Rasmus Wriedt Larsen
|
12c49031e8
|
Python: Modernise bottle library
|
2019-09-26 15:03:47 +02:00 |
|
Mark Shannon
|
3f740d6efe
|
Python: Update CWE-312 queries to use new taint-tracking configuration.
|
2019-08-30 11:21:04 +01:00 |
|
Mark Shannon
|
811815aa4e
|
Merge branch 'master' into python-cwe-312
|
2019-08-30 10:39:04 +01:00 |
|
Mark Shannon
|
e5900921e7
|
Python taint-tracking: Remove warnings from test output.
|
2019-08-29 10:31:50 +01:00 |
|
Mark Shannon
|
d31e55f88e
|
Python taint-tracking: Avoid ambiguous flows through calls. Fix up tests.
|
2019-08-29 10:31:50 +01:00 |
|
Mark Shannon
|
78ce19678a
|
Python taint-tracking: Fix up SQL injection query.
|
2019-08-29 10:31:50 +01:00 |
|
Mark Shannon
|
7c4a18eee3
|
Python taint-tracking: Fix up handling of legacy (config-less) taint-tracking
|
2019-08-29 10:31:50 +01:00 |
|
Mark Shannon
|
2d9d292ee4
|
Python: Fix up pi-node handling in taint-tracking.
|
2019-08-29 10:31:50 +01:00 |
|
Mark Shannon
|
8909c3d6ab
|
Python: Fix tags and message for CWE-312 queries.
|
2019-08-23 15:20:19 +01:00 |
|
Mark Shannon
|
4759044ee4
|
Python tests: Fix up tests for CWE-312 to not use external locations.
|
2019-08-22 15:27:49 +01:00 |
|
Mark Shannon
|
9df205b288
|
Python tests: Fix up CWE-327 tests to use new sensitive-data library.
|
2019-08-22 15:27:48 +01:00 |
|
Mark Shannon
|
816938369e
|
Python: Add tests for clear-text storage and logging.
|
2019-08-22 15:27:48 +01:00 |
|
Mark Shannon
|
453ae19881
|
Python points-to: Add .getAstNode() method to TaintedNode for forward compatibility with upcoming taint-tracking enhancements.
|
2019-08-16 09:54:11 +01:00 |
|
Mark Shannon
|
6bd5158f9e
|
Python taint-tracking: Remove 'parents' query from path-queries, as it unused by the tooling.
|
2019-08-08 10:15:06 +01:00 |
|
Mark Shannon
|
fab2cb5a32
|
Python: Add missing function to flask test stub.
|
2019-08-01 13:11:41 +01:00 |
|
Mark Shannon
|
2c5b1c0810
|
Fix semantic merge conflict between #1470 and #1487.
|
2019-07-15 15:34:00 +01:00 |
|
Mark Shannon
|
39b7a69abd
|
Python: Tarslip query: Fix up sanitizers.
|
2019-06-19 15:00:02 +01:00 |
|
Mark Shannon
|
6f15c84bdc
|
Python: Tarslip query; Add sink for members and sanitizers for tarinfo objects.
|
2019-06-19 11:48:31 +01:00 |
|
Mark Shannon
|
e14f7ef466
|
Python: Tarslip query; track info objects and handle sanitization.
|
2019-06-19 11:48:31 +01:00 |
|
Mark Shannon
|
ea4e263060
|
Python: Initial version and help of tar-slip (CWE-022) query.
|
2019-06-19 11:48:31 +01:00 |
|
Mark Shannon
|
918bdecba5
|
Python: Don't record taint past sinks.
|
2019-06-18 16:34:23 +01:00 |
|
Mark Shannon
|
65a30ab392
|
Adjust a couple of query tests to work with latest points-to.
|
2019-04-29 14:28:51 +01:00 |
|
Mark Shannon
|
90bbfd3b16
|
Python: Add library tests for django.
|
2019-04-26 16:21:46 +01:00 |
|
Mark Shannon
|
4a03fd03cd
|
Update test to reflect new true positive.
|
2019-04-26 16:21:46 +01:00 |
|
Mark Shannon
|
28799441af
|
Python: Fix false positive in 'Incomplete URL substring sanitization' query.
|
2019-04-25 18:11:01 +01:00 |
|
Mark Shannon
|
2ba122373a
|
Merge pull request #1128 from taus-semmle/python-paramiko-unsafe-host-key-validation
Python: Add query for insecure SSH host key policies in Paramiko.
|
2019-04-04 16:57:13 +01:00 |
|
Taus Brock-Nannestad
|
5eb63ae048
|
Fix false positive and add test.
|
2019-03-21 14:10:05 +01:00 |
|
Taus Brock-Nannestad
|
9cb35a8ca9
|
Use correct named argument for ssl.SSLContext.
|
2019-03-21 14:09:25 +01:00 |
|
Taus Brock-Nannestad
|
c7c6c83627
|
Address review comments.
|
2019-03-19 15:44:11 +01:00 |
|
Taus Brock-Nannestad
|
52278b25d9
|
Python: Add query for insecure SSH host key policies in Paramiko.
|
2019-03-18 16:45:54 +01:00 |
|
Mark Shannon
|
38a5fb715a
|
Python: Avoid cross-talk between unrelated sources in py/stack-trace-exposure query.
|
2019-03-05 16:52:28 +00:00 |
|
Mark Shannon
|
6c82be8bda
|
Python: CherryPy web framework support -- requests.
|
2019-02-28 15:24:58 +00:00 |
|
Taus
|
b8b4216352
|
Merge pull request #979 from markshannon/python-falcon
Python: Add support for falcon web API framework.
|
2019-02-28 15:47:35 +01:00 |
|
Mark Shannon
|
f7d7b8eef2
|
Merge pull request #785 from taus-semmle/python-unsafe-use-of-mktemp
Python: Add query for unsafe use of `tempfile.mktemp`.
|
2019-02-27 15:01:06 +00:00 |
|
Mark Shannon
|
742c1d0fa7
|
Python: Add test skeleton for falcon web framework.
|
2019-02-27 09:53:20 +00:00 |
|
Taus Brock-Nannestad
|
e47b391329
|
Fix interpolation.
|
2019-02-26 16:27:04 +01:00 |
|
Taus Brock-Nannestad
|
7daaf77183
|
Make query alert refer to AST nodes rather than CFG nodes.
|
2019-02-26 15:56:37 +01:00 |
|
Taus Brock-Nannestad
|
8d774cd354
|
Merge branch 'master' into python-unsafe-use-of-mktemp
|
2019-02-26 13:23:38 +01:00 |
|
Mark Shannon
|
26c5ebde54
|
Python: Basic support for TurboGears: requests and responses.
|
2019-02-26 10:15:36 +00:00 |
|
Mark Shannon
|
aab0a243dc
|
Python: Add redirects to bottle framework support.
|
2019-02-12 14:26:06 +00:00 |
|
Mark Shannon
|
8d525e5295
|
Python: Add support for bottle framework routing and requests.
|
2019-02-12 14:26:06 +00:00 |
|
Taus Brock-Nannestad
|
edd4468d08
|
Fix tests by stubbing relevant os functions.
|
2019-01-29 17:27:14 +01:00 |
|
Taus
|
6f7c96db54
|
Merge branch 'master' into python-unsafe-use-of-mktemp
|
2019-01-29 16:12:53 +01:00 |
|
Taus Brock-Nannestad
|
9a9d902cfb
|
Add support for os.tempnam and os.tmpnam.
|
2019-01-29 16:08:32 +01:00 |
|
Taus
|
9adb19f3a9
|
Merge branch 'master' into python-incomplete-url-sanitize
|
2019-01-29 14:17:37 +01:00 |
|
Mark Shannon
|
6d553ae2be
|
Python: Check os.open as well as os.chmod for weak file permissions.
|
2019-01-28 14:26:16 +00:00 |
|
Mark Shannon
|
88d8cb514c
|
Python: Two new queries for URL and hostname sanitization (CWE-020).
|
2019-01-24 12:57:14 +00:00 |
|
Mark Shannon
|
a3b5769c2c
|
Python: Weak file permissions query.
|
2019-01-22 11:33:19 +00:00 |
|
Taus Brock-Nannestad
|
ad429f5ae1
|
Add tests.
|
2019-01-17 14:45:25 +01:00 |
|
Taus Brock-Nannestad
|
e8c092ad72
|
Python: Support the dill pickling library.
|
2019-01-16 14:53:42 +01:00 |
|