Erik Krogh Kristensen
7245591468
Merge pull request #7763 from erik-krogh/unused-field
...
QL: add unused-field query
2022-05-18 09:15:16 +02:00
Nick Rolfe
2efa38aaa6
Python: fix typos in comments
2022-05-12 16:02:20 +01:00
Rasmus Wriedt Larsen
795adf0566
Python: Fix API::moduleImport("foo.bar")
2022-05-12 13:33:00 +02:00
Rasmus Wriedt Larsen
f8253f5fef
Python: Fully disallow API::moduleImport of module with dots
...
Inspired by discussion about this for MaD in
https://github.com/github/codeql/pull/8883#discussion_r865858084
2022-05-12 13:30:26 +02:00
Rasmus Wriedt Larsen
597a8414d9
Python: Add test of API::moduleImport with dots
...
This is currently semi-works -- the import is allowed, but doesn't
always work when used :|
2022-05-12 13:29:16 +02:00
Rasmus Wriedt Larsen
cff950f5f7
Python: Fix select of py/insecure-cookie
2022-05-11 14:06:30 +02:00
Rasmus Wriedt Larsen
fc8633cc01
Python: Fix select for py/cookie-injection
2022-05-11 13:18:14 +02:00
Rasmus Wriedt Larsen
d127d2164a
Merge branch 'main' into jorgectf/python/insecure-cookie
2022-05-11 11:13:47 +02:00
Rasmus Wriedt Larsen
2b6e0cfb44
Merge pull request #8340 from yoff/python/simple-csrf
...
python: minimal CSRF implementation
2022-05-10 13:36:38 +02:00
Rasmus Wriedt Larsen
cb17e2a649
Merge pull request #8595 from porcupineyhairs/pypam
...
Python : Add query to detect PAM authorization bypass
2022-05-10 13:35:12 +02:00
Rasmus Lerchedahl Petersen
aa3d7babf4
python: fix bad merge
...
caused by an optimistic attempt at solving a
merge conflict in the online GUI.
2022-05-10 11:37:41 +02:00
Rasmus Wriedt Larsen
2421076d2f
Merge pull request #8696 from RasmusWL/new-nosql-examples
...
Python: Improve experimental modeling for `pymongo`
2022-05-10 11:03:05 +02:00
yoff
6c3e2db7fd
Merge branch 'main' into python/simple-csrf
2022-05-10 10:55:28 +02:00
yoff
b6605bc330
Merge pull request #8634 from RasmusWL/promote-xxe
...
Python: Promote XXE and XML-bomb queries
2022-05-09 21:54:55 +02:00
Rasmus Wriedt Larsen
c218162104
Merge branch 'main' into pypam
2022-05-09 14:20:05 +02:00
Rasmus Wriedt Larsen
de05b108fa
Python: Fix singleton set
2022-05-09 11:01:13 +02:00
yoff
6169ac6122
Merge pull request #7776 from RasmusWL/django-filefield-uploadto
...
Python: Support Django FileField.upload_to
2022-05-05 14:25:08 +02:00
yoff
56ed68b3eb
Merge pull request #9001 from RasmusWL/files-refactoring
...
Python: Flask: Improve `request.files` modeing
2022-05-03 12:19:55 +02:00
Rasmus Wriedt Larsen
fb0133d276
Python: Fix Flask request.files modeling
2022-05-02 14:14:58 +02:00
Rasmus Wriedt Larsen
0c62916af5
Python: Highlight problem with Flask request.files modeling
2022-05-02 14:14:53 +02:00
yoff
1d44694280
Merge pull request #8732 from RasmusWL/dataflow-imports
...
Python: Don't re-export `python` under `DataFlow::`
2022-05-02 12:08:28 +02:00
Taus
231def026f
Merge pull request #8890 from tausbn/python-add-global-attribute-writes
...
Python: Add support for global attribute writes
2022-05-02 12:03:41 +02:00
yoff
c67b06b1fd
Update python/ql/test/experimental/dataflow/typetracking/attribute_tests.py
...
Co-authored-by: Taus <tausbn@github.com >
2022-05-02 11:36:58 +02:00
Rasmus Wriedt Larsen
5f01fc24e4
Merge branch 'main' into promote-xxe
2022-05-02 11:25:55 +02:00
Rasmus Wriedt Larsen
3c1a37e7e1
Merge branch 'main' into new-nosql-examples
2022-05-02 11:21:36 +02:00
Taus
b4a31e572f
Python: Add global attribute writes
2022-04-27 16:45:00 +00:00
Taus
f71cf2e1fc
Python: Add test
2022-04-27 15:48:11 +00:00
yoff
39753d5a0b
Merge pull request #8693 from erik-krogh/pyApi
...
PY: more API-graphs refactorings
2022-04-27 13:19:50 +02:00
Erik Krogh Kristensen
e1c7d369be
Merge pull request #8796 from erik-krogh/redundantImport
...
Remove redundant imports
2022-04-27 12:39:51 +02:00
yoff
9d774463f5
Merge pull request #8859 from tausbn/python-fix-bad-essa-joins
...
Python: Fix a bunch of bad joins
2022-04-27 12:27:50 +02:00
Taus
7d736952db
Python: Update expected output
2022-04-26 15:49:40 +00:00
Erik Krogh Kristensen
d389012b75
Merge branch 'main' into redundantImport
2022-04-26 14:24:51 +02:00
yoff
76f2eca1ee
Merge pull request #8560 from erik-krogh/movePolyTest
...
PY: move the polynomialbacktracking-test to the test folder
2022-04-26 14:21:30 +02:00
Tom Hvitved
bffa8fa7cb
Merge pull request #8641 from hvitved/dataflow/interpret-read-store
...
Data flow: Introduce `ContentSet`
2022-04-25 12:17:34 +02:00
Erik Krogh Kristensen
acac8919b3
PY: update expected output for deprecation warning in test file
2022-04-22 15:28:31 +02:00
Tom Hvitved
b033f107df
Merge remote-tracking branch 'upstream/main' into dataflow/interpret-read-store
2022-04-22 14:35:02 +02:00
Rasmus Wriedt Larsen
03c0366fd4
Merge branch 'main' into stdlib-FileSystemAccess-improvement
2022-04-22 14:31:31 +02:00
Erik Krogh Kristensen
8fcbaea273
Merge branch 'main' into labelNaming
2022-04-22 13:19:44 +02:00
Erik Krogh Kristensen
ff73dbc35c
delete redundant imports
2022-04-22 12:55:28 +02:00
Erik Krogh Kristensen
a96489b23d
delete duplicate imports
2022-04-22 12:41:30 +02:00
Rasmus Wriedt Larsen
650d57083b
Python: Recognize path arguments to pathlib methods
2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen
bcaba45202
Python: Expand pathlib tests
2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen
059dea713d
Python: Fix os.path.samefile modeling
2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen
bb6969a175
Merge branch 'main' into promote-xxe
2022-04-20 13:42:02 +02:00
Rasmus Wriedt Larsen
084c8eb22e
Python: Don't re-export python under DataFlow::
2022-04-20 11:42:10 +02:00
Rasmus Wriedt Larsen
5dbbd17bb2
Python: Add test to ensure we keep DataFlow imports clean
...
Currently we're not in a good state :(
2022-04-20 11:41:01 +02:00
Rasmus Wriedt Larsen
6235dc5039
Python: Handle find_library assignment to temp variable
2022-04-13 11:44:15 +02:00
Rasmus Wriedt Larsen
c87b3087be
Python: Add test for Django FileField upload_to
...
The output from running the test script is:
```
'rootdir/bar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/bar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/foo%2fbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/%2e%2e%2fbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/foo%c0%afbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
```
I didn't add a `.py` extension, so it wasn't extracted, since we don't
actually care about what we model in that file.
2022-04-13 11:27:18 +02:00
Rasmus Wriedt Larsen
304713ca87
Python: Handle django v4 as well in tests
2022-04-13 11:21:44 +02:00
Rasmus Wriedt Larsen
4927f0018b
Merge branch 'main' into django-filefield-uploadto
2022-04-13 10:22:28 +02:00
