jorgectf
48bca5beb8
Fix references' link anchor
2021-08-25 17:09:47 +02:00
Rasmus Wriedt Larsen
605bd19306
Python: Add CWE-328 to py/weak-sensitive-data-hashing
...
Reading over the description at https://cwe.mitre.org/data/definitions/328.html :
> The product uses a hashing algorithm that produces a hash value that can be used to determine the original input, or to find an input that can produce the same hash, more efficiently than brute force techniques.
For the data that does not require computationally expensive hashing, that will be the exactly problems that this query finds 👍 (that is, MD5, SHA1)
2021-08-25 10:19:22 +02:00
Andrew Eisenberg
3660c64328
Packaging: Rafactor Python core libraries
...
Extract the external facing `qll` files into the codeql/python-all
query pack.
2021-08-24 13:23:45 -07:00
yoff
2f5ed03798
Merge pull request #6323 from RasmusWL/sec-test-layout
...
Python: Restructure security tests to contain query name
2021-08-24 16:50:08 +02:00
Rasmus Lerchedahl Petersen
e865a290de
Python: straight port of query
...
The old query uses `pointsTo` to limit the sinks
to methods on lists and dictionaries.
That constraint is omitted here which could hurt performance.
2021-08-24 16:35:11 +02:00
Rasmus Lerchedahl Petersen
e3765ced78
Python: Add tests for modification of defaults
2021-08-24 16:35:11 +02:00
Rasmus Wriedt Larsen
ca341bde08
Merge pull request #5612 from jty-team/jty/python/nosqlInjection
...
Python: CWE-943 - Add NoSQL injection query
2021-08-24 11:29:25 +02:00
Erik Krogh Kristensen
38477d7d2e
Merge pull request #6462 from erik-krogh/repeat
...
JS: support more regular expressions in js/incomplete-multi-character-sanitization
2021-08-23 15:39:31 +02:00
yoff
0c0f335b1c
Merge pull request #6508 from github/RasmusWL-patch-1
...
Python: Update comment for RegExpTreeView isExcluded
2021-08-23 15:07:29 +02:00
yoff
467aa647da
Merge pull request #6507 from tausbn/python-prevent-polynomial-redos-explosion
...
Python: Prevent explosion in poly-ReDoS query
2021-08-23 11:48:14 +02:00
Rasmus Lerchedahl Petersen
34d7772a0d
Python: Move constraints into pranch charpreds
...
For sequences and alternations, we require at least one child.
Otherwise, we wish to represent the term differently.
This avoids multiple representations.
2021-08-23 11:44:00 +02:00
Rasmus Lerchedahl Petersen
c4554836ca
Python: merge test.py into unittests.py
2021-08-19 10:24:32 +02:00
Rasmus Lerchedahl Petersen
3c647c65bf
Python: update comment
2021-08-19 10:21:19 +02:00
Rasmus Lerchedahl Petersen
21f683d531
Python: clean up stray coments
2021-08-18 16:59:35 +02:00
Taus
021e5ff510
Python: Autoformat
2021-08-18 14:27:54 +00:00
Rasmus Wriedt Larsen
60eb81106a
Python: Update comment for RegExpTreeView isExcluded
...
I noticed after reading https://github.com/github/codeql/pull/6507 , but didn't want to overload that PR.
2021-08-18 16:16:26 +02:00
Taus
af91a2df00
Python: Prevent explosion in poly-ReDoS query
...
I consider this to be a short-term solution to the performance problems
we identified. The choice of "at most ten occurrences of `.*`" is
somewhat arbitrary, and it's possible a higher limit would work just as
well.
2021-08-18 13:21:46 +00:00
Andrew Eisenberg
03d6b15401
Merge branch 'main' into aeisenberg/pack/cpp
2021-08-17 15:28:47 -07:00
Rasmus Wriedt Larsen
3231ae77ef
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-08-17 15:17:10 +02:00
Erik Krogh Kristensen
3f7f5d2418
performance improvements in ReDoSUtil
2021-08-17 15:10:33 +02:00
Erik Krogh Kristensen
49e47641e4
sync ReDoSUtil.qll with python
2021-08-17 15:10:33 +02:00
Rasmus Wriedt Larsen
15d483d56c
Python: Use TypeTrackingNode in new PEP249 modeling
2021-08-17 12:03:40 +02:00
Rasmus Wriedt Larsen
b649f5f38c
Merge branch 'main' into peewee-modeling
2021-08-17 12:03:18 +02:00
Rasmus Lerchedahl Petersen
dee5535fbb
Python: condense tests
...
This also avoids potential licensing issues.
2021-08-17 11:24:39 +02:00
Andrew Eisenberg
e566fb9c5a
Packaging: Update suite-helpers qlpack
...
Uses new style naming scheme.
2021-08-16 17:51:33 -07:00
Erik Krogh Kristensen
46959234b7
Merge pull request #6288 from erik-krogh/emptyRedos
...
JS/Python: Fix FP in redos related to empty lookaheads
2021-08-16 13:48:22 +02:00
Erik Krogh Kristensen
e962a7c77c
Update python/ql/src/semmle/python/RegexTreeView.qll
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-08-16 11:24:05 +02:00
Rasmus Lerchedahl Petersen
6be78d442c
Python: fix compilation
2021-08-16 10:35:33 +02:00
Rasmus Lerchedahl Petersen
2df846ee4b
Merge branch 'python-regex-parsing-consistency-checks' of github.com:yoff/codeql into python-regex-parsing-consistency-checks
2021-08-12 13:34:11 +02:00
Rasmus Lerchedahl Petersen
54e65ce765
Python: Add consistency tests
...
for all the projects that went out of disk as a result of ReDoS
2021-08-12 13:33:44 +02:00
yoff
61bbddeb0c
Apply suggestions from code review
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-08-12 09:39:04 +02:00
Rasmus Lerchedahl Petersen
c08f94ec04
Python: Fix parsing of octal escapes
2021-08-11 15:01:26 +02:00
Rasmus Lerchedahl Petersen
34b054ff53
Python: Add consistency checks
2021-08-11 14:58:27 +02:00
jorgectf
e6ce10b5c5
Merge remote-tracking branch 'origin/main' into jty/python/nosqlInjection
2021-08-10 20:01:08 +02:00
Tom Hvitved
ea6d51f123
Python: Avoid bad join in AstExtended::AstNode::containsInScope
2021-08-09 11:20:57 +02:00
jorgectf
54ed25a925
Change False and None scopes
2021-07-25 18:21:16 +02:00
jorgectf
c8a7f48d6e
Add .expected
2021-07-25 18:18:38 +02:00
jorgectf
983465963a
Polish CookieWrite
2021-07-25 18:18:29 +02:00
jorgectf
65044293dd
Add CookieWrite concept
2021-07-25 17:53:58 +02:00
jorgectf
66fdd530e3
Merge branch 'jorgectf/python/headerInjection' into jorgectf/python/insecure-cookie
2021-07-25 04:35:51 +02:00
jorgectf
8d0386b049
Split into getNameArg and getValueArg
2021-07-25 04:35:22 +02:00
jorgectf
4f68a1777c
Write documentation and example
2021-07-25 04:07:05 +02:00
jorgectf
c8983be947
Add query
2021-07-25 04:06:44 +02:00
jorgectf
8a3e4f14d1
Add tests and .qlref
2021-07-25 04:06:02 +02:00
jorgectf
0aaa9c13bd
Merge remote-tracking branch 'origin/jorgectf/python/headerInjection' into jorgectf/python/insecure-cookie
2021-07-25 03:22:16 +02:00
jorgectf
93c8529fc9
Add .expected
2021-07-25 01:53:21 +02:00
jorgectf
1dd77f167a
Fix undetected tests
2021-07-25 01:51:52 +02:00
jorgectf
b83b31cc7a
Write qldocs
2021-07-24 02:33:57 +02:00
jorgectf
61e873d725
Polish tests
2021-07-24 02:09:23 +02:00
jorgectf
0d2646fd3d
Polish documentation
2021-07-24 01:23:51 +02:00
