yoff
6c3e2db7fd
Merge branch 'main' into python/simple-csrf
2022-05-10 10:55:28 +02:00
yoff
b6605bc330
Merge pull request #8634 from RasmusWL/promote-xxe
...
Python: Promote XXE and XML-bomb queries
2022-05-09 21:54:55 +02:00
yoff
6169ac6122
Merge pull request #7776 from RasmusWL/django-filefield-uploadto
...
Python: Support Django FileField.upload_to
2022-05-05 14:25:08 +02:00
Rasmus Wriedt Larsen
fb0133d276
Python: Fix Flask request.files modeling
2022-05-02 14:14:58 +02:00
Rasmus Wriedt Larsen
0c62916af5
Python: Highlight problem with Flask request.files modeling
2022-05-02 14:14:53 +02:00
Rasmus Wriedt Larsen
5f01fc24e4
Merge branch 'main' into promote-xxe
2022-05-02 11:25:55 +02:00
Rasmus Wriedt Larsen
650d57083b
Python: Recognize path arguments to pathlib methods
2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen
bcaba45202
Python: Expand pathlib tests
2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen
059dea713d
Python: Fix os.path.samefile modeling
2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen
c87b3087be
Python: Add test for Django FileField upload_to
...
The output from running the test script is:
```
'rootdir/bar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/bar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/foo%2fbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/%2e%2e%2fbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/foo%c0%afbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
```
I didn't add a `.py` extension, so it wasn't extracted, since we don't
actually care about what we model in that file.
2022-04-13 11:27:18 +02:00
Rasmus Wriedt Larsen
304713ca87
Python: Handle django v4 as well in tests
2022-04-13 11:21:44 +02:00
Rasmus Wriedt Larsen
4927f0018b
Merge branch 'main' into django-filefield-uploadto
2022-04-13 10:22:28 +02:00
Rasmus Wriedt Larsen
7728b6cf1b
Python: Change XmlBomb vulnerability kind
2022-04-07 10:56:35 +02:00
Rasmus Wriedt Larsen
23637fd691
Merge branch 'main' into promote-xxe
2022-04-06 12:56:31 +02:00
Rasmus Wriedt Larsen
b4c0065aeb
Python: Extend FileSystemAccess for xml.sax and xml.dom.* parsing
2022-03-31 18:08:47 +02:00
Rasmus Wriedt Larsen
e11269715d
Python: Promote xml.sax and xml.dom.* modeling
2022-03-31 17:44:00 +02:00
Rasmus Wriedt Larsen
05bb0ef976
Python: Align xml.etree.ElementTree modeling
...
I didn't find a good way to actually share the stuff, so we kinda just
have 2 things that look very similar :|
2022-03-31 17:24:16 +02:00
Rasmus Wriedt Larsen
db43d043c4
Python: Add test showing misalignment of xml.etree modeling
2022-03-31 11:55:46 +02:00
Rasmus Wriedt Larsen
543454eff2
Python: Model file access from XML parsing
2022-03-31 11:47:29 +02:00
Rasmus Wriedt Larsen
386ff53614
Python: Model lxml.iterparse
2022-03-31 11:32:22 +02:00
Rasmus Wriedt Larsen
12cbdcde28
Python: Model lxml.etree.XMLID
2022-03-31 11:21:24 +02:00
Rasmus Wriedt Larsen
64aa503cc3
Python: Promote xml.etree modeling
2022-03-31 11:12:02 +02:00
Rasmus Wriedt Larsen
7f5f7679f8
Python: Promote xmltodict modeling
2022-03-31 10:28:34 +02:00
Rasmus Wriedt Larsen
80b5cde3a2
Python: Promote lxml parsing modeling
2022-03-31 10:19:08 +02:00
Rasmus Wriedt Larsen
c4473c5f65
Python: Rename lxml XPath tests
2022-03-31 10:08:02 +02:00
Rasmus Wriedt Larsen
769f5691d0
Python: Add taint for StringIO and BytesIO
2022-03-31 09:52:54 +02:00
Sebastian Bauersfeld
a3c3a7fe0d
Python: Identify alternative body argument in invocations of Response constructor.
2022-03-30 19:34:54 +07:00
Rasmus Lerchedahl Petersen
1e9840d779
python: broaden local protection concept
2022-03-25 12:28:33 +01:00
Rasmus Lerchedahl Petersen
6c2449564a
python: add concept tests
2022-03-23 12:05:09 +01:00
Rasmus Lerchedahl Petersen
0f2c21c8bd
python: require local protection to be absent
...
for CSRF to be likely
2022-03-22 13:42:52 +01:00
Rasmus Wriedt Larsen
ae1ba11d57
Merge branch 'main' into orm
2022-03-16 11:23:14 +01:00
Rasmus Wriedt Larsen
461e2f3663
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-16 10:43:20 +01:00
haby0
7e6666bc63
Merge branch 'main' into py/add-ssrf-sinks
2022-03-07 12:09:14 +08:00
Rasmus Wriedt Larsen
f620e2599d
Merge branch 'main' into py/add-ssrf-sinks
2022-03-04 11:50:12 +01:00
Rasmus Wriedt Larsen
02a97b08bb
Python: Move urllib and urllib2 to be part of stdlib modeling
2022-03-04 11:31:47 +01:00
Rasmus Wriedt Larsen
c65839bb77
Python: improve urllib3 modeling
2022-03-04 11:25:14 +01:00
Rasmus Wriedt Larsen
7d6d8be179
Python: Fix httpx modeling
2022-03-04 11:07:51 +01:00
Rasmus Wriedt Larsen
40feb1fb8d
Python: SPURIOUS results for httpx
2022-03-04 11:03:32 +01:00
yoff
d0a393e8d1
Update python/ql/test/library-tests/frameworks/stdlib/XPathExecution.py
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-03-04 10:56:53 +01:00
Rasmus Lerchedahl Petersen
143e9ee954
Merge branch 'main' of github.com:github/codeql into python/promote-xpath-injection
2022-03-02 13:14:08 +01:00
Rasmus Lerchedahl Petersen
80be767a7a
python: implement stdlib xpath support
2022-03-02 12:59:34 +01:00
Rasmus Lerchedahl Petersen
06e0f140c5
python: add tests for stdlib xpath
2022-03-02 12:58:37 +01:00
Rasmus Wriedt Larsen
27d5349a74
Python: ORM: Remove imports from test code
...
These are no longer needed, as data-flow now has this import by default
2022-03-01 15:39:52 +01:00
Rasmus Lerchedahl Petersen
f55d7d627e
python: model XPathEvaluator
2022-03-01 14:40:13 +01:00
Rasmus Lerchedahl Petersen
3bb17be389
python: add concept and library tests
2022-03-01 14:39:28 +01:00
Rasmus Wriedt Larsen
8afd560c64
Python: ORM: Handle load of PolymorphicModels
2022-02-28 16:38:41 +01:00
Rasmus Wriedt Larsen
48fba87273
Python: ORM: add flow to base-class
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
6b9dd49499
Python: ORM: Model polymorphic.models.PolymorphicModel as Django ORM class
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
e1191cf63c
Python: ORM: Add tests for inheritance
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
092cfceb18
Python: Add dataflow consistency checks to ORM tests
...
Luckily they passed :phew:
2022-02-28 16:38:40 +01:00
