Rasmus Lerchedahl Petersen
294092b671
Python: use comprehension function argument
...
For a comprehension `[x for x in l]
- `l` is now a legal argument (in DataFlowPublic)
- `l` is the argument of the comprehension function (in DataFlowDispatch)
- the parameter of the comprehension function is being read rather than `l` (in IterableUnpacking)
Thus the read that used to cross callable boundaries is now split into a arg-param edge and a read from that param.
2024-09-27 09:44:39 +02:00
Rasmus Lerchedahl Petersen
fc2dc28f87
python: capture flow through comprehensions
...
- add comprehension functions as `DataFlowCallable`s
- add comprehension call as `DataFlowCall`
- create capture argument node for comprehension calls
2024-09-25 10:02:31 +02:00
Taus
8c015b0784
Merge pull request #17305 from Kwstubbs/CORSMiddleware-Starlette
...
Python: Add Support for CORS Middlewares
2024-09-24 15:51:49 +02:00
Chuan-kai Lin
1cd8af54f2
Merge pull request #17190 from github/cklin/diff-informed-java-queries
...
Java: add support for alert location restrictions
2024-09-23 08:39:24 -07:00
Joe Farebrother
48f9e0efe5
Adress review comments: Add missing deprecation + additional test case
2024-09-23 10:57:04 +01:00
Anders Schack-Mulligen
3a1e50dcf9
Dataflow: Simplify diff-informed implementation and tweak flag name.
2024-09-20 07:07:10 -07:00
Joe Farebrother
3001a570b2
Replace uses of StringConstCompare
2024-09-20 14:47:22 +01:00
Joe Farebrother
164cf27e67
Add additional constant checks to constant barrier gaurd
2024-09-20 12:46:10 +01:00
Kevin Stubbings
c30332818f
Reorder and rename
2024-09-13 00:41:55 -07:00
Kevin Stubbings
03f375e436
missed some
2024-09-13 00:21:33 -07:00
Kevin Stubbings
831d522025
First round feedback
2024-09-12 20:49:10 -07:00
Chuan-kai Lin
ff78bebf19
Shared support for alert filtering
2024-09-11 13:18:26 -07:00
Joe Farebrother
d1cca13563
Merge pull request #17314 from joefarebrother/python-x509-cert
...
Python: Exclude certificate classification fo sensitive data queries
2024-09-09 10:48:36 +01:00
erik-krogh
20dfdc9661
delete some deprecated files
2024-09-03 20:30:59 +02:00
erik-krogh
0fdd06fff5
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
Joe Farebrother
ec7ad84cd1
Update formatting
2024-08-30 13:51:33 +01:00
Joe Farebrother
5360192a58
Apply review suggestions - change = to in
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-08-30 13:25:59 +01:00
Joe Farebrother
1cb23e7e86
Exclude certificates from being cinsidered sensitive data by cleartext-storage and cleartext-logging queries
2024-08-27 14:18:39 +01:00
Kevin Stubbings
812abea0de
change-notes
2024-08-26 22:25:00 -07:00
Kevin Stubbings
0420d25c13
refactor
2024-08-26 22:09:24 -07:00
Kevin Stubbings
1db7865d49
Corrections
2024-08-26 22:06:12 -07:00
Kevin Stubbings
8bf8893307
Add support for vulnerable CORS middlewares
2024-08-26 21:30:48 -07:00
Anders Schack-Mulligen
8470e91c16
Legacy Dataflow: Sync.
2024-08-20 10:07:57 +02:00
Tom Hvitved
0fcfb47423
Sync shared files
2024-08-13 13:34:45 +02:00
Joe Farebrother
62c2fe6b17
Merge pull request #16933 from joefarebrother/python-cookie-concept-promote
...
Python: Promote the insecure cookie query from experimental
2024-08-07 09:06:05 +01:00
Joe Farebrother
24df54804a
Review suggestion - Add link to qldoc
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-08-06 22:59:14 +01:00
yoff
251036c6b4
Merge pull request #17080 from sylwia-budzynska/streamlit
...
Python: Add Streamlit models
2024-07-31 18:20:11 +02:00
yoff
123dcc75d1
Merge pull request #16971 from RasmusWL/mad-dict-source
...
Python: Add MaD support for DictionaryElement/DictionaryElementAny for sources
2024-07-31 13:40:07 +02:00
Sylwia Budzynska
2a6ad00a2f
Fix typo
2024-07-31 13:22:27 +02:00
Sylwia Budzynska
72e7b6c872
Update python/ql/lib/semmle/python/frameworks/Streamlit.qll
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-31 13:20:01 +02:00
Sylwia Budzynska
81f3609c4b
Formatting
2024-07-30 17:49:20 +02:00
Sylwia Budzynska
dfc51922ba
Change regex
2024-07-30 17:39:34 +02:00
Sylwia Budzynska
ef2b225144
Fix PascalCase
2024-07-30 17:36:55 +02:00
Sylwia Budzynska
f796efe470
Add Streamlit SQLAlchemy models
2024-07-30 17:20:52 +02:00
Sylwia Budzynska
bfd2e4350b
Add StreamlitConnection model
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-30 12:58:49 +02:00
Joe Farebrother
82da8b95a7
Fix typo
2024-07-29 23:29:19 +01:00
Joe Farebrother
ef3bbeacd6
Add check for kwargs in cookie attribute predicates
2024-07-29 11:17:42 +01:00
Joe Farebrother
90e87a1752
Factor each framework implementation of the cookie parameters to a common concept
2024-07-29 10:51:24 +01:00
Joe Farebrother
c7f9095739
Apply similar changes to httponly
2024-07-29 10:29:59 +01:00
Joe Farebrother
1127b08635
Merge branch 'main' into python-cookie-concept-promote
2024-07-29 10:26:03 +01:00
Joe Farebrother
d997eee6e6
Code review suggestions - make definitions clearer
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-29 10:22:33 +01:00
Joe Farebrother
58689c90fb
Merge pull request #16893 from joefarebrother/python-cookie-injectio-promote
...
Python: Promote cookie injection query from experimental
2024-07-29 10:17:01 +01:00
Sylwia Budzynska
a05266c236
Formatting
2024-07-26 14:55:58 +02:00
Sylwia Budzynska
6d1c00742f
Add tests and change note
2024-07-26 14:15:43 +02:00
Sylwia Budzynska
221c18934c
Add models
2024-07-26 13:23:39 +02:00
Anders Schack-Mulligen
7a48fe1102
Dataflow: Replace ppReprType with DataFlowType.toString.
2024-07-25 13:08:47 +02:00
Joe Farebrother
b28d79960b
Update ConceptsTests and make a fix
2024-07-23 10:15:09 +01:00
Joe Farebrother
be87eb50d4
Add cookie models to each framework
2024-07-23 10:15:02 +01:00
Joe Farebrother
226e4eb8a5
Use a 3-valued newtype for hasSameSiteAttribute
2024-07-23 10:14:45 +01:00
Joe Farebrother
32fbe52f0f
Model cookie attributes for Django and Flask
2024-07-23 10:14:33 +01:00
