5436 Commits

Author	SHA1	Message	Date
yoff	0778d90ac1	python: fix implementation of lambdaCreation ... - still identifying summarized callables by name. I think ther shoudl perhaps be a `getAUse` next to `getACall`. - also fix tests, adding a standard taint configuration	2022-05-12 11:35:57 +00:00
yoff	92c4c87058	python: sync file	2022-05-11 12:36:02 +00:00
yoff	4445cf152a	python: various fixes ... - compilation - alerts - some review comments	2022-05-11 12:28:58 +00:00
yoff	f67be52b99	python: fix compilation ... by making client code use the "new" class. Really, this part of the split class should have the old name, to minimise disruptions to clients. Same goes for the other split classes.	2022-05-10 12:53:13 +00:00
yoff	db008f1939	python: summaries may allowParameterReturnInSelf	2022-05-10 12:48:42 +00:00
yoff	238c578f5a	python: Add LocalSourceParameterNode ... This can be used when one wants to consider a (source) parameter node as a local source.	2022-05-10 12:48:42 +00:00
yoff	28b239a9a4	python: add qldoc	2022-05-10 12:48:42 +00:00
yoff	da3634188d	python: variaous fixes ... - sync summary files - format files - fix compilation	2022-05-10 12:48:42 +00:00
yoff	f14ee0e794	python: Flow summaries based on type tracking ... Two classes have been inserted into the hierarchies: - `NonLibraryDataFlowCallable` with a method `getACall2`. This method implements "get a call, not considering flow summaries". For `NonLibraryDataFlowCallable`s, `getACall` will defer to `getACall2`. While you could have a synthesised call to such a callable, it would not correspond to a `CallNode`. - `NonLibraryDataFlowSourceCall` with methods `getArg2` and `getCallable2`. These also refer to a call graph that does not consider flow summaries. `getArg2` is used to synthesise pre-update nodes for arguments. `getCallable2` is used in `connects` to compute argument passing. This is used to define data flow nodes for overflow arguments. `getACall2` ensures that `LibraryCallableValue::getACall` is not called when the charpred of `FunctionCall` is evaluated.	2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen	506efcf051	python: refactor TDataFlowCall ... - Branch predicates are made simple. In particular, they do not try to detect library calls. - All branches based on `CallNode`s are gathered into one. - That branch has been given a class `NonSpecialCall`, which is the new parent of call classes based on `CallNode`s. (Those classes now have more involved charpreds.) - A new such class, 'LambdaCall` has been split out from `FunctionCall` to allow the latter to replace its general `CallNode` field with a specific `FunctionValue` one. - `NonSpecialCall` is not an abstract class, but it has some abstract overrides. Therefor, it is not considered a resolved call in the test `UnresolvedCalls.qll`.	2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen	d85844bb89	python: type tracking uses source nodes	2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen	81ca479ca9	Python: local flow for type tracking ... summary flow is excluded from the local flow relation used for typetracking, but included in the one used for global data flow.	2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen	177dea5307	python: use new syntax for flow summaries ... also convert to inline tests	2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen	4024ce4777	python: some summary flows	2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen	8c263b349f	python: add summary flow steps	2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen	828db3a392	python: Add summary nodes ... allowing more `OutNode`s (not restricting to `CallNode`s), gives more flow in the `classesCallGraph` test	2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen	80175a9af5	Python: Compiles and mostly pass tests ... - add flowsummaries shared files - register in indentical files - fix initial non-monotonic recursions - add DataFlowSourceCall - add resolvedCall - add SourceParameterNode failing tests: - 3/library-tests/with/test.ql	2022-05-10 12:48:42 +00:00
Rasmus Wriedt Larsen	2b6e0cfb44	Merge pull request #8340 from yoff/python/simple-csrf ... python: minimal CSRF implementation	2022-05-10 13:36:38 +02:00
Rasmus Wriedt Larsen	cb17e2a649	Merge pull request #8595 from porcupineyhairs/pypam ... Python : Add query to detect PAM authorization bypass	2022-05-10 13:35:12 +02:00
Rasmus Lerchedahl Petersen	aa3d7babf4	python: fix bad merge ... caused by an optimistic attempt at solving a merge conflict in the online GUI.	2022-05-10 11:37:41 +02:00
Rasmus Wriedt Larsen	2421076d2f	Merge pull request #8696 from RasmusWL/new-nosql-examples ... Python: Improve experimental modeling for `pymongo`	2022-05-10 11:03:05 +02:00
yoff	6c3e2db7fd	Merge branch 'main' into python/simple-csrf	2022-05-10 10:55:28 +02:00
yoff	b6605bc330	Merge pull request #8634 from RasmusWL/promote-xxe ... Python: Promote XXE and XML-bomb queries	2022-05-09 21:54:55 +02:00
Rasmus Lerchedahl Petersen	1c7e533144	python: format	2022-05-09 21:22:27 +02:00
Rasmus Lerchedahl Petersen	2a5908ff49	python: require all settings be vulnerable ... at least all thos not in tests	2022-05-09 17:08:49 +02:00
Rasmus Wriedt Larsen	4a6789182d	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2022-05-09 16:37:12 +02:00
Anders Schack-Mulligen	f24364d951	Merge pull request #9045 from hvitved/dataflow/subpaths-perf-take2 ... Data flow: Speedup `subpaths` predicate (take 2)	2022-05-09 15:39:11 +02:00
Rasmus Wriedt Larsen	c218162104	Merge branch 'main' into pypam	2022-05-09 14:20:05 +02:00
Rasmus Wriedt Larsen	ab1252d196	Python: Add @precision high for py/pam-auth-bypass	2022-05-09 14:19:40 +02:00
Rasmus Wriedt Larsen	de05b108fa	Python: Fix singleton set	2022-05-09 11:01:13 +02:00
Rasmus Wriedt Larsen	36349222a9	Python: Fix casing of XMLDomParsing	2022-05-09 11:00:25 +02:00
Rasmus Wriedt Larsen	f22bd039f3	Python: Slight refactor of LxmlParsing	2022-05-09 10:56:39 +02:00
Rasmus Wriedt Larsen	f5854f33da	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2022-05-09 10:53:25 +02:00
Mathias Vorreiter Pedersen	176e40f139	Merge pull request #9052 from github/post-release-prep/codeql-cli-2.9.1 ... Post-release preparation for codeql-cli-2.9.1	2022-05-06 13:15:17 +01:00
github-actions[bot]	1a25457178	Post-release preparation for codeql-cli-2.9.1	2022-05-05 19:05:50 +00:00
yoff	6169ac6122	Merge pull request #7776 from RasmusWL/django-filefield-uploadto ... Python: Support Django FileField.upload_to	2022-05-05 14:25:08 +02:00
Tom Hvitved	d9d5372f28	Data flow: Sync files	2022-05-05 13:36:26 +02:00
yoff	0c7184952b	Merge pull request #9023 from RasmusWL/positional-docs ... Python: Clarify `getArg` is about positional arguments	2022-05-05 11:28:17 +02:00
Tom Hvitved	66a9759329	Merge pull request #8870 from hvitved/dataflow/expect-content ... Data flow: Introduce `expectsContent`	2022-05-05 09:01:40 +02:00
Tom Hvitved	8e33653d25	Merge pull request #9017 from hvitved/dataflow/subpaths-perf ... Data flow: Speedup `subpaths` predicate	2022-05-04 16:37:52 +02:00
Tom Hvitved	9cb63c0a5e	Data flow: Sync files	2022-05-04 14:49:26 +02:00
Tom Hvitved	74e99302d6	Address review comments	2022-05-04 09:57:59 +02:00
Tom Hvitved	da72ba46d4	Data flow: Add stub expectsContent for all languages	2022-05-04 09:57:59 +02:00
Tom Hvitved	6e2e8440eb	Data flow: Sync files	2022-05-04 09:57:59 +02:00
Rasmus Wriedt Larsen	d012eaa892	Python: Clarify getArg is about positional arguments	2022-05-03 14:26:23 +02:00
yoff	56ed68b3eb	Merge pull request #9001 from RasmusWL/files-refactoring ... Python: Flask: Improve `request.files` modeing	2022-05-03 12:19:55 +02:00
Tom Hvitved	e9c8f979f9	Data flow: Sync files	2022-05-03 11:46:51 +02:00
Rasmus Wriedt Larsen	7e1be3172e	Python: Add change-note	2022-05-02 14:24:13 +02:00
Rasmus Wriedt Larsen	de4390cdf6	Python: Improve Flask request.files handling even more	2022-05-02 14:19:45 +02:00
Rasmus Wriedt Larsen	fb0133d276	Python: Fix Flask request.files modeling	2022-05-02 14:14:58 +02:00