Rasmus Wriedt Larsen
98e6fc8a88
Python/Ruby: Remove owasp tags
...
These are no longer correct, since the A1 category changed from 2017 to
2021, see https://owasp.org/Top10/#whats-changed-in-the-top-10-for-2021
Since only a very few queries had these tags, I think we're much better
off having them removed.
2021-11-16 12:03:50 +01:00
Rasmus Wriedt Larsen
d44f279339
Python: Fix .qhelp
2021-09-21 20:35:03 +02:00
Rasmus Wriedt Larsen
a83bb39d0f
Python: Merge SQLAlchemy TextClause injection into py/sql-injection
...
As discussed in a meeting today, this will end up presenting an query
suite that's easier to use for customers.
Since https://github.com/github/codeql/pull/6589 has JUST been merged,
if we get this change in fast enough, no end-user will ever have run
`py/sqlalchemy-textclause-injection` as part of LGTM.com or Code
Scanning.
2021-09-21 20:21:42 +02:00
Rasmus Wriedt Larsen
97c0f1c7b7
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-09-20 12:04:46 +02:00
Rasmus Wriedt Larsen
88c6d4bb20
Python: Fix .qhelp
2021-09-02 16:02:04 +02:00
Rasmus Wriedt Larsen
c34d6d1162
Python: Add query to handle SQLAlchemy TextClause Injection
...
instead of doing this via taint-steps. See description in code/tests.
2021-09-02 10:19:57 +02:00
Rasmus Wriedt Larsen
0be280c608
Python: Port py/sql-injection to use proper source/sink customization
2021-07-12 16:22:10 +02:00
Calum Grant
771e686946
Update security-severity scores
2021-06-15 13:25:17 +01:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Rasmus Wriedt Larsen
7afe3972d8
Revert "Merge pull request #5171 from RasmusWL/restructure-queries"
...
This reverts commit 8caafb3710ec79094957
2021-02-17 16:32:53 +01:00
Rasmus Wriedt Larsen
3a18881660
Python: Restructure query file location
...
Since I can never remember the CWE numbers
2021-02-16 11:36:10 +01:00
Rasmus Wriedt Larsen
0c6bd8401a
Python: Move SqlInjection configuration to own file
2020-11-06 14:09:46 +01:00
Taus Brock-Nannestad
fb6a02e060
Python: More import fixups
2020-11-02 22:17:42 +01:00
Taus Brock-Nannestad
f903e4ffbe
Python: Promote experimental queries
...
DO NOT MERGE
Also adds performance fix to `python.qll`.
2020-10-30 19:40:56 +01:00
Taus Brock-Nannestad
f07a7bf8cf
Python: Autoformat everything using qlformat.
...
Will need subsequent PRs fixing up test failures (due to deprecated
methods moving around), but other than that everything should be
straight-forward.
2020-07-07 15:43:52 +02:00
Taus Brock-Nannestad
87a9f51c78
Python: Autoformat all .ql files.
2020-03-30 11:59:10 +02:00
Rasmus Wriedt Larsen
6d5a8e4995
Python: Fix typos
2020-02-17 14:34:22 +01:00
Rasmus Wriedt Larsen
e5abfd0196
Python: Modernise Security/ queries
2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
2648e34f1a
Python: Autoformat security
2020-01-31 14:49:18 +01:00
Sauyon Lee
0040c9fb4c
Update links to OWASP cheat sheet
2019-11-06 20:21:47 -08:00
Rasmus Wriedt Larsen
471318369b
Python: Don't quote %s in django example
...
This is vulnerable to SQL injection because of the quotes around %s -- added
some code that highlights this in test.py
Since our examples did this in the safe query, I ended up rewriting them
completely, causing a lot of trouble for myself :D
2019-10-29 13:58:07 +01:00
Mark Shannon
91aefab7aa
Python: Reorganise code a bit to minimize diff for PR.
2019-08-29 10:31:50 +01:00
Mark Shannon
78ce19678a
Python taint-tracking: Fix up SQL injection query.
2019-08-29 10:31:50 +01:00
Mark Shannon
35e82dca68
Python revert .getNode() to .getSink()/.getSource() to keep expected test output the same.
2019-04-04 10:56:45 +01:00
Mark Shannon
7fc5d690cd
Python: Use new taint-tracking query in SQL-injection query.
2019-04-04 10:56:44 +01:00
Mark Shannon
61bd8682df
Python: Improve API and representation of taint tracking nodes. Update queries and tests accordingly.
2018-11-23 12:32:14 +00:00
Mark Shannon
722d89fc75
Upgrade taint-tracking security queries to path-problem queries.
2018-11-22 11:05:01 +00:00
Mark Shannon
e930b43bf3
Python security queries. Choose a precision reflecting actual precision for Security queries.
2018-11-19 17:10:40 +00:00
Mark Shannon
5f58824d1b
Initial commit of Python queries and QL libraries.
2018-11-19 15:10:42 +00:00
