Rasmus Lerchedahl Petersen
9cb83fcdc9
python: add summaries for
...
copy, pop, get, getitem, setdefault
Also add read steps to taint tracking.
Reading from a tainted collection can be done in two situations:
1. There is an acces path
In this case a read step (possibly from a flow summary)
gives rise to a taint step.
2. There is no access path
In this case an explicit taint step (possibly via a flow
summary) should exist.
2023-05-26 14:04:15 +02:00
Rasmus Lerchedahl Petersen
8d4f9447b1
python: remove explicit steps
...
copy, pop, get, popitem
2023-05-26 13:22:54 +02:00
Rasmus Wriedt Larsen
62f0c64a03
Merge pull request #12552 from erik-krogh/py-type-trackers
...
Py: refactor regex tracking to type-trackers
2023-05-11 16:18:34 +02:00
erik-krogh
f0254fc089
introduce RegExpInterpretation instead of RegexString, and move RegexTreeView.qll into a regexp folder
2023-05-01 10:42:13 +02:00
Rasmus Wriedt Larsen
d73289ac4e
Python: Accept .expected changes
2023-04-27 11:54:39 +02:00
erik-krogh
e189b36e3f
materialize less strings when ranking states
2023-03-23 10:35:58 +01:00
erik-krogh
b071d3557e
JS/PY/RB: add a worst-case test, that now performs OK
2023-03-22 10:13:18 +01:00
erik-krogh
b208988675
Py: add test for problematic regex
2023-03-16 12:21:00 +01:00
erik-krogh
6e712b293a
add tracking of strings to compile-sites for poly-redos, in the style of Ruby
2023-02-02 22:56:20 +01:00
erik-krogh
52959d7c0a
add failing test for not tracking strings to re.compile
2023-02-02 19:10:32 +01:00
erik-krogh
618438642a
update expected output of the queries (some sorting changed due to locations being used slightly differently in the shared pack)
2022-11-07 14:31:52 +01:00
erik-krogh
4f11e2d25f
port the Python regex/redos queries to use the shared pack
2022-11-07 14:31:51 +01:00
erik-krogh
4da0508dae
Merge branch 'main' into py-last-msg
2022-10-11 10:49:19 +02:00
erik-krogh
944ca4a0da
fix some more style-guide violations in the alert-messages
2022-10-07 11:23:34 +02:00
Rasmus Wriedt Larsen
b01a0ae696
Python: Adjust .expected after flask source change
...
It's really hard to audit that this is all good.. I tried my best with
`icdiff` though -- and there is a problem with
ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql
that needs to be fixed in the next commit
2022-10-03 20:35:49 +02:00
Erik Krogh Kristensen
13482fc97b
rename ReDoSUtil to NfaUtils, and rename the "performance" folder to "regexp"
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
36db492aa2
move the polynomialbacktracking-test to the test folder
2022-03-28 13:22:26 +02:00
Rasmus Lerchedahl Petersen
8536f5f5a2
Python: remember to update refs...
2021-10-28 14:32:53 +02:00
Anders Schack-Mulligen
f30dad7705
Dataflow: Update test expected outputs.
2021-09-07 13:02:20 +02:00
Taus
e9a4114c04
Python: Hotfix: Disable ReDoS queries
2021-07-22 10:58:49 +00:00
Rasmus Wriedt Larsen
a5834c4d78
Python: Fix py/polynomial-redos
2021-07-15 14:16:19 +02:00
Rasmus Wriedt Larsen
76caf43b54
Python: Add tests for py/polynomial-redos
2021-07-15 14:15:44 +02:00
