Rasmus Wriedt Larsen
88f703af1f
DataFlow: Accept changes to .expected
2022-11-10 22:13:34 +01:00
ALJI Mohamed
fdbed2a019
Add expected test results without considering inStdLib files.
2022-10-22 09:34:57 +01:00
ALJI Mohamed
0f44268038
Add expected test results
2022-10-21 22:14:55 +01:00
ALJI Mohamed
7d60f1f1c8
Modified the QL ref file and add TarSlip examples
2022-10-21 22:14:00 +01:00
ALJI Mohamed
31a6fb4181
Add TarSlip qlref for query-tests
2022-10-21 21:28:20 +01:00
Jeroen Ketema
d389a183f0
Merge pull request #10743 from jsoref/spelling
...
Spelling
2022-10-12 12:48:22 +02:00
erik-krogh
4da0508dae
Merge branch 'main' into py-last-msg
2022-10-11 10:49:19 +02:00
Josh Soref
21caa4b03f
spelling: across
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:35 -04:00
erik-krogh
6fdfd40880
changes to address reviews
2022-10-07 22:31:00 +02:00
erik-krogh
944ca4a0da
fix some more style-guide violations in the alert-messages
2022-10-07 11:23:34 +02:00
Rasmus Wriedt Larsen
d7be27a1c0
Python: Fix experimental py/ip-address-spoofing
...
I realized the modeling was done in a non-recommended way, so I changed
the modeling. It was very nice that I could use API graphs for the flask
part, and a little sad when I couldn't for Django/Tornado.
2022-10-03 21:19:30 +02:00
Rasmus Wriedt Larsen
b01a0ae696
Python: Adjust .expected after flask source change
...
It's really hard to audit that this is all good.. I tried my best with
`icdiff` though -- and there is a problem with
ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql
that needs to be fixed in the next commit
2022-10-03 20:35:49 +02:00
Tom Hvitved
f4b82cb2e8
Python: Update expected test output
2022-09-22 15:01:40 +02:00
yoff
ea743173d5
Merge pull request #8781 from yoff/python-dataflow/flow-summaries-from-scratch
...
Python dataflow: flow summaries restart
2022-09-20 14:08:31 +02:00
Rasmus Wriedt Larsen
556e93ae68
Merge pull request #10384 from RasmusWL/callnode-getargbyname
...
Python: Allow `CallNode.getArgByName` for keyword args after `**kwargs`
2022-09-19 15:05:59 +02:00
Rasmus Lerchedahl Petersen
37fb27fa1c
Python: change type of LibraryCallable::getACall
...
The other callables return control flow nodes,
so it is slightly inconsistent for this to return a
data flow node, but it does make models based
on API graphs nicer.
2022-09-19 14:02:52 +02:00
Rasmus Lerchedahl Petersen
245baa51a3
Python: rename summary map -> list_map,
...
since map resolves to a class call
also fix test expectation
2022-09-14 11:21:16 +02:00
Rasmus Lerchedahl Petersen
f83158ff8b
Python: do not stake out too much territory
2022-09-14 10:28:11 +02:00
Rasmus Lerchedahl Petersen
58cfac27d2
Python: adjust expectations to new spelling
2022-09-13 10:10:17 +02:00
Rasmus Lerchedahl Petersen
c1ab66181b
Python: format
2022-09-13 08:08:04 +02:00
Rasmus Lerchedahl Petersen
03c243175b
Python: fix QL alerts
2022-09-12 23:53:42 +02:00
Rasmus Lerchedahl Petersen
bf16e220a0
Python: adjust expectations
2022-09-12 22:43:03 +02:00
Rasmus Lerchedahl Petersen
efc5cfb852
Merge branch 'main' of github.com:github/codeql into python-dataflow/flow-summaries-from-scratch
2022-09-12 19:56:16 +02:00
Rasmus Lerchedahl Petersen
0f95992b2f
Python: remove NonLibraryDataFlowCallable
...
this required managing parameters and their pre-update nodes a bit
2022-09-12 15:17:29 +02:00
Rasmus Wriedt Larsen
4296ac1ac0
Python: Allow CallNode.getArgByName for keyword args after **kwargs
2022-09-12 15:03:13 +02:00
Rasmus Lerchedahl Petersen
895f5480c2
Python: Added recursion guard
...
to ensure that the call graph seen by type tracking
does not include summary calls resolved by type tracking.
(I tried inserting a similar test into the Ruby codebase,
and it still compiled)
To get this to compile, I had to move the resolution of summary calls
out of the data flow nodes and into the `viableCallable` predicate.
This means that we now have a potential summary call for each
cfg call node. (I tried using the base class, `DataFlowCall`, for this
but calls to `map` got identified as class calls and would no longer
be associated with a summary.)
It is possible that the "NonLIbrary"-layers the were inserted into the
hierarchy can be removed again.
2022-09-09 22:47:47 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
Rasmus Lerchedahl Petersen
f6d807aec0
Python: Add summary test append_to_list
2022-09-06 18:42:32 +02:00
Taus
3bb7e28712
Merge pull request #10176 from RasmusWL/import-problem
...
Python: Add testcase for import problem
2022-09-06 18:12:37 +02:00
Rasmus Lerchedahl Petersen
4cd41c24c7
Python: remove comments and start design document
2022-09-06 17:23:40 +02:00
Rasmus Lerchedahl Petersen
67c3a9b2f4
Python: resolve library calls in the CFG
...
rather than in the AST
2022-09-06 17:00:28 +02:00
Rasmus Wriedt Larsen
e979dffc08
Python: Fix variable access from extractor-change
...
These changes are from internal PR.
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
ebd97f4496
Python: Add type-tracking regession example
2022-09-06 10:11:36 +02:00
erik-krogh
1d1aa7c8b4
update some expected output
2022-08-25 20:52:30 +02:00
erik-krogh
cc7a9ef97a
rename more acronyms
2022-08-25 20:52:27 +02:00
Rasmus Wriedt Larsen
0728ecebbb
Python: Highlight that import problem is not just a relative problem
2022-08-25 15:54:21 +02:00
Rasmus Wriedt Larsen
1ca19533e0
Python: Add import problem test from the wild
2022-08-25 15:50:55 +02:00
yoff
6b4716485b
Python: rename file
2022-08-25 12:23:09 +00:00
yoff
800165d63c
python: udate deprecated call
2022-08-25 09:49:46 +00:00
yoff
0b5d4c59dd
Merge branch 'main' of https://github.com/github/codeql into python-dataflow/flow-summaries-from-scratch
...
synced files have changed
2022-08-25 09:24:05 +00:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
yoff
75ac24a847
Merge branch 'main' into python-dataflow/flow-summaries-from-scratch
2022-08-10 10:57:59 +02:00
Rasmus Wriedt Larsen
f89b32183f
Merge branch 'main' into typetracker-decorators
2022-08-08 11:52:09 +02:00
yoff
f52d792b36
Merge branch 'main' of https://github.com/github/codeql into python-dataflow/flow-summaries-from-scratch
2022-07-01 12:01:07 +00:00
yoff
61523bd330
python: better names
...
- "Normal" instead of "NonSpecial"
- "NonLibrary" instead of "2"
I could not find a good replacement for "NonLibrary", nor for "Source",
but I added QLDocs in a few places to help the reading.
2022-07-01 11:55:20 +00:00
yoff
6087bc6888
Merge branch 'main' into python/more-logic-tests
2022-06-28 22:16:38 +02:00
Asger F
a522562f93
Merge pull request #9369 from asgerf/python/api-graph-api
...
Python: API graph renaming and documentation
2022-06-28 14:48:12 +02:00
Rasmus Lerchedahl Petersen
a1fe8a5b2b
python: handle not in BarrierGuard
...
in the program
```python
if not is_safe(path):
return
```
the last node in the `ConditionBlock` is `not is_safe(path)`,
so it would never match "a call to is_safe".
Thus, guards inside `not` would not be part of `GuardNode`
(nor `BarrierGuard`). Now they can.
2022-06-27 20:10:47 +00:00
Rasmus Lerchedahl Petersen
882000afb3
python: not is confusing our logic
...
- added `is_unsafe`
- added "negated version" of two tests.
These versions do not use `not` and the analysis gets the taint right.
2022-06-27 20:10:47 +00:00
Rasmus Wriedt Larsen
3248f7b423
Merge pull request #9649 from RasmusWL/certificate-modeling
...
Python/JS/Ruby: Ignore common words (like certain) as sensitive data source
2022-06-23 12:04:58 +02:00
