Chris Smowton
30be6803c3
Merge pull request #17480 from github/post-release-prep/codeql-cli-2.19.0
...
Post-release preparation for codeql-cli-2.19.0
2024-09-16 16:06:58 +01:00
github-actions[bot]
79be301984
Post-release preparation for codeql-cli-2.19.0
2024-09-16 14:09:32 +00:00
Paolo Tranquilli
8953ad6b76
Python: replace src_archive exclusion patterns with *.testproj ones
...
The `**/src_archive/**` exclusion patterns seem to have to do with
trying to exclude archived source files from being picked up for the
extractor while running the test itself. However it seems that directory
is not being used any more by `codeql` (which uses a `src` directory
instead).
A `*.testproj` exclusion pattern will work in a more robust way, by
excluding any file inside the database being built.
2024-09-16 14:30:55 +02:00
github-actions[bot]
acdafd9646
Release preparation for version 2.19.0
2024-09-16 10:56:10 +00:00
Dave Bartolomeo
485fc04029
Initial merge from main
2024-09-15 08:55:31 -04:00
github-actions[bot]
97edff3f70
Post-release preparation for codeql-cli-2.18.4
2024-09-09 18:45:46 +00:00
github-actions[bot]
91537cdf9a
Release preparation for version 2.18.4
2024-09-09 16:08:48 +00:00
Joe Farebrother
d1cca13563
Merge pull request #17314 from joefarebrother/python-x509-cert
...
Python: Exclude certificate classification fo sensitive data queries
2024-09-09 10:48:36 +01:00
Joe Farebrother
959715ac8e
Merge pull request #16814 from porcupineyhairs/pyCors
...
WIP: Python: CORS Bypass
2024-09-05 02:43:02 +01:00
Erik Krogh Kristensen
49aaf65f3f
fix mistake in the Python change-note
...
Co-authored-by: Taus <tausbn@github.com >
2024-09-04 12:43:01 +02:00
erik-krogh
e2b16bd8f9
add some change-notes
2024-09-03 22:06:07 +02:00
erik-krogh
20dfdc9661
delete some deprecated files
2024-09-03 20:30:59 +02:00
erik-krogh
0fdd06fff5
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
Porcupiney Hairs
f86570f6e7
WIP: Python: CORS Bypass
...
This PR adds a query to detect a Cross Origin Resource Sharing(CORS) policy bypass due to an incorrect check.
This PR attempts to detect the vulnerability pattern found in CVE-2022-3457
```python
if request.method in ['POST', 'PUT', 'PATCH', 'DELETE']:
origin = request.headers.get('Origin', None)
if origin and not origin.startswith(request.base):
raise cherrypy.HTTPError(403, 'Unexpected Origin header')
```
In this case, a value obtained from a header is compared using `startswith` call. This comparision is easily bypassed resulting in a CORS bypass. Given that similar bugs have been found in other languages as well, I think this PR would be a great addition to the exisitng python query pack.
The databases for CVE-2022-3457 can be downloaded from
```
https://filetransfer.io/data-package/i4Mfepls#link
https://file.io/V67T4SSgmExF
```
2024-09-03 03:11:35 +05:30
Joe Farebrother
ec7ad84cd1
Update formatting
2024-08-30 13:51:33 +01:00
Joe Farebrother
5360192a58
Apply review suggestions - change = to in
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-08-30 13:25:59 +01:00
Henry Mercer
3490067316
Merge branch 'main' into henrymercer/rc-3.15-mergeback
2024-08-29 19:48:01 +01:00
Joe Farebrother
5494389c4b
Update changenote
...
Co-authored-by: Sid Shankar <sidshank@github.com >
2024-08-29 09:44:23 +01:00
Joe Farebrother
a8591c79c5
Update test
2024-08-28 09:11:34 +01:00
Joe Farebrother
f3dea1d647
Add changenote
2024-08-28 09:04:01 +01:00
Joe Farebrother
fc24ca304d
Update tests
2024-08-27 14:18:50 +01:00
Joe Farebrother
1cb23e7e86
Exclude certificates from being cinsidered sensitive data by cleartext-storage and cleartext-logging queries
2024-08-27 14:18:39 +01:00
Tom Hvitved
c92c96fa78
Data flow: Compute local big step relation per stage
2024-08-26 09:15:27 +02:00
github-actions[bot]
0724fd7ce2
Post-release preparation for codeql-cli-2.18.3
2024-08-21 18:25:54 +00:00
github-actions[bot]
17cd9624fb
Release preparation for version 2.18.3
2024-08-21 17:13:52 +00:00
Anders Schack-Mulligen
993bfee096
Merge pull request #17259 from aschackmull/dataflow/remove-srcsink-grouping
...
Dataflow: Remove src/sink grouping feature
2024-08-20 14:42:33 +02:00
Anders Schack-Mulligen
8470e91c16
Legacy Dataflow: Sync.
2024-08-20 10:07:57 +02:00
Felicity Chapman
fcb2b5730f
Update CookieInjection.ql to remove period
2024-08-15 13:17:13 +01:00
Tom Hvitved
51077ce2e7
Merge pull request #17173 from hvitved/shared/inline-flow-provenance
...
Shared: Apply `ShowProvenance` in `InlineFlowTest.qll`
2024-08-13 14:15:08 +02:00
Tom Hvitved
0fcfb47423
Sync shared files
2024-08-13 13:34:45 +02:00
Rasmus Wriedt Larsen
6dd52e45e4
Merge pull request #17154 from RasmusWL/poetry-update
...
Python: Upgrade lockfile for extractor tests
2024-08-13 11:54:15 +02:00
Alexander Eyers-Taylor
ffd811a55d
Merge pull request #17182 from github/post-release-prep/codeql-cli-2.18.2
...
Post-release preparation for codeql-cli-2.18.2
2024-08-08 16:28:03 +01:00
github-actions[bot]
cc6d87c276
Post-release preparation for codeql-cli-2.18.2
2024-08-08 12:56:21 +00:00
github-actions[bot]
019da8c287
Release preparation for version 2.18.2
2024-08-07 14:02:38 +00:00
Alexander Eyers-Taylor
46577b585e
Revert "Release preparation for version 2.18.2"
2024-08-07 14:24:37 +01:00
Joe Farebrother
62c2fe6b17
Merge pull request #16933 from joefarebrother/python-cookie-concept-promote
...
Python: Promote the insecure cookie query from experimental
2024-08-07 09:06:05 +01:00
Joe Farebrother
24df54804a
Review suggestion - Add link to qldoc
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-08-06 22:59:14 +01:00
github-actions[bot]
c14ba0e4bd
Release preparation for version 2.18.2
2024-08-06 12:46:15 +00:00
Rasmus Wriedt Larsen
d50898e114
Python: Downgrade packaging for Python 3.7 support
2024-08-06 11:15:48 +02:00
Rasmus Wriedt Larsen
4eb6afa880
Python: Update poetry.lock
2024-08-05 14:14:41 +02:00
Anders Schack-Mulligen
377301a55a
Merge pull request #17108 from aschackmull/dataflow/flowthrough-provenance
...
Dataflow: Propagate provenance correctly for flow-through wrappers.
2024-08-01 09:35:56 +02:00
yoff
251036c6b4
Merge pull request #17080 from sylwia-budzynska/streamlit
...
Python: Add Streamlit models
2024-07-31 18:20:11 +02:00
Anders Schack-Mulligen
9724516c84
C#/Go/Java/Python/Ruby: Accept qltest .expected changes.
2024-07-31 14:45:10 +02:00
yoff
123dcc75d1
Merge pull request #16971 from RasmusWL/mad-dict-source
...
Python: Add MaD support for DictionaryElement/DictionaryElementAny for sources
2024-07-31 13:40:07 +02:00
Sylwia Budzynska
9bd00c9e1e
Change Gradio rfs test to use shared rfs test module
2024-07-31 13:25:32 +02:00
Sylwia Budzynska
2a6ad00a2f
Fix typo
2024-07-31 13:22:27 +02:00
Sylwia Budzynska
72e7b6c872
Update python/ql/lib/semmle/python/frameworks/Streamlit.qll
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-31 13:20:01 +02:00
Sylwia Budzynska
81f3609c4b
Formatting
2024-07-30 17:49:20 +02:00
Sylwia Budzynska
dfc51922ba
Change regex
2024-07-30 17:39:34 +02:00
Sylwia Budzynska
ef2b225144
Fix PascalCase
2024-07-30 17:36:55 +02:00
