yoff
2b6aab108d
Update python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
...
Co-authored-by: Taus <tausbn@github.com >
2024-10-01 12:36:20 +02:00
Rasmus Lerchedahl Petersen
dacc0ab8fe
Python: docs and a simplification
2024-09-30 16:06:30 +02:00
Rasmus Lerchedahl Petersen
438e664116
Python: add missing qldoc
...
More doc is needed, but this should turn the tests green
2024-09-30 15:43:19 +02:00
Rasmus Lerchedahl Petersen
7392d186bc
Python: use yield step also for taint
...
Using the comprehension store step meant that all comprehensions would receive taint.
This because comprehension flow now goes via a callable, meaning they share the return node.
2024-09-30 13:49:01 +02:00
Rasmus Lerchedahl Petersen
ded39749a7
Python: allow comp arg as argumentnode
2024-09-30 13:02:20 +02:00
Rasmus Lerchedahl Petersen
3ef05a628f
Python: add location to node
2024-09-30 11:56:36 +02:00
Rasmus Lerchedahl Petersen
310819d392
Python: fix dataflow inconsistencies
...
- adjust scope of argument, the argument is outside the called function
- add missing post-update nodes for the new arguments
2024-09-30 10:31:36 +02:00
Rasmus Lerchedahl Petersen
d4ea62edec
Python: flow through yield
...
- add yield as a dataflow return
- replace comprehension store step
with a store step to the yield
2024-09-30 09:01:29 +02:00
Rasmus Lerchedahl Petersen
72530a8312
Python: use synthetic node for comprehension capture argument
...
We used to use the CfgNode for the comprehension itself.
In cases where that is also an argument, say
```python
",".join([x for x in l])
```
that would be an argument to two different calls causing a dataflow consistency violation.
2024-09-27 12:15:03 +02:00
Rasmus Lerchedahl Petersen
294092b671
Python: use comprehension function argument
...
For a comprehension `[x for x in l]
- `l` is now a legal argument (in DataFlowPublic)
- `l` is the argument of the comprehension function (in DataFlowDispatch)
- the parameter of the comprehension function is being read rather than `l` (in IterableUnpacking)
Thus the read that used to cross callable boundaries is now split into a arg-param edge and a read from that param.
2024-09-27 09:44:39 +02:00
Rasmus Lerchedahl Petersen
fc2dc28f87
python: capture flow through comprehensions
...
- add comprehension functions as `DataFlowCallable`s
- add comprehension call as `DataFlowCall`
- create capture argument node for comprehension calls
2024-09-25 10:02:31 +02:00
Taus
8c015b0784
Merge pull request #17305 from Kwstubbs/CORSMiddleware-Starlette
...
Python: Add Support for CORS Middlewares
2024-09-24 15:51:49 +02:00
Chuan-kai Lin
1cd8af54f2
Merge pull request #17190 from github/cklin/diff-informed-java-queries
...
Java: add support for alert location restrictions
2024-09-23 08:39:24 -07:00
Joe Farebrother
48f9e0efe5
Adress review comments: Add missing deprecation + additional test case
2024-09-23 10:57:04 +01:00
Anders Schack-Mulligen
3a1e50dcf9
Dataflow: Simplify diff-informed implementation and tweak flag name.
2024-09-20 07:07:10 -07:00
Joe Farebrother
3001a570b2
Replace uses of StringConstCompare
2024-09-20 14:47:22 +01:00
Joe Farebrother
164cf27e67
Add additional constant checks to constant barrier gaurd
2024-09-20 12:46:10 +01:00
Kevin Stubbings
c30332818f
Reorder and rename
2024-09-13 00:41:55 -07:00
Kevin Stubbings
03f375e436
missed some
2024-09-13 00:21:33 -07:00
Kevin Stubbings
831d522025
First round feedback
2024-09-12 20:49:10 -07:00
Chuan-kai Lin
ff78bebf19
Shared support for alert filtering
2024-09-11 13:18:26 -07:00
Joe Farebrother
d1cca13563
Merge pull request #17314 from joefarebrother/python-x509-cert
...
Python: Exclude certificate classification fo sensitive data queries
2024-09-09 10:48:36 +01:00
erik-krogh
20dfdc9661
delete some deprecated files
2024-09-03 20:30:59 +02:00
erik-krogh
0fdd06fff5
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
Joe Farebrother
ec7ad84cd1
Update formatting
2024-08-30 13:51:33 +01:00
Joe Farebrother
5360192a58
Apply review suggestions - change = to in
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-08-30 13:25:59 +01:00
Joe Farebrother
1cb23e7e86
Exclude certificates from being cinsidered sensitive data by cleartext-storage and cleartext-logging queries
2024-08-27 14:18:39 +01:00
Kevin Stubbings
812abea0de
change-notes
2024-08-26 22:25:00 -07:00
Kevin Stubbings
0420d25c13
refactor
2024-08-26 22:09:24 -07:00
Kevin Stubbings
1db7865d49
Corrections
2024-08-26 22:06:12 -07:00
Kevin Stubbings
8bf8893307
Add support for vulnerable CORS middlewares
2024-08-26 21:30:48 -07:00
Anders Schack-Mulligen
8470e91c16
Legacy Dataflow: Sync.
2024-08-20 10:07:57 +02:00
Tom Hvitved
0fcfb47423
Sync shared files
2024-08-13 13:34:45 +02:00
Joe Farebrother
62c2fe6b17
Merge pull request #16933 from joefarebrother/python-cookie-concept-promote
...
Python: Promote the insecure cookie query from experimental
2024-08-07 09:06:05 +01:00
Joe Farebrother
24df54804a
Review suggestion - Add link to qldoc
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-08-06 22:59:14 +01:00
yoff
251036c6b4
Merge pull request #17080 from sylwia-budzynska/streamlit
...
Python: Add Streamlit models
2024-07-31 18:20:11 +02:00
yoff
123dcc75d1
Merge pull request #16971 from RasmusWL/mad-dict-source
...
Python: Add MaD support for DictionaryElement/DictionaryElementAny for sources
2024-07-31 13:40:07 +02:00
Sylwia Budzynska
2a6ad00a2f
Fix typo
2024-07-31 13:22:27 +02:00
Sylwia Budzynska
72e7b6c872
Update python/ql/lib/semmle/python/frameworks/Streamlit.qll
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-31 13:20:01 +02:00
Sylwia Budzynska
81f3609c4b
Formatting
2024-07-30 17:49:20 +02:00
Sylwia Budzynska
dfc51922ba
Change regex
2024-07-30 17:39:34 +02:00
Sylwia Budzynska
ef2b225144
Fix PascalCase
2024-07-30 17:36:55 +02:00
Sylwia Budzynska
f796efe470
Add Streamlit SQLAlchemy models
2024-07-30 17:20:52 +02:00
Sylwia Budzynska
bfd2e4350b
Add StreamlitConnection model
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-30 12:58:49 +02:00
Joe Farebrother
82da8b95a7
Fix typo
2024-07-29 23:29:19 +01:00
Joe Farebrother
ef3bbeacd6
Add check for kwargs in cookie attribute predicates
2024-07-29 11:17:42 +01:00
Joe Farebrother
90e87a1752
Factor each framework implementation of the cookie parameters to a common concept
2024-07-29 10:51:24 +01:00
Joe Farebrother
c7f9095739
Apply similar changes to httponly
2024-07-29 10:29:59 +01:00
Joe Farebrother
1127b08635
Merge branch 'main' into python-cookie-concept-promote
2024-07-29 10:26:03 +01:00
Joe Farebrother
d997eee6e6
Code review suggestions - make definitions clearer
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-29 10:22:33 +01:00
