Rasmus Lerchedahl Petersen
36e27f2aa4
Python: Remove promoted code:
...
- queries (`py/regex-injection`)
- concepts (RegexExecution, RegexEscape)
- library models (Stdlib::Re)
2021-09-14 13:14:16 +02:00
jorgectf
e6ce10b5c5
Merge remote-tracking branch 'origin/main' into jty/python/nosqlInjection
2021-08-10 20:01:08 +02:00
Rasmus Wriedt Larsen
42a997cbcb
Python: Fix deprecation warning
2021-07-22 15:59:13 +02:00
Rasmus Wriedt Larsen
71e6db8a01
Merge branch 'main' into jorgectf/python/ldapimproperauth
2021-07-22 15:57:43 +02:00
Rasmus Wriedt Larsen
802d9bda83
Merge pull request #5680 from mrthankyou/python-use-sqlalchemy
...
Python: Add SqlAlchemy model
2021-07-22 15:31:39 +02:00
Taus
e9a4114c04
Python: Hotfix: Disable ReDoS queries
2021-07-22 10:58:49 +00:00
thank_you
9e01338500
Query only vulnerable methods
2021-07-18 17:13:10 -04:00
thank_you
0be2c6b765
Add SQLEscapySanitizerCall class
2021-06-29 19:39:46 -04:00
thank_you
986f2f4302
Add SQLEscape module
2021-06-29 19:39:26 -04:00
jorgectf
0819090fcb
Fix qldocs typo
2021-06-29 16:53:32 +02:00
jorgectf
2f9e6454a5
Hardcode ldap2 binding functions
2021-06-29 16:14:55 +02:00
Rasmus Wriedt Larsen
a5a7f3e38a
Python: Add taint-step for sqlalchemy.text
2021-06-29 11:06:25 +02:00
Rasmus Wriedt Larsen
684f51ae5f
Merge branch 'main' into python-use-sqlalchemy
2021-06-29 10:58:51 +02:00
jorgectf
51395d155f
Move xmltodict to its own file under frameworks/
2021-06-28 21:08:43 +02:00
Jorge
350440897c
Apply suggestions from code review
...
Update `xmltodict` format and delete `ujson` modeling.
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-06-28 21:02:40 +02:00
jorgectf
68c683189a
Polish documentation, mongoCollectionMethod() and update .expected
2021-06-28 20:55:49 +02:00
jorgectf
1d4d8ab6e0
Fix tests
2021-06-28 14:16:52 +02:00
jorgectf
b9422518b3
Rephrase .qhelp
2021-06-28 14:00:00 +02:00
Rasmus Wriedt Larsen
318694ccc8
Python: Don't rely on d = d.getOutput() for Decoding
...
Although it is for `json.loads` and the like.
2021-06-28 13:17:45 +02:00
Rasmus Wriedt Larsen
59711424bd
Python: Fix qhelp for NoSQL injection
2021-06-28 11:48:28 +02:00
Rasmus Wriedt Larsen
5477b2e0d5
Python: Minor refactoring cleanup
2021-06-28 10:54:21 +02:00
Rasmus Wriedt Larsen
4a2c99a021
Python: Inline LDAPImproperAuth.qll
...
Since having it inlined makes the query a bit easier to read. We
obviously need to share it if we want to share this predicate, but for
now that does not seem to be the case.
2021-06-28 10:54:21 +02:00
Rasmus Wriedt Larsen
b33f6a315c
Python: Fix select for py/improper-ldap-auth
2021-06-28 10:54:21 +02:00
Rasmus Wriedt Larsen
dfe16aae4c
Python: Handle both positional and keyword args for LDAP bind
2021-06-28 10:46:13 +02:00
Rasmus Wriedt Larsen
a9469b73d9
Python: Port py/clear-text-storage-sensitive-data
2021-06-24 17:39:08 +02:00
Rasmus Wriedt Larsen
e05d6e71b8
Merge pull request #6064 from tausbn/python-add-get-method-call
...
Python: Add `getAMethodCall` to `LocalSourceNode`
2021-06-22 11:16:39 +02:00
Taus
768cab3642
Python: Address review comments
...
- changes `getReceiver` to `getObject`
- fixes `calls` to avoid unwanted cross-talk
- adds some more documentation to highlight the above issue
2021-06-21 14:57:19 +00:00
jorgectf
1d7ddce8db
Update .expected
2021-06-17 18:10:43 +02:00
jorgectf
9cbb7e0899
Change query objective
2021-06-17 17:53:58 +02:00
jorgectf
5704ac36db
Rework LDAP framework modeling
2021-06-17 17:44:08 +02:00
jorgectf
13cfcec968
Change qhelp explanation
2021-06-17 17:43:34 +02:00
jorgectf
d34d2ed2b1
Add .qlref
2021-06-17 17:42:38 +02:00
jorgectf
4e74003cd5
Polish Concepts documentation
2021-06-17 15:44:51 +02:00
jorgectf
7e6032f5b4
Port to Decoding
2021-06-17 15:43:54 +02:00
jorgectf
b8e619a60c
Extend qhelp references
2021-06-17 15:42:45 +02:00
jorgectf
5c7229c715
Optimize Type Tracking stuff
2021-06-16 23:19:05 +02:00
Taus
41ee325bc9
Python: Clean up Stdlib.qll
...
Not as many opportunities to clean stuff up here.
2021-06-15 15:04:30 +00:00
jorgectf
6bed8594f2
Match sanitizer inputs' naming
2021-06-15 16:27:32 +02:00
Rasmus Wriedt Larsen
156b10cb59
Merge branch 'main' into promote-clickhouse
2021-06-15 11:30:19 +02:00
jorgectf
c948970181
resolve merge conflicts
2021-06-15 01:24:04 +02:00
jorgectf
1662c5d113
resolve merge conflict
2021-06-15 01:22:11 +02:00
Taus
3869ab76d1
Python: Promote shared type tracking library
...
This was slightly messier than anticipated, as I hadn't accounted for
the dozen uses of `startInAttr` in our codebase. To circumvent this,
I decided to put the type tracking implementation in the `internal`
directory, and wrap it with a file that ensures the old interface still
works.
2021-06-11 20:20:22 +00:00
Rasmus Wriedt Larsen
f807c2f52b
Python: autoformat
2021-05-26 11:07:48 +02:00
Rasmus Wriedt Larsen
d5f2846394
Merge branch 'main' into jorgectf/python/ldapInjection
2021-05-26 11:01:48 +02:00
Rasmus Wriedt Larsen
1b3f857a2f
Python: Promote ClickHouse SQL models
2021-05-25 16:27:23 +02:00
Rasmus Wriedt Larsen
eb1da152a0
Python: Rewrite ClickHouse SQL lib modeling
...
This did turn into a few changes, that maybe could have been split into
separate PRs 🤷
* Rename `ClickHouseDriver` => `ClickhouseDriver`, to better follow
import name in `.qll` name
* Rewrote modeling to use API graphs
* Split modeling of `aioch` into separate `.qll` file, which does re-use
the `getExecuteMethodName` predicate. I feel that sharing code between
the modeling like this was the best approach, and stuck the
`INTERNAL: Do not use.` labels on both modules.
* I also added handling of keyword arguments (see change in .py files)
2021-05-25 16:13:31 +02:00
Rasmus Wriedt Larsen
ee3477c20a
Python: Remove dummy clickhouse SQL injection query
2021-05-25 14:27:29 +02:00
Rasmus Wriedt Larsen
35793a10bb
Merge pull request #5889 from japroc/python-clickhouse-driver
...
Python: Implement module ClickHouseDriver.qll
2021-05-25 14:25:28 +02:00
jorgectf
37d6ff76a3
Update tests and .expected
2021-05-21 17:47:53 +02:00
Jorge
9e9678b3ca
Apply documentation suggestions
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-05-21 16:17:39 +02:00
