Commit Graph

319 Commits

Author SHA1 Message Date
Rasmus Wriedt Larsen
1029f04e76 Python: TarSlip sanitizer: handle not 2020-02-20 16:27:54 +01:00
Rasmus Wriedt Larsen
3c317ed0e6 Python: TarSlip sanitizer: only clear taint on false edge
maybe it was on purpose, will have to investigate FPs when query is good
2020-02-20 16:11:24 +01:00
Rasmus Wriedt Larsen
2d637e1cf7 Python: Add more tarslip examples 2020-02-20 16:09:10 +01:00
Rasmus Wriedt Larsen
e7fdfd3d3e Python: Move subprocess.call so super-class detection works
This is a temporary fix!

Added minimal working example (MWE) as a regression, so it's easier to fix the
real problem.

only Python 3 is facing the problem -- and without --max-import-depth=1 the test
times out at 10 minutes :O
2020-02-19 14:12:22 +01:00
Rasmus Wriedt Larsen
13568b7b9f Python: Modernise Statements/ queries
Almost. Left out a few things marked with TODO
2020-02-19 14:10:29 +01:00
Rasmus Wriedt Larsen
6e349eb6e7 Python: Make py/side-effect-in-assert handle example
Also removed parantheses
2020-02-19 14:05:55 +01:00
Rasmus Wriedt Larsen
ae8dbd81f3 Python: Update test-file for py/redundant-assignment
now the test code can be pasted, and actually works ;)
2020-02-19 14:05:55 +01:00
Rebecca Valentine
7997e1dc98 Merge branch 'master' into objectapi-to-valueapi-expectedmappingforformatstring 2020-02-18 21:33:12 -08:00
Taus
ffbb5d0529 Merge pull request #2739 from RasmusWL/python-modernise-security
Python: modernise Security/ queries
2020-02-18 16:28:53 +01:00
Rasmus Wriedt Larsen
5a0babe88b Python: Add support for Django 2.x and 3.x
I changed the django mock to support both 1.x and 2.x routing APIs, which is not
really a nice long term solution.
2020-02-18 11:22:35 +01:00
Rebecca Valentine
4178002d59 Merge branch 'master' into python-objectapi-to-valueapi-useofapply 2020-02-17 17:20:00 -08:00
Rebecca Valentine
13cd8d2435 Fixes expected results bug 2020-02-17 11:47:03 -08:00
Rasmus Wriedt Larsen
362e7aebbb Python: Add HttpRedirectSinks test for django 2020-02-17 16:54:06 +01:00
Taus
03ae7831ad Merge pull request #2711 from RasmusWL/python-fix-import-deprecated-module
Python: fix alerts for py/import-deprecated-module
2020-02-17 11:46:12 +01:00
Taus
990d1c1663 Merge pull request #2802 from RasmusWL/python-fix-fp-py/import-own-module
Python: Fix FP for py/import own module
2020-02-17 11:23:11 +01:00
Rebecca Valentine
6a04004d94 Adds test cases and qlref. 2020-02-13 14:49:01 -08:00
jack1142
e1644dd68b Python: Handle __class_getitem__ in py/not-named-self (#2825)
Fixes #2824
2020-02-13 13:38:36 +01:00
Rebecca Valentine
acb3c524dd Updates expected results. 2020-02-12 19:46:43 -08:00
Rasmus Wriedt Larsen
1f762841ec Python: In py/import-own-module handle from foo import * 2020-02-11 11:45:48 +01:00
Rasmus Wriedt Larsen
5cc2efef8e Python: Fix FPs for py/import-own-module
Before I added `--max-import-depth=2`, there was a bit of trouble, where it
would alert on `from pkg_ok import foo2` -- since all the `pkg_ok.foo<n>`
modules were missing, I guess the analysis didn't make any assumptions on
whether `foo2` is a module or a regular attribute.
2020-02-11 11:45:48 +01:00
Rasmus Wriedt Larsen
f3f9e340d3 Python: Update tests for py/import-own-module
So I've been thinking a bit about import pkg_ok.foo1 after reading the Python
references for imports of submodules
https://docs.python.org/3/reference/import.html#submodules

> When a submodule is loaded using any mechanism (...) a binding is placed in the
parent module’s namespace to the submodule object. For example, if package spam
has a submodule foo, after importing spam.foo, spam will have an attribute foo
which is bound to the submodule.

That does at least explain what is going on here.

I feel that import pkg_ok.foo1 might be a very contrived example. In principle
it should be an alert, since the module pkg_ok ends up with an import of itself,
but my gut feeling is that in practice it's not a very important piece of code
to give alerts for. if we really care about giving these import related alerts,
we could probably add a new query for this pattern, as it's kind of surprising
that it works when you're just an ordinary python programmer.
2020-02-11 11:45:48 +01:00
Rasmus Wriedt Larsen
2bffbf0734 Python: Add testcases for py/import-own-module
You can try out:

python2 -c "import pkg_ok; print(pkg_ok.foo1); print(pkg_ok.foo2); print(pkg_ok.foo3); print(pkg_ok.foo4); print(pkg_ok.foo5); print(pkg_ok.Foo3); print(pkg_ok.Foo5); print(pkg_ok.pkg_ok)"

python3 -c "import pkg_ok; print(pkg_ok.foo1); print(pkg_ok.foo2); print(pkg_ok.foo3); print(pkg_ok.foo4); print(pkg_ok.foo5); print(pkg_ok.Foo3); print(pkg_ok.Foo5); print(pkg_ok.pkg_ok)"
2020-02-10 15:16:47 +01:00
Rasmus Wriedt Larsen
c0b7dcc019 Python: Remove ignored automatic_locations in qltest options files 2020-02-06 14:28:10 +01:00
Rasmus Wriedt Larsen
c1d073a54d Python: Add test-cases for py/hardcoded-credentials 2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
6b5b28aded Python: Add Value.getABooleanValue and Value.getDefiniteBooleanValue
Replacing `Value.booleanValue`. We wanted to match `Object.booleanValue` that
only gives a result if it is either `true` or `false`, but also wanted to keep
the flexibility to see if the Value _could_ be `true`/`false`. We don't have a
motivating usecase, so let's see if we ever need it :P

+ fix modernisation regression on py/jinja2/autoescape-false
2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
bd1f21fb7a Python: Fix modernisation regression on py/weak-crypto-key
also fixes test code to use the right argument name
2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
e5abfd0196 Python: Modernise Security/ queries 2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
5bc592514a Python: Consistenly use "a user-provided value"
ReflectedXss was the only query that used it with the "a"
2020-02-03 14:35:09 +01:00
Rasmus Wriedt Larsen
4ca72de4cd Python: Fix recommended module for deprecated posixfile
$ python2 -W default -c 'import posixfile'
-c:1: DeprecationWarning: The posixfile module is deprecated; fcntl.lockf() provides better locking

https://docs.python.org/2.7/library/posixfile.html
2020-01-28 16:44:47 +01:00
Rasmus Wriedt Larsen
6c7cddf258 Python: py/import-deprecated-module handle backwards compatible code 2020-01-28 16:36:47 +01:00
Rasmus Wriedt Larsen
e92d6c0459 Python: Stop py/import-deprecated-module from double alerting
This changes the location from the import statement, to the actual expression
2020-01-28 16:15:46 +01:00
Rasmus Wriedt Larsen
194228850a Python: Add tests for py/import-deprecated-module 2020-01-28 16:15:21 +01:00
Taus
618a35bb7c Merge pull request #2664 from RasmusWL/python-fix-redirect-example
Python: Remove unused variable in example for py/url-redirection
2020-01-23 13:42:00 +01:00
Rasmus Wriedt Larsen
12bb05522a Python: Make py/weak-cryptographic-algorithm a path-problem
and stop using deprecated hasFlow
2020-01-22 13:45:14 +01:00
Rasmus Wriedt Larsen
c5091f1ce7 Python: Make py/hardcoded-credentials a path-problem
and stop using deprecated hasFlow
2020-01-22 13:45:14 +01:00
Rasmus Wriedt Larsen
96d5703f2c Python: Remove use of deprecated methods 2020-01-22 13:45:14 +01:00
Rasmus Wriedt Larsen
422658bbdb Python: Remove unused variable in example for py/url-redirection 2020-01-21 15:45:05 +01:00
Taus
cfb84be7b1 Merge pull request #2540 from RasmusWL/python-modernise-variables-queries
Python: modernise variables queries
2020-01-10 14:45:12 +01:00
Rasmus Wriedt Larsen
81e27aab8d Python: Modernise py/unused-loop-variable 2019-12-20 15:05:49 +01:00
Taus
52d231c219 Merge pull request #2469 from RasmusWL/python-modernise-twisted-library
Python: modernise twisted library
2019-12-18 13:55:50 +01:00
Rasmus Wriedt Larsen
4e3c183676 Python: Adapt twisted tests so they pass 2019-12-18 10:42:39 +01:00
Rasmus Wriedt Larsen
e257ba40c4 Python: Make zope web tests pass 2019-12-17 17:42:03 +01:00
Rasmus Wriedt Larsen
3e5e14a14b Merge pull request #2431 from tausbn/python-cyclic-import-future-annotations
Python: Account for non-evaluation of annotations in cyclic imports.
2019-11-27 13:31:53 +01:00
Taus Brock-Nannestad
036e0f75c8 Python: Account for non-evaluation of annotations in cyclic imports.
Should fix #2426.

Essentially, we disregard expressions used inside annotations, if these
annotations occur in a file that has `from __future__ import annotations`, as
this prevents the annotations from being evaluated.
2019-11-25 15:32:52 +01:00
Rebecca Valentine
a8204385c3 Adds fix for __init_subclass__ bug. (#2390)
* Adds fix for __init_subclass__ bug.

* Adds test case.

* Move test on name.

I think it makes more sense here, alongside the other "special" method names.
2019-11-24 12:18:17 +01:00
Rasmus Wriedt Larsen
46b6e6d722 Merge pull request #2409 from tausbn/python-typing-forward-reference-fp
Python: Support forward references inside return type annotations.
2019-11-22 11:18:04 +01:00
Taus Brock-Nannestad
033524ce63 Python: Support forward references inside return type annotations.
Should fix #2407.

Also allows for the string containing the forward reference to appear inside a
subexpression of the type annotation.
2019-11-21 15:37:32 +01:00
Taus Brock-Nannestad
9fda4ab480 Python: Fix false positive in py/non-iterator-in-for-loop
Should fix #1833, #2137, and #2187.

Internally, comprehensions are (at present) elaborated into local functions and
iterators as described in [PEP-289](https://www.python.org/dev/peps/pep-0289/).
That is, something like:

```
g = (x**2 for x in range(10))
```

becomes something akin to

```
def __gen(exp):
    for x in exp:
        yield x**2
g = __gen(iter(range(10)))
```

In the context of the top-level of a class, this means `__gen` looks as if it is
a method of the class, and in particular `exp` looks like it's the `self`
argument of this method, which leads the points-to analysis to think that `exp`
is an instance of the surrounding class itself.

The fix in this case is pretty simple: we look for occurrences of `exp` (in fact
called `.0` internally -- carefully chosen to _not_ be a valid Python
identifier) and explicitly exclude this parameter from being classified as a
`self` parameter.
2019-11-21 11:49:29 +01:00
Rasmus Wriedt Larsen
b39bcde31c Merge pull request #2375 from tausbn/python-fix-mutable-value-type-coercion-fp
Python: Don't report mutable parameters that are in fact immutable.
2019-11-19 13:26:23 +01:00
Rasmus Wriedt Larsen
231414ceaf Merge pull request #2374 from tausbn/python-fix-mappingproxytype-fp
Python: Fix non-container FP relating to `MappingProxyType`.
2019-11-19 13:13:26 +01:00