hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
81,482 Commits 1,672 Branches 157 Tags
move-cors-query-from-experimental2
Commit Graph

4711 Commits

Author SHA1 Message Date
Rasmus Lerchedahl Petersen
96b7f75905 Python: add postupdate nodes for kwargs 
drops remaining reverse read failures on saltstack.
 2021-01-25 17:34:49 +01:00
Rasmus Lerchedahl Petersen
ad39bfb2ff Python: Add postupdate nodes for subscripts. 
This drops reverse read inconsistencies on saltstack from 14909 to 1353.
 2021-01-25 17:01:25 +01:00
Rasmus Lerchedahl Petersen
89e56707c3 Python: Omit all unresolved parameter nodes. 
Drops the results further to 139.
 2021-01-24 16:16:07 +01:00
Rasmus Lerchedahl Petersen
baf0917524 On saltstack this drops the number of consistency errors 
of type uniqueEnclosingCallable from 4026 to 614.
 2021-01-24 15:30:59 +01:00
Rasmus Lerchedahl Petersen
0d20a4cb4a Python: Simplify modelling 2021-01-22 19:40:34 +01:00
Rasmus Lerchedahl Petersen
f948ef8f27 Merge branch 'main' of github.com:github/codeql into python-dataflow-unpacking-assignment 2021-01-22 16:26:48 +01:00
Rasmus Wriedt Larsen
7a76a5134e Python: Add redirect modeling for Tornado 
After making https://github.com/github/codeql/pull/4995, I realized how easy
this would be :D

Will need to do some manual merge-conflict handling, but it should be all good
:)
 2021-01-21 14:04:11 +01:00
Rasmus Wriedt Larsen
48083d657a Python: Apply code-review suggestion 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-01-21 13:40:58 +01:00
Rasmus Wriedt Larsen
ee2d18afd8 Merge pull request #4665 from yoff/python-dataflow-modernize-tests 
Python: Add new-style tests
 2021-01-21 13:35:39 +01:00
Rasmus Wriedt Larsen
b55817a5b2 Python: Model HTTP responses in tornado 
This is quite a simpel model, but ends up matching what we were able to do with
points-to.

I think this modeling excercise really shows that we need a bit of a different
way to model HTTP responses... but I'm not going to try to fix that in this PR.
 2021-01-21 13:26:31 +01:00
Rasmus Lerchedahl Petersen
88db8f562d Python: Elaborate comments for steps 2021-01-21 10:55:59 +01:00
Rasmus Lerchedahl Petersen
bc1b50788a Python: Small refactor 2021-01-21 10:44:58 +01:00
Rasmus Lerchedahl Petersen
19918e2e57 Python: Have Node-postfix consistently 2021-01-21 10:43:15 +01:00
Rasmus Lerchedahl Petersen
2409a7899b Python: Remove func tag in some situations. 
Also make ArgumentNode public
 2021-01-20 20:18:40 +01:00
Rasmus Lerchedahl Petersen
7a5d553dd2 Merge branch 'main' of github.com:github/codeql into python-dataflow-unpacking-assignment 2021-01-20 19:27:34 +01:00
yoff
e072864948 Apply suggestions from code review 
Co-authored-by: Taus <tausbn@github.com>
 2021-01-20 17:38:34 +01:00
Rasmus Wriedt Larsen
9a397b6faf Python: Apply code-review suggestion 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-01-20 15:28:20 +01:00
Rasmus Wriedt Larsen
37aa9b9d06 Python: Add prefix sanitizer on URL redirect query 
This doesn't cover 100% of what we want to, but matches what we used to.
 2021-01-20 11:35:47 +01:00
Rasmus Wriedt Larsen
d8bfa3565f Python: Simple port of URL redirect query 
Still have not added sanitizer, but seems like old sanitizer was a bit too broad
(also covering %-formatting)
 2021-01-20 11:35:44 +01:00
Rasmus Wriedt Larsen
ab607b8030 Python: Add redirect modeling for Django 2021-01-19 14:45:41 +01:00
Rasmus Wriedt Larsen
aea974ee0c Python: Add redirect modeling for Flask 2021-01-19 14:44:50 +01:00
Rasmus Wriedt Larsen
efb872ad1e Python: Add HttpRedirectResponse concept 2021-01-19 14:35:19 +01:00
Rasmus Lerchedahl Petersen
bd3de23c6e Python: Remove some unhelpful store steps 2021-01-19 00:05:10 +01:00
Rasmus Wriedt Larsen
8e5557eca3 Python: Avoid duplicated route-setup in django 
When using `django.conf.urls.url` with Django 2+
 2021-01-18 16:18:29 +01:00
Rasmus Lerchedahl Petersen
175e43d6f2 Python: Slight refactor 2021-01-18 09:12:05 +01:00
Rasmus Lerchedahl Petersen
5f189a7e43 Python: Address reviews 2021-01-15 20:18:37 +01:00
yoff
1edad03622 Apply suggestions from code review 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2021-01-15 18:50:04 +01:00
yoff
48910d0597 Apply suggestions from code review 
Co-authored-by: Taus <tausbn@github.com>
 2021-01-15 14:02:27 +01:00
yoff
b5d40e4c9a Merge pull request #4944 from RasmusWL/flask-class-based-handlers 
Python: Add modeling of Flask class based (HTTP) request handlers
 2021-01-14 15:17:36 +01:00
Rasmus Wriedt Larsen
4cb2f2ed1e Python: Proper models of flask MethodView classes 2021-01-14 13:42:18 +01:00
Rasmus Wriedt Larsen
e327fdb317 Python: Model flask View classes 2021-01-14 13:42:18 +01:00
Rasmus Wriedt Larsen
14bb10a361 Python: Use LocalSourceNode for TornadoRouteRegex 2021-01-14 13:39:41 +01:00
Rasmus Wriedt Larsen
812ea5dde5 Python: Tornado: Model request handlers without known route 2021-01-14 13:37:27 +01:00
Rasmus Wriedt Larsen
1849b9e771 Python: Tornado: Handle basic route setup with tuples 
The reason this becomes valueable right now, is that we can mark routed params
as taint-sources. Longer down the line, we can (hopefully) detect that a routed
param will only accept digits, and mark it safe for some of our taint-tracking
queries.
 2021-01-14 13:37:26 +01:00
Rasmus Wriedt Larsen
39d85896a1 Python: Add basic taint modeling of tornado request 2021-01-14 13:37:26 +01:00
Rasmus Wriedt Larsen
4641150d45 Python: Basic taint-modeling of tornado.web.RequestHandler classes 2021-01-14 13:37:25 +01:00
Rasmus Lerchedahl Petersen
dfdfd3c2b7 Python: FIx flow 2021-01-14 01:19:58 +01:00
Rasmus Lerchedahl Petersen
e3199fbbe2 Python: Fix inconsostencies to fix flow 
(and fix annotations again)
 2021-01-14 00:09:18 +01:00
Rasmus Lerchedahl Petersen
36a4a5081e Python: big refactor and fix tests 
Make sure tests are valid
Fix wrong test annotations
Big refactor to make code readable
Big comment to explain code
 2021-01-13 18:33:08 +01:00
Rasmus Lerchedahl Petersen
b10cf78e17 Python: start handling iterated unpacking 2021-01-13 08:40:47 +01:00
Rasmus Lerchedahl Petersen
4ee2f49f38 Python: model conversion during unpacking 2021-01-12 22:19:31 +01:00
Rasmus Wriedt Larsen
2ba7ed4940 Python: Add note about future work for getARequestHandler 2021-01-12 13:32:43 +01:00
Rasmus Lerchedahl Petersen
a1ab5cc2b8 Python: start support for nested unpacking 2021-01-12 13:09:12 +01:00
Rasmus Wriedt Larsen
7d94bab75e Merge branch 'main' into django-request-handler-without-route 2021-01-11 12:24:41 +01:00
Rasmus Wriedt Larsen
828bb9a902 Python: Small refactor for request param modeling in Django 2021-01-11 11:29:54 +01:00
Rasmus Wriedt Larsen
141b9adc4d Python: Minor refactoring 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-01-11 11:18:59 +01:00
Taus
75cfec863f Merge pull request #4828 from yoff/yoff-python-add-source-nodes 
Python: add source nodes
 2021-01-05 15:07:51 +01:00
Rasmus Lerchedahl Petersen
8ceb33d3f7 Python: Also restrict StepSumary::step 2021-01-04 16:42:11 +01:00
Rasmus Wriedt Larsen
71a6ef5b00 Python: Model RequestHandler from standard library explicitly 2020-12-21 18:02:31 +01:00
Rasmus Wriedt Larsen
05ab6cd54a Python: Add RemoteFlowSource for django handler without route 
A bit scary that we don't have any tests to indicate that I forgot to add this :O
 2020-12-21 18:02:30 +01:00