Rasmus Wriedt Larsen
df67028a1d
Python: Model aiohttp.StreamReader
2021-06-11 12:06:53 +02:00
Tony Torralba
c828c7031f
Add change note
2021-06-11 12:04:11 +02:00
Rasmus Wriedt Larsen
2d31ef7016
Python: Fix last TODOs in aiohttp tests
2021-06-11 12:00:02 +02:00
Rasmus Wriedt Larsen
64a0e3fd0a
Merge branch 'main' into aiohttp-modeling
2021-06-11 11:42:24 +02:00
Rasmus Wriedt Larsen
8b8e1334cc
Python: Fix syntax error
2021-06-11 11:42:14 +02:00
Rasmus Wriedt Larsen
46f7a2b572
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-06-11 11:28:11 +02:00
Rasmus Wriedt Larsen
6f29b01abc
Python: Model rsa
2021-06-11 11:23:06 +02:00
Rasmus Wriedt Larsen
40714c05b7
Python: Add tests for rsa PyPI package
2021-06-11 11:17:13 +02:00
Rasmus Wriedt Larsen
3d5f379b8c
Merge branch 'main' into sensitive-improvements
2021-06-11 10:48:20 +02:00
John L. Singleton
cd61fb4753
this should be abstract
2021-06-10 19:54:58 -04:00
John L. Singleton
219dc71ae6
changlog entry
2021-06-10 17:15:06 -04:00
John L. Singleton
2a01324172
more maintainable pattern for class abstractions
2021-06-10 17:09:32 -04:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Erik Krogh Kristensen
50d574d20d
add graphql injection to the sql-injection query
2021-06-10 21:01:54 +02:00
John L. Singleton
bd7c416356
comment change
2021-06-10 11:21:11 -04:00
John L. Singleton
0d3f53b013
Changes to structure per feedback of @jbj
2021-06-10 11:16:58 -04:00
Taus
e7b9603c5b
Merge pull request #6053 from RasmusWL/fix-tests
...
Python: Fix tests
2021-06-10 16:55:45 +02:00
Rasmus Wriedt Larsen
dd457f9641
Python: Fix tests
2021-06-10 15:58:56 +02:00
John L. Singleton
f174d7a0e0
Comment changes
2021-06-10 09:52:22 -04:00
John L. Singleton
14c419a75f
autoformatting
2021-06-10 09:39:43 -04:00
CodeQL CI
a241c114da
Merge pull request #5836 from RasmusWL/ec-class-improvement
...
Approved by tausbn
2021-06-10 06:20:56 -07:00
Rasmus Wriedt Larsen
04db33513e
Merge branch 'main' into sensitive-improvements
2021-06-10 15:11:09 +02:00
Rasmus Wriedt Larsen
ea0c1d7db3
Python: Better handling of sensitive functions
...
This solution was the best I could come up with, but it _is_ a bit
brittle since you need to remember to add this additional taint step
to any configuration that relies on sensitive data sources... I don't
see an easy way around this though :|
2021-06-10 15:08:21 +02:00
Tamas Vajk
916780a452
Fix codeql CLI path
2021-06-10 15:07:54 +02:00
Rasmus Wriedt Larsen
f167143a84
Python: Use real config in TestSensitiveDataSources
...
This will enable better tests in just one second
2021-06-10 15:01:31 +02:00
Rasmus Wriedt Larsen
c341643ec1
Python: Add more tests for sensitive function handling
2021-06-10 14:36:05 +02:00
Owen Mansel-Chan
e0130a932e
Update experimental query using NewCookie
2021-06-10 13:33:20 +01:00
Owen Mansel-Chan
c173b89529
Model NewCookie
2021-06-10 13:32:39 +01:00
Owen Mansel-Chan
ee6019a2d8
Fix tests for experimental httponly query
2021-06-10 13:31:28 +01:00
Rasmus Wriedt Larsen
eb4f168dd4
Python: Clarify SensitiveAttributeAccess
...
The comment about imports was placed wrong. I also realized we didn't
even have a single test-case for
`this.(DataFlow::AttrRead).getAttributeNameExpr() = sensitiveLookupStringConst(classification)`
so I added that (notice that this is only `getattr(foo, x)` and not
`getattr(foo, "password")`)
2021-06-10 14:09:47 +02:00
Owen Mansel-Chan
d5d27d5ccf
Duplicate tests for Jakarta
2021-06-10 10:43:40 +01:00
Owen Mansel-Chan
0ad35421f2
Comment out stubs (Jakarta)
2021-06-10 10:43:40 +01:00
Owen Mansel-Chan
318d1ea484
Stubs in javax-ws-rs-api-3.0.0
...
Generated using java-autostub
2021-06-10 10:43:39 +01:00
Owen Mansel-Chan
e6a6a8898b
Move Jax XSS sinks to JaxWS.qll and add tests
2021-06-10 10:43:39 +01:00
Owen Mansel-Chan
d1fe62d4d5
(Minor) Update comments to match ExternalFlow docs
2021-06-10 10:43:38 +01:00
Owen Mansel-Chan
1ae9d68409
Move and convert URL redirect sinks
...
Adds for them as well
2021-06-10 10:43:37 +01:00
Owen Mansel-Chan
f2ff2aa3e1
Add flow tests for JAX-RS
2021-06-10 10:43:37 +01:00
Owen Mansel-Chan
155d63d5f7
Add tests for JAX-RS
2021-06-10 10:43:36 +01:00
Owen Mansel-Chan
f63fd68bfb
Fix models to work with collection flow
...
And also removal of `Argument` with indices
2021-06-10 10:43:36 +01:00
Owen Mansel-Chan
e929de98ec
Delete duplicated taint summary rows
2021-06-10 10:43:35 +01:00
Owen Mansel-Chan
2b8bb5c231
Fix JAX-RS models
2021-06-10 10:43:35 +01:00
Owen Mansel-Chan
baa21c5bcf
Manually comment out parts of stubs
...
This is to avoid having to make more stubs, which we don't really need
2021-06-10 10:43:34 +01:00
Owen Mansel-Chan
caf96b01e1
Stubs in javax-ws-rs-api-2.1.1
...
Generated using java-autostub
2021-06-10 10:43:34 +01:00
Owen Mansel-Chan
7b3acd8b45
(Minor) Add missing this.
2021-06-10 10:43:33 +01:00
Owen Mansel-Chan
07f7fd0342
Add missing QLDocs in JaxWS.qll
...
And correct one QLDoc
2021-06-10 10:43:15 +01:00
Tamas Vajk
b067309909
Change artifact names
2021-06-10 11:26:07 +02:00
yoff
716627c1dd
Merge pull request #5878 from RasmusWL/fix-concept-tests-pretty-print
...
Python: Fix concept tests pretty print
2021-06-10 11:21:08 +02:00
Tamas Vajk
73aaeb4c0d
Change workflow names
2021-06-10 11:01:45 +02:00
Tamas Vajk
55dd6ed3d1
Allow space separated package patterns in framework-aggregated reports
2021-06-10 10:54:12 +02:00
Tamas Vajk
74c00383d2
Update java framework coverage reports
2021-06-10 10:26:34 +02:00
