02-06 10:27:56 +01:00
Asger F
975ce064fc
Python: implement for polynomial redos
2025-02-06 10:27:45 +01:00
Asger F
15c2ccb880
Python: ignore experimental for now
2025-02-06 10:27:43 +01:00
Asger F
9dfd1cc608
Python: Fixup broken patch
2025-02-06 10:27:21 +01:00
Asger F
e4a1847dad
Python: mass enable diff-informed data flow
2025-02-06 10:27:19 +01:00
Remco Vermeulen
9894e9ef9f
Add CCR suites
2025-02-05 01:58:34 +00:00
Joe Farebrother
287cf0121d
Fix docs
2025-02-04 15:28:13 +00:00
Joe Farebrother
3802a73f47
Update docs
2025-02-04 14:46:02 +00:00
Joe Farebrother
e8adef18a3
Update to inline expectations + fixes
2025-02-04 14:45:59 +00:00
Joe Farebrother
0bf8d4ec4b
Exclude 'methods' used in initialisation, and allow self for metaclass methods
2025-02-04 14:45:52 +00:00
Joe Farebrother
fa76bf3c9f
Fix formatting and rewrite redundant exists
2025-02-04 14:45:48 +00:00
Joe Farebrother
526e235fc1
Update NonSelf and NonCls queries
2025-02-04 14:45:44 +00:00
github-actions[bot]
f1b05a79a4
Post-release preparation for codeql-cli-2.20.4
2025-02-04 09:25:09 +00:00
github-actions[bot]
573e53e454
Release preparation for version 2.20.4
2025-02-03 15:19:35 +00:00
github-actions[bot]
fbb7f0a0c6
Post-release preparation for codeql-cli-2.20.2
2025-01-20 21:11:14 +00:00
github-actions[bot]
a0512a50f2
Release preparation for version 2.20.2
2025-01-20 21:11:12 +00:00
Taus
4141b4fb8a
Python: Add metrics query for type annotations
...
Adds a query that counts the number of type annotations of various
kinds. Intended to be used with something like MRVA to inform our
modelling decisions.
Currently the query counts the following "interesting" types in addition
to the total number of types:
- Built-in types (which are less likely to be interesting from a
modelling perspective)
- Forward declarations (i.e. annotations inside strings) which will
require a fair bit of QL machinery to interpret.
- Simple types (stuff like `foo` or `foo.bar.baz`)
- Optional types (stuff like `Optional[foo]` which from a modelling
perspective should likely be treated the same as `foo`)
- Complex types (anything that contains more complex type constructions
such as instantiations of generic types)
2025-01-08 15:41:31 +00:00
github-actions[bot]
fb20f6ca63
Post-release preparation for codeql-cli-2.20.1
2025-01-07 22:07:40 +00:00
github-actions[bot]
88b6f1e79a
Release preparation for version 2.20.1
2025-01-07 20:50:36 +00:00
Dave Bartolomeo
72a53c4b23
Revert "Release preparation for version 2.20.1"
2025-01-07 13:32:23 -05:00
github-actions[bot]
fbf9f2fff8
Release preparation for version 2.20.1
2025-01-07 17:20:13 +00:00
Dave Bartolomeo
22e030584c
Revert "Release preparation for version 2.20.1"
2025-01-07 12:14:27 -05:00
github-actions[bot]
a121c5a5d0
Release preparation for version 2.20.1
2025-01-06 18:20:22 +00:00
Joe Farebrother
8a778da253
Apply suggestions from docs review
...
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com >
2024-12-09 19:58:00 +00:00
Joe Farebrother
ebaab89933
Formatting updates
2024-12-09 19:57:25 +00:00
Joe Farebrother
6e16ed52e8
Reveiw suggestions: Spelling/grammar fixes
...
Co-authored-by: Taus <tausbn@github.com >
2024-12-09 19:56:59 +00:00
Joe Farebrother
494d779541
Add changenote
2024-12-09 19:56:38 +00:00
Joe Farebrother
f0163894b6
fix link in qhelp refs
2024-12-09 19:56:25 +00:00
Joe Farebrother
4602c5c905
Remove experimental version + qhelp fixes
2024-12-09 19:56:18 +00:00
Joe Farebrother
e4e02ec674
Add security severity + fix qhelp
2024-12-09 19:56:03 +00:00
Joe Farebrother
02f395f5f8
Add qhelp
2024-12-09 19:55:57 +00:00
Joe Farebrother
1cb01a286d
Add tests for jinja
2024-12-09 19:55:36 +00:00
Joe Farebrother
60d8a85a9c
Promote jinja sinks
2024-12-09 19:54:57 +00:00
Joe Farebrother
8647073433
Copy template injection to standard pack + add jinja sinks
2024-12-09 19:47:06 +00:00
github-actions[bot]
cf71a1525b
Post-release preparation for codeql-cli-2.20.0
2024-12-04 18:36:17 +00:00
github-actions[bot]
96564b7128
Release preparation for version 2.20.0
2024-12-04 16:01:14 +00:00
