github-actions[bot]
e152f08468
Post-release preparation for codeql-cli-2.24.3
2026-03-02 22:51:27 +00:00
github-actions[bot]
7795badd18
Release preparation for version 2.24.3
2026-03-02 13:23:40 +00:00
yoff
600f585a31
Merge pull request #21296 from yoff/python/bool-comparison-guards
...
Python: Handle guards being compared to boolean literals
2026-02-26 21:13:51 +01:00
yoff
89e5a9bd72
Update python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll
...
Co-authored-by: Taus <tausbn@github.com >
2026-02-26 13:14:26 +01:00
yoff
cfbae50845
Python: convert barrier guard to MaD
2026-02-26 13:12:34 +01:00
yoff
9b9c9304c7
Python: simplify logic, suggested in review
2026-02-25 18:16:38 +01:00
yoff
c4f8748a42
Python: simplify barrier guard
2026-02-25 18:03:40 +01:00
Taus
6bfb1e1fae
Merge pull request #21344 from github/tausbn/python-remove-points-to-from-metrics-libraries
...
Python: Remove points-to from metrics library
2026-02-24 15:55:16 +01:00
Taus
f107235db2
Update change note
2026-02-24 15:08:36 +01:00
yoff
7df44f9418
python: add change note
2026-02-24 10:00:22 +01:00
yoff
7351e82c92
python: handle guards compared to boolean literals
2026-02-24 10:00:22 +01:00
yoff
8488039fb9
python: add tests for guards compared to booleans
2026-02-24 10:00:21 +01:00
Jon Janego
e14b4f1c5c
Merge branch 'main' into codeql-spark-run-22317536589
2026-02-23 11:52:17 -06:00
Jon Janego
79ac95d8a8
Fix syntax error with '=' in format specifier
2026-02-23 11:50:03 -06:00
Taus
480ae619e6
Merge pull request #21116 from github/tausbn/python-add-dataflow-overlay-annotations
...
Add `overlay[local]` annotations
2026-02-21 13:44:09 +01:00
Taus
07099f17d6
Python: Add change note
2026-02-19 12:32:27 +00:00
Taus
e8de8433f4
Python: Update all metrics-dependant queries
...
The ones that no longer require points-to no longer import
`LegacyPointsTo`. The ones that do use the specific
`...MetricsWithPointsTo` classes that are applicable.
2026-02-19 12:32:27 +00:00
Taus
20fea3955e
Python: Remove points-to from Metrics.qll
...
Moves the classes/predicates that _actually_ depend on points-to to the
`LegacyPointsTo` module, leaving behind a module that contains all of
the metrics-related stuff (line counts, nesting depth, etc.) that don't
need points-to to be evaluated.
Consequently, `Metrics` is now no longer a private import in
`python.qll`.
2026-02-19 12:32:27 +00:00
Taus
6b6d8862b0
Merge pull request #21288 from microsoft/azure_python_sanitizer_upstream2
...
Azure python sanitizer upstream2
2026-02-18 14:59:59 +01:00
Taus
3d4785f29f
Python: Add change note
2026-02-18 12:51:35 +00:00
Ben Rodes
a1eaf42cbf
Update python/ql/lib/change-notes/2026-02-09-ssrf_test_case_cleanup_and_new_ssrf_barriers.md
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2026-02-17 13:05:51 -05:00
Ben Rodes
ceb3b21e0f
Update python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
...
Co-authored-by: Taus <tausbn@github.com >
2026-02-17 10:28:43 -05:00
github-actions[bot]
b5898c5a30
Post-release preparation for codeql-cli-2.24.2
2026-02-16 17:07:45 +00:00
Taus
cd62cdadff
Python: Fix bad join in returnStep
2026-02-16 16:48:08 +00:00
Taus
304cd12fff
Python: Fix bad join in missing_imported_module
...
This caused a ~30x blowup in intermediate tuples, now back to baseline.
2026-02-16 13:48:33 +00:00
Taus
987b10ab3e
Python: Fix bad join in OutgoingRequestCall
...
On `keras-team/keras`, this was producing ~200 million intermediate
tuples in order to produce a total of ... 2 tuples.
After the refactor, max intermediate tuple count is ~80k for the
charpred (and 4 for the new helper predicate).
2026-02-16 13:48:33 +00:00
Taus
72f5109ec2
Python: Add more overlay[caller] to Flow.qll
...
These were causing the repo `gufolabs/noc` to spend ~30 seconds
evaluating `ControlFlowNode.strictlyDominates`. Just in case, I added
`overlay[caller] to the other instances of `pragma[inline]` as well.
2026-02-16 13:48:33 +00:00
Taus
248932db7a
Python: Fix frameworks/data/warnings.ql
2026-02-16 13:48:32 +00:00
Taus
306d7d1b5d
Python: DataFlowDispatch.qll annotations
2026-02-16 13:48:32 +00:00
Taus
7ea96c43ec
Python: DataFlowPrivate.qll annotations
2026-02-16 13:48:32 +00:00
Taus
bd71db87be
Python: DataFlowPublic.qll annotations
2026-02-16 13:48:32 +00:00
Taus
c46c662b72
Python: LocalSources.qll annotations
2026-02-16 13:48:32 +00:00
Taus
df0f2f8ce4
Python: Simple dataflow annotations
...
None of these required any changes to the dataflow libraries, so it
seemed easiest to put them in their own commit.
2026-02-16 13:48:32 +00:00
Taus
51ebec9164
Python: Fix broken queries
2026-02-16 13:48:32 +00:00
Taus
fd7b123ee3
Python: Add overlay annotations to AST classes
...
... and everything else that it depends on.
2026-02-16 13:48:32 +00:00
github-actions[bot]
ef04f927fb
Release preparation for version 2.24.2
2026-02-16 13:29:25 +00:00
REDMOND\brodes
4d4e7a1b5c
Pretty print for tests.
2026-02-12 08:28:08 -05:00
Taus
7d17454a3b
Merge pull request #21138 from github/tausbn/python-prepare-for-overlay-annotations
...
Prepare dataflow for local annotations
2026-02-12 14:23:45 +01:00
Chris Smowton
5f970d9f2f
Rewordings per copilot
2026-02-12 12:01:33 +00:00
Chris Smowton
bed1ec8981
Enhance path validation recommendations
...
Expanded recommendations for validating user input when constructing file paths, including normalization and using allowlists.
2026-02-11 12:10:08 +00:00
REDMOND\brodes
9f9c353806
Update expected files. Copilot suggestions broke unit test expected results (column numbers).
2026-02-10 11:47:23 -05:00
REDMOND\brodes
4bb110beb8
More copilot suggestions.
2026-02-10 11:46:16 -05:00
REDMOND\brodes
a91cf6b7cb
Applying copilot PR suggestions.
2026-02-10 11:37:11 -05:00
Ben Rodes
9f8ed710e2
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-10 11:09:25 -05:00
REDMOND\brodes
23bab81855
Added change log
2026-02-09 13:22:35 -05:00
REDMOND\brodes
df54459552
Restore prior PR change log (accidentally removed)
2026-02-09 13:19:02 -05:00
Ben Rodes
85ae4045c5
Merge branch 'main' into azure_python_sanitizer_upstream2
2026-02-09 13:12:38 -05:00
yoff
5ad42f8bcc
Merge pull request #20563 from microsoft/azure_python_sdk_url_summary_upstream
...
Azure python sdk url summary upstream
2026-02-09 18:34:36 +01:00
REDMOND\brodes
f6c302b68c
Removing commented out test cases.
2026-02-06 11:28:48 -05:00
REDMOND\brodes
4f11913ee5
removing SSRFSink.qll
2026-02-06 11:23:58 -05:00
