Owen Mansel-Chan
91b6801db1
py: Inline expectation should have space before $
2026-03-04 13:11:38 +00:00
Owen Mansel-Chan
5a97348e78
python: Inline expectation should have space after $
...
This was a regex-find-replace from `# \$(?! )` (using a negative lookahead) to `# $ `.
2026-03-04 12:45:05 +00:00
yoff
600f585a31
Merge pull request #21296 from yoff/python/bool-comparison-guards
...
Python: Handle guards being compared to boolean literals
2026-02-26 21:13:51 +01:00
Taus
6bfb1e1fae
Merge pull request #21344 from github/tausbn/python-remove-points-to-from-metrics-libraries
...
Python: Remove points-to from metrics library
2026-02-24 15:55:16 +01:00
yoff
7351e82c92
python: handle guards compared to boolean literals
2026-02-24 10:00:22 +01:00
yoff
8488039fb9
python: add tests for guards compared to booleans
2026-02-24 10:00:21 +01:00
Taus
480ae619e6
Merge pull request #21116 from github/tausbn/python-add-dataflow-overlay-annotations
...
Add `overlay[local]` annotations
2026-02-21 13:44:09 +01:00
Taus
e8de8433f4
Python: Update all metrics-dependant queries
...
The ones that no longer require points-to no longer import
`LegacyPointsTo`. The ones that do use the specific
`...MetricsWithPointsTo` classes that are applicable.
2026-02-19 12:32:27 +00:00
Taus
6b6d8862b0
Merge pull request #21288 from microsoft/azure_python_sanitizer_upstream2
...
Azure python sanitizer upstream2
2026-02-18 14:59:59 +01:00
Taus
248932db7a
Python: Fix frameworks/data/warnings.ql
2026-02-16 13:48:32 +00:00
Taus
df0f2f8ce4
Python: Simple dataflow annotations
...
None of these required any changes to the dataflow libraries, so it
seemed easiest to put them in their own commit.
2026-02-16 13:48:32 +00:00
REDMOND\brodes
4d4e7a1b5c
Pretty print for tests.
2026-02-12 08:28:08 -05:00
Taus
7d17454a3b
Merge pull request #21138 from github/tausbn/python-prepare-for-overlay-annotations
...
Prepare dataflow for local annotations
2026-02-12 14:23:45 +01:00
REDMOND\brodes
9f9c353806
Update expected files. Copilot suggestions broke unit test expected results (column numbers).
2026-02-10 11:47:23 -05:00
REDMOND\brodes
4bb110beb8
More copilot suggestions.
2026-02-10 11:46:16 -05:00
REDMOND\brodes
a91cf6b7cb
Applying copilot PR suggestions.
2026-02-10 11:37:11 -05:00
Ben Rodes
9f8ed710e2
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-10 11:09:25 -05:00
REDMOND\brodes
f6c302b68c
Removing commented out test cases.
2026-02-06 11:28:48 -05:00
REDMOND\brodes
97f19d03ad
Updating test case expected alerts.
2026-02-06 11:20:13 -05:00
REDMOND\brodes
97ddab0724
Added support for new URIValidator in AntiSSRF library. Updated test caes to use postprocessing results. Currently results for partial ssrf still need work, it is flagging cases where the URL is fully controlled, but is sanitized. I'm not sure if this should be flagged yet.
2026-02-06 11:20:11 -05:00
Ben Rodes
08b72d0a86
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 11:18:51 -05:00
Ben Rodes
46a2a249f9
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 11:18:49 -05:00
REDMOND\brodes
9912aaaf1a
Adding azure sdk test cases and updated test expected file.
2026-02-06 11:18:16 -05:00
REDMOND\brodes
0a88425170
Python: Altering SSRF MaD to use 'request-forgery' tag. Update to test cases expected results, off by one line. Changed to using ModelOutput::sinkNode.
2026-02-04 09:04:22 -05:00
Ben Rodes
cd73dcfb04
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-04 08:55:38 -05:00
Owen Mansel-Chan
3f08ff88a4
Pretty print models in test
...
Otherwise the tests breaks when unrelated changes are made because the
model numbers change
2026-02-04 10:52:44 +00:00
Ben Rodes
7ddfa80399
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-02 09:00:35 -05:00
Owen Mansel-Chan
5204255615
Merge pull request #21234 from owen-mc/python/convert-sanitizers-to-mad
...
Python: Allow models-as-data sanitizers
2026-01-30 14:28:39 +00:00
Taus
958c798c3f
Python: Accept dataflow test changes
...
New nodes means new results. Luckily we rarely have a test that selects
_all_ dataflow nodes.
2026-01-30 12:50:25 +00:00
Taus
ac5a74448f
Python: Fix tests
...
With `ModuleVariableNode`s now appearing for _all_ global variables (not
just the ones that actually seem to be used), some of the tests changed
a bit. Mostly this was in the form of new flow (because of new nodes
that popped into existence). For some inline expectation tests, I opted
to instead exclude these results, as there was no suitable location to
annotate. For the normal tests, I just accepted the output (after having
vetted it carefully, of course).
2026-01-30 12:50:25 +00:00
Owen Mansel-Chan
ad6f800022
Pretty print model numbers in tests
2026-01-30 09:21:24 +00:00
yoff
e7a0fc7140
python: Add query for prompt injection
...
This pull request introduces a new CodeQL query for detecting prompt injection vulnerabilities in Python code targeting AI prompting APIs such as agents and openai. The changes includes a new experimental query, new taint flow and type models, a customizable dataflow configuration, documentation, and comprehensive test coverage.
2026-01-29 23:47:52 +01:00
Taus
34800d1519
Merge pull request #20945 from joefarebrother/python-websockets
...
Python: Model remote flow sources for the `websockets` library
2026-01-29 15:47:46 +01:00
Tom Hvitved
b974a84bef
Merge pull request #21051 from hvitved/shared/flow-summary-provenance-filtering
...
Shared: Provenance-based filtering of flow summaries
2026-01-26 17:24:34 +01:00
Tom Hvitved
0adece7cde
Python: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:19 +01:00
yoff
3dbfb9fa4b
python: add machinery for MaD barriers
...
and reinstate previously removed barrier
now as a MaD row
2026-01-22 17:30:24 +01:00
yoff
699ed50432
python: remove barrier that can be expressed in MaD
2026-01-22 17:30:24 +01:00
Taus
5414bd2716
Merge pull request #21134 from yoff/python/support-ListElement-in-MaD
...
Python support `ListElement` in MaD
2026-01-20 23:38:02 +01:00
yoff
1ac3706e75
Python support ListElement in MaD
2026-01-09 13:08:06 +01:00
Taus
d2c7147480
Python: Add new test
2025-12-10 13:52:13 +00:00
Taus
6af9fd816f
Python: Make space for new test
2025-12-10 13:51:20 +00:00
yoff
5c6d83ed65
Merge pull request #20877 from joefarebrother/python-tornado-websocket
...
Python: Add models for websocket handlers for Tornado
2025-12-09 10:08:59 +01:00
Taus
1b519384d7
Merge pull request #20739 from github/tausbn/python-remove-top-level-points-to-imports
...
Python: Hide points-to imports in `python.qll`
2025-12-05 14:24:41 +01:00
Joe Farebrother
d70c596c86
Merge pull request #20914 from joefarebrother/python-socketio
...
Python: Add models for socketio
2025-12-04 23:14:58 +00:00
Joe Farebrother
ac55cf9544
Update test and qldoc
2025-12-01 20:41:59 +00:00
Joe Farebrother
7cf3964e44
Update expectations
2025-12-01 20:27:48 +00:00
Joe Farebrother
384e17a4ef
Implement websockets models
2025-12-01 16:24:59 +00:00
Taus
24a29f46be
Python: Fix all metrics-related compilation failures
...
In hindsight, having a `.getMetrics()` method that just returns `this`
is somewhat weird. It's possible that it predates the existence of the
inline cast, however.
2025-11-26 21:28:51 +00:00
Taus
cd1619b43e
Python: Fix queries and tests
2025-11-26 17:06:55 +00:00
Joe Farebrother
16018e91a2
Minor test fix
2025-11-26 15:47:56 +00:00
