Rasmus Lerchedahl Petersen
4c3c4deb34
python: Move over query and tests
2022-01-28 09:19:11 +01:00
Rasmus Lerchedahl Petersen
a026120c52
Python: Move configuration over and refine it
...
The original configuration did not match sinks with sanitizers.
Here it is resolved using flow state,
it could also be done by using two configurations.
2022-01-28 09:00:40 +01:00
Rasmus Lerchedahl Petersen
e6b5833bd6
python: fix typo in qhelp
2022-01-26 19:05:36 +01:00
Sam Partington
db7b3bc136
Remove experimental tag from non-ATM queries
2021-12-15 16:17:14 +00:00
Taus
8cccee6eba
Merge pull request #6972 from yoff/python/promote-redos
...
Python: Promote ReDoS queries
2021-11-23 14:02:09 +01:00
jorgectf
ef4a27ff8c
Apply code review suggestions
2021-10-28 17:31:52 +02:00
jorgectf
3dec222922
Merge remote-tracking branch 'origin/main' into jorgectf/python/jwt-queries
2021-10-28 13:11:46 +02:00
jorgectf
7069f45864
Polish documentation
2021-10-28 13:09:28 +02:00
jorgectf
350cbb4c5d
Polish qhelp and libraries
2021-10-27 18:47:19 +02:00
Rasmus Lerchedahl Petersen
fed6a97eb8
Python: Promote ReDoS queries
2021-10-27 11:03:57 +02:00
jorgectf
45146bc798
Merge branch 'main' into jorgectf/python/headerInjection
2021-10-16 12:46:57 +02:00
jorgectf
2db1ffef1e
Merge remote-tracking branch 'origin/main' into jorgectf/python/headerInjection
2021-10-16 10:40:52 +02:00
Rasmus Lerchedahl Petersen
61008fd3d0
Merge branch 'main' of github.com:github/codeql into python/promote-regex-injection
2021-10-12 11:28:12 +02:00
yoff
43f7eede0b
Merge pull request #6182 from haby0/python/LogInjection
...
Python: CWE-117 Log injection
2021-10-12 10:54:45 +02:00
yoff
0629ce00de
Merge pull request #6214 from haby0/python/ClientSuppliedIpUsedInSecurityCheck
...
[Python] CWE-348: Client supplied ip used in security check
2021-10-11 16:38:04 +02:00
haby0
538bf7c321
Update python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-10-07 19:44:25 +08:00
haby0
a17b0d4e5c
Modify Sanitizer
2021-10-05 17:12:04 +08:00
Rasmus Wriedt Larsen
547cbb6322
Merge pull request #6331 from porcupineyhairs/pythonXpath
...
Python : Improve Xpath Injection Query
2021-09-24 18:11:08 +02:00
Rasmus Wriedt Larsen
26d2fbd217
Python: Fix new XPath injection query
...
Fixes the typo `ETXpath` => `ETXPath`
2021-09-24 15:11:34 +02:00
Rasmus Wriedt Larsen
913a679ef5
Python: Replace old XPath injection query
2021-09-24 15:10:41 +02:00
Rasmus Wriedt Larsen
c9640ffdbc
Python: Minor adjustments to XPath Injection
2021-09-24 15:02:39 +02:00
Rasmus Wriedt Larsen
289660067c
Merge branch 'main' into pythonXpath
2021-09-24 13:53:38 +02:00
haby0
9b969e15fc
Modify according to @yoff suggestion
2021-09-24 12:56:10 +08:00
haby0
0277601705
Eliminate false positives caused by .
2021-09-16 20:59:34 +08:00
haby0
c60eded2de
Fix conflicting
2021-09-15 11:07:43 +08:00
haby0
9e63aa9d84
Update query
2021-09-14 21:12:49 +08:00
Rasmus Lerchedahl Petersen
36e27f2aa4
Python: Remove promoted code:
...
- queries (`py/regex-injection`)
- concepts (RegexExecution, RegexEscape)
- library models (Stdlib::Re)
2021-09-14 13:14:16 +02:00
jorgectf
2ccc6dc092
Merge branch 'main' into jorgectf/python/ldapinsecureauth
2021-09-14 09:32:19 +02:00
jorgectf
eee9b3f39e
Merge remote-tracking branch 'origin/main' into jorgectf/python/headerInjection
2021-09-07 19:54:58 +02:00
Jorge
1bc16fb31e
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-09-07 18:37:33 +02:00
jorgectf
64b305cf7a
Add .qhelp along with its example
2021-08-26 23:29:45 +02:00
Jorge
d458464e6b
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-08-26 12:20:09 +02:00
jorgectf
e6ce10b5c5
Merge remote-tracking branch 'origin/main' into jty/python/nosqlInjection
2021-08-10 20:01:08 +02:00
jorgectf
f9b244ecad
Polish documentation
2021-07-24 01:06:05 +02:00
Jorge
f02b6d60a5
Merge branch 'github:main' into jorgectf/python/ldapinsecureauth
2021-07-22 18:49:51 +02:00
jorgectf
a34d6d390e
Port to ApiGraphs and finish the query
2021-07-22 18:34:57 +02:00
Rasmus Wriedt Larsen
71e6db8a01
Merge branch 'main' into jorgectf/python/ldapimproperauth
2021-07-22 15:57:43 +02:00
Taus
e9a4114c04
Python: Hotfix: Disable ReDoS queries
2021-07-22 10:58:49 +00:00
jorgectf
edb273ace5
Merge remote-tracking branch 'origin/jorgectf/python/ldapimproperauth' into jorgectf/python/ldapinsecureauth
2021-07-22 02:51:19 +02:00
Porcuiney Hairs
c6c925d67a
Python : Improve Xpath Injection Query
2021-07-20 03:31:30 +05:30
haby0
e8d0827916
Add tornado source
2021-07-05 10:42:15 +08:00
haby0
b866f1b21e
Add CWE-348 ClientSuppliedIpUsedInSecurityCheck
2021-07-02 19:30:33 +08:00
jorgectf
a1f48db60b
Make verifiesSignature() a predicate
2021-07-01 17:51:56 +02:00
jorgectf
07422a1dce
Move tests under test/
2021-07-01 17:51:00 +02:00
jorgectf
1d4d8ab6e0
Fix tests
2021-06-28 14:16:52 +02:00
jorgectf
b9422518b3
Rephrase .qhelp
2021-06-28 14:00:00 +02:00
Rasmus Wriedt Larsen
59711424bd
Python: Fix qhelp for NoSQL injection
2021-06-28 11:48:28 +02:00
Rasmus Wriedt Larsen
4a2c99a021
Python: Inline LDAPImproperAuth.qll
...
Since having it inlined makes the query a bit easier to read. We
obviously need to share it if we want to share this predicate, but for
now that does not seem to be the case.
2021-06-28 10:54:21 +02:00
Rasmus Wriedt Larsen
b33f6a315c
Python: Fix select for py/improper-ldap-auth
2021-06-28 10:54:21 +02:00
jorgectf
058ade4d8e
Merge remote-tracking branch 'upstream/main' into jorgectf/python/jwt-queries
2021-06-18 22:21:38 +02:00
