hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity
78,280 Commits 1,672 Branches 157 Tags
oscarsj/test-cpp-internal-checks
Commit Graph

9236 Commits

Author SHA1 Message Date
thank_you
7773c53124 Replace any(string) with _ wildcard 2021-04-20 08:49:08 -04:00
thank_you
bbd3552392 Rename predicate to getQuery 2021-04-20 08:47:37 -04:00
Taus
76700d17d6 Merge pull request #5684 from RasmusWL/flask-more-taint-tests 
Python: Add taint tests for .get() in flask
 2021-04-20 14:08:08 +02:00
thank_you
c5fbbc0551 Refactor SqlAlchemy model 
- Replaced classes that look for SqlAlchemy instances with predicates
- General clean-up of code
 2021-04-19 18:56:00 -04:00
Taus
bc6685aa3f Python: Fix typo 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2021-04-19 19:57:35 +02:00
Rasmus Wriedt Larsen
d607c13ab6 Python: Taint tests: include elment for forgotten MISSING 2021-04-19 15:01:42 +02:00
Rasmus Wriedt Larsen
9585390941 Python: Taint tests, report error location first 
To better match the standard output from inline expectation tests
 2021-04-19 14:59:47 +02:00
Rasmus Wriedt Larsen
b2cb284ff2 Python: Add more examples of what is ok with new taint tests 2021-04-19 14:56:20 +02:00
Taus
9acc71a7cb Python: Get rid of all _attr methods in Django.qll 2021-04-19 11:54:10 +00:00
yoff
118840dad4 Merge pull request #5690 from tausbn/python-disallow-post-update-nodes-as-local-source-nodes 
Python: Disallow `PostUpdateNode` as `LocalSourceNode`
 2021-04-19 06:56:11 +02:00
Taus
f3661c34ee Python: Clean up Django models using API graphs 
First sweep. Takes care of most of the models.
 2021-04-16 19:53:36 +00:00
Rasmus Wriedt Larsen
3c8ea167c4 Merge pull request #5668 from tausbn/python-use-api-graphs-in-fabric 
Python: Use API graphs in Fabric model
 2021-04-16 14:27:55 +02:00
Rasmus Wriedt Larsen
6ed1016bb8 Merge pull request #5669 from tausbn/python-use-api-graphs-for-invoke 
Python: Use API graphs for Invoke
 2021-04-16 14:27:19 +02:00
Taus
92b4eb7f02 Python: Cleanup and more explanation 
Goes into some detail about the intended semantics of local source nodes
and `flowsTo`.
 2021-04-16 11:54:20 +00:00
Taus
5c79ad2412 Python: Apply suggestions from code review 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2021-04-16 11:38:29 +02:00
Taus
af0c32c01d Python: Apply suggestions from code review 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2021-04-16 11:35:12 +02:00
Rasmus Lerchedahl Petersen
a8280f9b12 Python: update test expectation 2021-04-16 08:25:29 +02:00
Rasmus Lerchedahl Petersen
0678745677 Python: refactor based on review suggestion 2021-04-16 08:22:00 +02:00
Rasmus Lerchedahl Petersen
341dbcef2e Python: simplify code following review suggestion 
also standardise on camelCase.
 2021-04-16 07:41:00 +02:00
Rasmus Lerchedahl Petersen
8aa6b1a87c Python: use standard tracking construction 2021-04-16 07:36:04 +02:00
Taus
451d36dc97 Python: Allow _some_ PostUpdateNodes 
Specifically, allow the ones arising from calls, but not reads or
writes. This should fix the tests.
 2021-04-15 21:26:12 +00:00
thank_you
a854fb8f8b Add documentation and refactor code 2021-04-15 15:22:15 -04:00
Taus
c9c8259ed0 Python: Disallow PostUpdateNode as LocalSourceNode 
Previously, in cases like

```python
def foo(x):
    x.bar()
    x.baz()
    x.quux()
```

we would have flow from the first `x` to each use _and_ flow from the
post-update node for each method call to each subsequent use, and all
of these would be `LocalSourceNode`s. For large functions with the above
pattern, this would lead to a quadratic blowup in `hasLocalSource`.

With this commit, only the first of these will count as a
`LocalSourceNode`, and the blowup disappears.
 2021-04-15 17:56:14 +00:00
Rasmus Wriedt Larsen
3e7dc12246 Python: Port taint tests to use inline expectations 
The meat of this PR is described in the new python/ql/test/experimental/meta/InlineTaintTest.qll file:

> Defines a InlineExpectationsTest for checking whether any arguments in
> `ensure_tainted` and `ensure_not_tainted` calls are tainted.
>
> Also defines query predicates to ensure that:
> - if any arguments to `ensure_not_tainted` are tainted, their annotation is marked with `SPURIOUS`.
> - if any arguments to `ensure_tainted` are not tainted, their annotation is marked with `MISSING`.
>
> The functionality of this module is tested in `ql/test/experimental/meta/inline-taint-test-demo`.
 2021-04-15 18:00:33 +02:00
Rasmus Lerchedahl Petersen
42ae5f4f7d Python: support / from the right 
Will also support both operands being paths
 2021-04-15 16:07:35 +02:00
Rasmus Wriedt Larsen
b359205d17 Python: Add taint tests for .get() in flask 2021-04-15 14:53:44 +02:00
Rasmus Lerchedahl Petersen
d361d999b7 Python: add some path returning functions 
that were only listed as file sytem accesses.
 2021-04-15 10:55:09 +02:00
Rasmus Lerchedahl Petersen
02e41d8018 Python: update annotations 
This because `resolve` accesses the file system,
I am open to not include that fact in the modelling.
 2021-04-15 10:49:22 +02:00
Rasmus Lerchedahl Petersen
3eb1813584 Python: update test expectations 2021-04-15 10:47:49 +02:00
Rasmus Lerchedahl Petersen
c9b2c7885e Python: add changenote 2021-04-15 10:14:35 +02:00
Rasmus Lerchedahl Petersen
52a9040d73 Python update tests 2021-04-15 09:46:53 +02:00
Rasmus Lerchedahl Petersen
2387dc640c Python: Attempts at modelling pathlib-Paths 2021-04-15 09:40:23 +02:00
Rasmus Lerchedahl Petersen
8489403051 Python: Add some tests for pathlib 2021-04-15 09:40:23 +02:00
Thank You
f1e71e21ed Add SqlAlchemy module 2021-04-14 22:00:25 -04:00
Taus
897d12420b Python: Prevent bad join in isinstanceEvaluatesTo 
In some cases, we were joining the result of `val.getClass()` against
the first argument of `Types::improperSubclass` before filtering out the
vast majority of tuples by the call to `isinstance_call`.

To fix this, we let `isinstance_call` take care of figuring out the
class of the value being tested. As a bonus, this cleans up the only
other place where `isinstance_call` is used, where we _also_ want to
know the class of the value being tested in the `isinstance` call.
 2021-04-14 16:49:12 +00:00
Taus
a7fcf52267 Python: Fix bad join in total_cost 
The recent change to `appliesTo` lead to a perturbation in the join
order of this predicate, which resulted in a cartesian product between
`call` and `ctx` being created (before being filtered by `appliesTo`).

By splitting the intermediate result into its own helper predicate,
suitably marked to prevent inlining/magic, we prevent this from
happening again.
 2021-04-14 15:36:01 +00:00
yoff
447f339857 Merge pull request #5641 from tausbn/python-use-localsourcenode-in-typetrackers 
Python: Use API graphs in PEP249 support
 2021-04-14 15:39:49 +02:00
Taus
54c79bff74 Merge pull request #5666 from RasmusWL/django-refactor 
Python: Refactoring and exposing of Django views/fields/forms
 2021-04-14 13:07:20 +02:00
Rasmus Wriedt Larsen
44d2bf42d7 Merge pull request #5671 from tausbn/python-use-api-graphs-in-werkzeug 
Python: Use API graphs in Werkzeug
 2021-04-14 12:57:58 +02:00
Rasmus Wriedt Larsen
9de8085571 Merge pull request #5665 from tausbn/python-use-api-graphs-in-tornado 
Python: Tornado cleanup using API graphs
 2021-04-14 10:22:21 +02:00
Rasmus Wriedt Larsen
2d0c9b6bf2 Merge pull request #5670 from tausbn/python-use-api-graphs-in-dill 
Python: Use API graphs in Dill model
 2021-04-14 10:08:02 +02:00
Rasmus Wriedt Larsen
55723618a9 Python: Apply suggestions from code review 
Co-authored-by: Taus <tausbn@github.com>
 2021-04-14 10:05:50 +02:00
Taus
981c5deb57 Merge pull request #5639 from tausbn/python-api-graphs-missing-builtins 
Python: Add missing builtins to `API::builtin`
 2021-04-13 21:27:52 +02:00
Taus
a6bb9ebb9f Python: Re-introduce abstract toString 
This seems like the easier solution in the short run.
 2021-04-13 16:08:41 +00:00
Taus
079c7e089d Python: Autoformat 2021-04-13 16:05:45 +00:00
Taus
273e8ce4ef Python: Add change note 2021-04-13 16:04:07 +00:00
Taus
5f7d3d0d36 Python: Use API graphs in Werkzeug 2021-04-13 15:57:21 +00:00
Taus
2890fe6d61 Python: Use API graphs in Dill model 
If only all rewrites were this smooth...
 2021-04-13 15:26:54 +00:00
Taus
7ed09904b4 Python: Use API graphs for Invoke 
A few stragglers remain, as they are modelling the use of decorators.

They will be dealt with at a later date.
 2021-04-13 15:21:19 +00:00
Taus
7f131c1f35 Python: Get rid of _attr predicates 2021-04-13 14:55:44 +00:00