erik-krogh
355499ea52
move getACommonTld to the shared pack
2022-12-17 17:26:18 +01:00
erik-krogh
f67d0bc8c0
put the shared HostnameRegexp code in the shared regex pack
2022-12-17 17:26:18 +01:00
erik-krogh
b3a9c1ca06
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
Rasmus Wriedt Larsen
d684dbdf5c
Merge pull request #10656 from porcupineyhairs/PyPamImprove
...
Python: Improve the PAM authentication bypass query
2022-12-08 11:59:10 +01:00
Jami Cogswell
1f4bd00993
split rsa/dsa/dh
2022-12-01 11:56:44 -05:00
Jami Cogswell
0fa05d47e3
add shared key sizes
2022-12-01 11:56:44 -05:00
Rasmus Wriedt Larsen
3d9556e5a3
Python: Use proper Query suffix
2022-11-28 16:03:17 +01:00
Rasmus Wriedt Larsen
c310948521
Python: Remove enclosing module for PAM Auth Bypass.qll
2022-11-28 16:02:38 +01:00
Porcupiney Hairs
db231a111c
Python : Improve the PAM authentication bypass query
...
The current PAM auth bypass query which was contributed by me a few months back, alert on a vulenrable function but does not check if the function is actually function. This leads to a lot of fasle positives.
With this PR, I add a taint-tracking configuration to check if the username parameter can actually be supplied by an attacker.
This should bring the FP's significantly down.
2022-11-19 01:29:25 +05:30
Erik Krogh Kristensen
d2857006cf
Merge pull request #11247 from erik-krogh/py-redosMod
...
Python: use the shared regex pack
2022-11-14 21:10:43 +01:00
erik-krogh
c8b7eccc6f
sync files
2022-11-09 11:31:13 +01:00
erik-krogh
4f11e2d25f
port the Python regex/redos queries to use the shared pack
2022-11-07 14:31:51 +01:00
erik-krogh
c15f63ce62
sync files
2022-11-01 21:35:27 +01:00
Taus
fa2faeb77b
Merge pull request #10802 from jsoref/spelling-python
...
Spelling python
2022-10-17 11:33:27 +02:00
Josh Soref
bc339e4477
spelling: see https
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:09 -04:00
Josh Soref
45d1e3f9b2
spelling: representation
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 10:56:41 -04:00
Josh Soref
124c5544cf
spelling: predicates
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 10:56:41 -04:00
Josh Soref
52a3e3c2fd
spelling: heuristic
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 10:56:41 -04:00
Josh Soref
5d94733078
spelling: ambiguously
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 10:51:25 -04:00
Josh Soref
09c8a98761
spelling: representation
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:20:26 -04:00
Josh Soref
bb1ce8973a
spelling: repeatable
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:20:24 -04:00
Josh Soref
adb8860b9b
spelling: pattern
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:20:24 -04:00
Josh Soref
98b317d1a5
spelling: escape
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:02:00 -04:00
Josh Soref
370da943dc
spelling: abcdefghijklmnopqrstuvwxyz
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-12 15:02:00 -04:00
Nick Rolfe
ed74e0aad1
JS/Python/Ruby: s/a HTML/an HTML/
2022-09-30 10:37:52 +01:00
Erik Krogh Kristensen
a4cd913aea
Merge pull request #10312 from erik-krogh/fix-caseDiff
...
ensure consistent casing of names
2022-09-19 10:43:12 +02:00
erik-krogh
252394666c
sync files
2022-09-13 20:44:05 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
erik-krogh
a86a940df7
add getRepr() and toString() on RelevantState
2022-09-05 13:27:34 +02:00
erik-krogh
3f1cb04f3e
sync files
2022-09-05 11:22:34 +02:00
erik-krogh
c38062ce93
convert RelevantState to a class in the PrefixConstruction module
2022-09-02 20:26:31 +02:00
erik-krogh
7fd426e748
print a correct range for ranges that doesn't contain any alpha-numeric chars
2022-08-30 13:57:11 +02:00
Erik Krogh Kristensen
8f0b999c31
Merge pull request #10207 from erik-krogh/fixRank
...
fix performance issue in the ReDoS query
2022-08-30 10:17:11 +02:00
erik-krogh
f47b097d7c
put a limit on the length of the equivalent range
2022-08-29 21:03:52 +02:00
erik-krogh
77949cbeb3
add context to the rankState predicate in ExponentialBackTracking.qll
2022-08-29 13:42:05 +02:00
Erik Krogh Kristensen
ba1ad00d2a
Merge pull request #10062 from erik-krogh/redosPrefix
...
JS: use the shared regular expression libraries in `js/case-sensitive-middleware-path`
2022-08-25 12:57:16 +02:00
Ian Lynagh
501a9b3c6b
Make *.qll non-executable
2022-08-24 16:36:15 +01:00
erik-krogh
5e3cb08ed2
rename stateInPumpableRegexp to stateInRelevantRegexp
2022-08-23 12:40:45 +02:00
erik-krogh
049af68bc2
restrict suffix-construction to relevant regexps
2022-08-21 20:35:39 +02:00
erik-krogh
d052b1e3c9
also support regular expressions without repetitions
2022-08-19 19:21:44 +02:00
erik-krogh
473bc92e2d
move the PrefixConstruction module out of the ReDoSPruning module
2022-08-18 10:07:48 +02:00
erik-krogh
5586c9a17e
delete old deprecations
2022-08-16 22:27:15 +02:00
erik-krogh
8e6a36256c
import the non-deprecated NfaUtils in the overly-large-range query
2022-08-16 11:21:43 +02:00
Erik Krogh Kristensen
f106e064fa
Merge pull request #9422 from erik-krogh/refacReDoS
...
Refactorizations of the ReDoS libraries
2022-08-16 09:32:08 +02:00
Erik Krogh Kristensen
0adb588fe8
Merge pull request #9712 from erik-krogh/badRange
...
JS/RB/PY/Java: add suspicious range query
2022-08-15 13:55:44 +02:00
erik-krogh
3a4a3437b5
fix some QL-for-QL warnings
2022-08-12 20:38:50 +02:00
erik-krogh
b9e96fb078
sync changes to other languages
2022-08-12 20:28:12 +02:00
Erik Krogh Kristensen
49276b1f38
Merge branch 'main' into refacReDoS
2022-08-09 16:18:46 +02:00
Erik Krogh Kristensen
595875ff98
remove redundant not-equals check
2022-07-13 12:06:12 +02:00
Erik Krogh Kristensen
8e52fc97fc
changes based on review by Shack
2022-07-12 16:02:50 +02:00
