jorgectf
3fd1129895
Delete trivial tests
2021-06-28 20:18:31 +02:00
jorgectf
0ca4f240d9
Merge tests and update .expected
2021-06-28 20:13:53 +02:00
Rasmus Wriedt Larsen
318694ccc8
Python: Don't rely on d = d.getOutput() for Decoding
...
Although it is for `json.loads` and the like.
2021-06-28 13:17:45 +02:00
Rasmus Wriedt Larsen
59711424bd
Python: Fix qhelp for NoSQL injection
2021-06-28 11:48:28 +02:00
jorgectf
eb16018446
Update .expected
2021-06-17 15:45:05 +02:00
jorgectf
4e74003cd5
Polish Concepts documentation
2021-06-17 15:44:51 +02:00
jorgectf
7e6032f5b4
Port to Decoding
2021-06-17 15:43:54 +02:00
jorgectf
8e3d5ff3f9
Rename mongoclient tests
2021-06-17 15:43:01 +02:00
jorgectf
b8e619a60c
Extend qhelp references
2021-06-17 15:42:45 +02:00
jorgectf
8527ccc6d6
Update .expected
2021-06-16 23:19:14 +02:00
jorgectf
5c7229c715
Optimize Type Tracking stuff
2021-06-16 23:19:05 +02:00
jorgectf
81505fbd76
Normalize tests
2021-06-16 23:18:38 +02:00
jorgectf
5123b8f4e3
Update .expected
2021-06-15 20:29:33 +02:00
jorgectf
e61cf9a58d
Simplify tests
2021-06-15 19:32:02 +02:00
jorgectf
6bed8594f2
Match sanitizer inputs' naming
2021-06-15 16:27:32 +02:00
jorgectf
c948970181
resolve merge conflicts
2021-06-15 01:24:04 +02:00
Taus
c6c9a5110a
Merge pull request #6063 from tausbn/python-promote-type-tracking-library
...
Python: Promote shared type tracking library
2021-06-14 18:56:03 +02:00
CodeQL CI
02c017afec
Merge pull request #6058 from RasmusWL/more-aiohttp
...
Approved by yoff
2021-06-14 02:56:59 -07:00
Taus
8016715fb6
Python: Add missing QLDoc
2021-06-11 20:35:58 +00:00
Taus
3869ab76d1
Python: Promote shared type tracking library
...
This was slightly messier than anticipated, as I hadn't accounted for
the dozen uses of `startInAttr` in our codebase. To circumvent this,
I decided to put the type tracking implementation in the `internal`
directory, and wrap it with a file that ensures the old interface still
works.
2021-06-11 20:20:22 +00:00
Calum Grant
85467adc5e
Merge pull request #5839 from github/security-severities5
...
Add security-severity scores
2021-06-11 15:56:20 +01:00
Rasmus Wriedt Larsen
53f7633662
Python: Model await request.post() as MultiDictProxy
...
as highlight as being quite easy to do by @yoff 👍
2021-06-11 14:53:30 +02:00
Rasmus Wriedt Larsen
df67028a1d
Python: Model aiohttp.StreamReader
2021-06-11 12:06:53 +02:00
Rasmus Wriedt Larsen
2d31ef7016
Python: Fix last TODOs in aiohttp tests
2021-06-11 12:00:02 +02:00
Rasmus Wriedt Larsen
64a0e3fd0a
Merge branch 'main' into aiohttp-modeling
2021-06-11 11:42:24 +02:00
Rasmus Wriedt Larsen
8b8e1334cc
Python: Fix syntax error
2021-06-11 11:42:14 +02:00
Rasmus Wriedt Larsen
46f7a2b572
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-06-11 11:28:11 +02:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Taus
e7b9603c5b
Merge pull request #6053 from RasmusWL/fix-tests
...
Python: Fix tests
2021-06-10 16:55:45 +02:00
Rasmus Wriedt Larsen
dd457f9641
Python: Fix tests
2021-06-10 15:58:56 +02:00
CodeQL CI
a241c114da
Merge pull request #5836 from RasmusWL/ec-class-improvement
...
Approved by tausbn
2021-06-10 06:20:56 -07:00
yoff
716627c1dd
Merge pull request #5878 from RasmusWL/fix-concept-tests-pretty-print
...
Python: Fix concept tests pretty print
2021-06-10 11:21:08 +02:00
Taus
b14fa8b4cd
Merge pull request #5925 from RasmusWL/pep249-import
...
Python: Use absolute import for PEP249
2021-06-09 18:32:28 +02:00
Rasmus Wriedt Larsen
aaddd36236
Python: Add another type-tracking attr test
...
This one just works out of the box 💪
2021-06-09 14:20:50 +02:00
Rasmus Wriedt Larsen
89cba216ca
Python: Apply suggestions from code review
...
Co-authored-by: Taus <tausbn@github.com >
2021-06-09 14:15:59 +02:00
Rasmus Wriedt Larsen
3d2de03674
Python: Add type-tracking test for attr set in function
2021-06-08 19:03:53 +02:00
Rasmus Wriedt Larsen
dcd448b743
Python: Refactor formatting
2021-06-08 19:03:53 +02:00
Rasmus Wriedt Larsen
09de1bcf44
Python: Add tests for type-tracking attrs on instances
2021-06-08 19:03:53 +02:00
Rasmus Wriedt Larsen
afd35f2e21
Python: Fix wording of change-note
...
`aiohttp.web` is a web _framework_, and not a web _server_.
2021-06-08 16:19:25 +02:00
Rasmus Wriedt Larsen
e82ad6fc22
Python: Add missing QLDoc
2021-06-07 10:13:26 +02:00
Rasmus Wriedt Larsen
9dcb26d151
Python: Autoformat
...
I had not set up the pre-commit hook properly
2021-06-07 10:05:48 +02:00
Rasmus Wriedt Larsen
e9acea8643
Python: Improve multidict modeling
2021-06-03 11:50:49 +02:00
Rasmus Wriedt Larsen
2e851cd5f0
Python: Improve yarl.URL modeling
2021-06-03 11:38:15 +02:00
Rasmus Wriedt Larsen
9372e3b284
Python: Add aiohttp.web change-note
2021-06-03 11:23:28 +02:00
Rasmus Wriedt Larsen
3c47e583d8
Python: Add test for missing data-flow step in aiohttp.web
2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
2dbbf52903
Python: Model HTTP responses in aiohttp.web
2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
735df4597f
Python: Aiohttp add response tests
2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
5d4140d3e2
Python: Handle more complicated route-setup in aiohttp
...
Since we want to be able to easy select request-handlers that are not
set up as part of a view-class, we need to easily be able to identify
those. To handle cases like the one below, we _can't_ just define these
to be all the async functions that are not methods on a class :(
```py
# see https://docs.aiohttp.org/en/stable/web_quickstart.html#organizing-handlers-in-classes
class MyCustomHandlerClass:
async def foo_handler(self, request): # $ MISSING: requestHandler
return web.Response(text="MyCustomHandlerClass.foo")
my_custom_handler = MyCustomHandlerClass()
app.router.add_get("/MyCustomHandlerClass/foo", my_custom_handler.foo_handler) # $ routeSetup="/MyCustomHandlerClass/foo"
```
So it seemed easiest to narrow down the route-setups, but that means we
want both refinement and extensibility... so `::Range` pattern to the
rescue 🎉
The important piece of code that still works after this commit, but
which hasn't been changed, is the one below:
```codeql
/**
* A parameter that will receive a `aiohttp.web.Request` instance when a request
* handler is invoked.
*/
class AiohttpRequestHandlerRequestParam extends Request::InstanceSource, RemoteFlowSource::Range,
DataFlow::ParameterNode {
AiohttpRequestHandlerRequestParam() {
exists(Function requestHandler |
requestHandler = any(AiohttpCoroutineRouteSetup setup).getARequestHandler() and
```
2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
919a0b6b84
Python: aiohttp route setup is more complicated than expected
2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
c69b857662
Python: Add self.request as RemoteFlowSource for aiohttp View
...
Just like we do for Django in
7393443f8c/python/ql/src/semmle/python/frameworks/Django.qll (L1786-L1804)
2021-06-03 10:55:34 +02:00
