Owen Mansel-Chan
20ce679d61
Accept changed edges in test output
...
No changes to alerts
2026-06-02 16:15:08 +01:00
Owen Mansel-Chan
f62ebef9e0
Adjust expected test output
2026-06-02 16:15:06 +01:00
Owen Mansel-Chan
c3ef1ddd64
Add MaD models for lxml and xml etree.fromstringlist
2026-06-02 16:15:01 +01:00
Owen Mansel-Chan
dede5bc49b
Track flow through tuple() with list with tainted elements
2026-06-02 16:14:59 +01:00
Owen Mansel-Chan
ad97b6dd64
Use access path for str.join model
2026-06-02 16:14:56 +01:00
Owen Mansel-Chan
b38440490a
Address review comment
2026-05-31 21:47:44 +01:00
Owen Mansel-Chan
aee33a0cc9
Add missing code for TAnyTupleOrDictionaryElement
2026-05-29 10:26:24 +01:00
Owen Mansel-Chan
df15a719cb
Add a ContentSet for any tuple or dictionary element
2026-05-28 16:48:23 +01:00
Owen Mansel-Chan
812e8e6b34
Add change note
2026-05-28 11:37:54 +01:00
Owen Mansel-Chan
80c6f082d1
Fix TODO in containerStep
2026-05-28 11:34:02 +01:00
Owen Mansel-Chan
ec13e1bcd3
Add wildcard ContentSets to avoid performance problems
2026-05-27 15:28:07 +01:00
Owen Mansel-Chan
e8779295ee
Update test results
2026-05-22 11:43:18 +01:00
Rasmus Lerchedahl Petersen
fa758d6bf5
python: fix test
2026-05-21 16:59:19 +01:00
Rasmus Lerchedahl Petersen
fa9426c749
Python: extra tests for comprehension
2026-05-21 16:59:18 +01:00
Rasmus Lerchedahl Petersen
0ecca91dea
Python: typo
2026-05-21 16:59:16 +01:00
Rasmus Lerchedahl Petersen
f669a4f3bf
Python: Make sure all imprecise taint bubbles up
2026-05-21 16:59:14 +01:00
Rasmus Lerchedahl Petersen
3275c814bd
Python: reset test expectations
2026-05-21 16:59:11 +01:00
Rasmus Lerchedahl Petersen
9a180036a5
Python: conversion step for format_map
...
and adjust collection test
2026-05-21 16:59:08 +01:00
Rasmus Lerchedahl Petersen
93e7ab52b7
Python: adjust test expectations
...
We now find an alert on this line as we hope to
It is not an alert for _full_ SSRF, though, since that configuration cannot handle multiple substitutions.
2026-05-21 16:58:51 +01:00
Rasmus Lerchedahl Petersen
facb3b681d
Python: recover taint for % format strings
2026-05-21 16:57:50 +01:00
Rasmus Lerchedahl Petersen
b67694b2ab
Python: Remove imprecise container steps
...
- remove `tupleStoreStep` and `dictStoreStep` from `containerStep`
These are imprecise compared to the content being precise.
- add implicit reads to recover taint at sinks
- add implicit read steps for decoders
to supplement the `AdditionalTaintStep`
that now only covers when the full container is tainted.
2026-05-21 16:57:44 +01:00
Geoffrey White
3aa660663e
Merge pull request #21806 from geoffw0/extsensitive
...
Shared: Improvements to SensitiveDataHeuristics.qll
2026-05-19 16:22:03 +01:00
Geoffrey White
a4b2c0f6fd
Update change notes (Copilot's suggestions).
2026-05-15 09:24:29 +01:00
Geoffrey White
59dbd68a5e
Add change notes.
2026-05-14 14:46:05 +01:00
Geoffrey White
c8196e439f
Merge branch 'main' into extsensitive
2026-05-13 13:04:48 +01:00
Paolo Tranquilli
ee13ea0f6b
Harden _relative_path for Windows and mixed-form inputs
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-13 11:35:02 +02:00
Paolo Tranquilli
d28792537b
Python extractor: use relative paths in diagnostic locations
...
Diagnostic `Location.file` fields contained absolute filesystem paths,
causing the GitHub UI to generate broken file links with runner paths
like `/home/runner/work/...`. Now paths are relativized against the
source root (`LGTM_SRC` or cwd), falling back to absolute if the file
is outside the source root.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-13 10:32:05 +02:00
Owen Mansel-Chan
0b808e1170
Merge pull request #21807 from owen-mc/java/improve-qhelp-unsafe-deserialization
...
Shared: improve qhelp for unsafe deserialization queries
2026-05-12 22:22:49 +01:00
Geoffrey White
af0124f0f1
Merge branch 'main' into extsensitive
2026-05-11 09:47:29 +01:00
Owen Mansel-Chan
a5ef036465
Note that common standard library types can be vulnerable to gadget-chain attacks
2026-05-08 14:18:54 +01:00
Owen Mansel-Chan
93e05db394
Python: remove doubles spaces from qhelp
2026-05-08 14:06:48 +01:00
Owen Mansel-Chan
e2874ac252
Python: Clarify that deserialization following a schema is safe
2026-05-08 14:05:55 +01:00
Geoffrey White
1c704a0912
Python: Accept test changes (improvement).
2026-05-07 10:28:19 +01:00
github-actions[bot]
7610277199
Post-release preparation for codeql-cli-2.25.4
2026-05-05 10:10:06 +00:00
github-actions[bot]
88e1d86c27
Release preparation for version 2.25.4
2026-05-05 09:34:30 +00:00
Josef Svenningsson
68be006a29
Merge pull request #21641 from github/josefs/promptInjectionImprovements
...
Improve prompt inject for Python
2026-04-29 11:23:52 +01:00
Josef Svenningsson
25a8aa97b2
Fix openai prompt injection tests
2026-04-28 18:24:26 +01:00
Josef Svenningsson
691aeb0815
Remove the chat completion create logic.
2026-04-28 18:24:24 +01:00
Josef Svenningsson
a05e191518
Add tests for anthropic prompt injection models
2026-04-28 18:24:22 +01:00
Josef Svenningsson
e069c9c2ee
Fix tests
2026-04-28 18:24:19 +01:00
Josef Svenningsson
bb18bb084c
Improve prompt inject for Python
2026-04-28 18:24:16 +01:00
Owen Mansel-Chan
6efb21314a
Merge pull request #21523 from owen-mc/docs/mad/barriers
...
Document models-as-data barriers and barrier guards and add change notes
2026-04-21 13:49:19 +01:00
Michael B. Gale
58e9bad0a0
Merge pull request #21737 from github/post-release-prep/codeql-cli-2.25.3
...
Post-release preparation for codeql-cli-2.25.3
2026-04-21 11:48:30 +02:00
Taus
b108e173a5
Merge pull request #21695 from github/tausbn/python-add-support-for-pep-798
...
Python: Add support for PEP-798
2026-04-20 15:01:01 +02:00
github-actions[bot]
a0bab539bb
Post-release preparation for codeql-cli-2.25.3
2026-04-20 12:40:34 +00:00
github-actions[bot]
c861d99802
Release preparation for version 2.25.3
2026-04-20 09:27:23 +00:00
Taus
ac23e16786
Python: Move Python 3.15 data-flow tests to a separate file
...
We won't be able to run these tests until Python 3.15 is actually out
(and our CI is using it), so it seemed easiest to just put them in their
own test directory.
2026-04-17 13:16:46 +00:00
Taus
dc36609743
Python: Add data-flow tests
...
Alas, all these demonstrate is that we already don't fully support the
desugared `yield from` form.
2026-04-17 12:15:04 +00:00
Taus
6c675fcede
Python: Consolidate duplicated code
2026-04-16 21:14:42 +00:00
Owen Mansel-Chan
8f17b73796
Fix link formatting in change notes
2026-04-14 15:27:37 +01:00
