yoff
b6605bc330
Merge pull request #8634 from RasmusWL/promote-xxe
...
Python: Promote XXE and XML-bomb queries
2022-05-09 21:54:55 +02:00
Rasmus Lerchedahl Petersen
1c7e533144
python: format
2022-05-09 21:22:27 +02:00
Rasmus Lerchedahl Petersen
2a5908ff49
python: require all settings be vulnerable
...
at least all thos not in tests
2022-05-09 17:08:49 +02:00
Rasmus Wriedt Larsen
4a6789182d
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-05-09 16:37:12 +02:00
Anders Schack-Mulligen
f24364d951
Merge pull request #9045 from hvitved/dataflow/subpaths-perf-take2
...
Data flow: Speedup `subpaths` predicate (take 2)
2022-05-09 15:39:11 +02:00
Rasmus Wriedt Larsen
c218162104
Merge branch 'main' into pypam
2022-05-09 14:20:05 +02:00
Rasmus Wriedt Larsen
ab1252d196
Python: Add @precision high for py/pam-auth-bypass
2022-05-09 14:19:40 +02:00
Erik Krogh Kristensen
fc1ab06c1c
autoformat
2022-05-09 12:39:38 +02:00
Rasmus Wriedt Larsen
de05b108fa
Python: Fix singleton set
2022-05-09 11:01:13 +02:00
Rasmus Wriedt Larsen
36349222a9
Python: Fix casing of XMLDomParsing
2022-05-09 11:00:25 +02:00
Rasmus Wriedt Larsen
f22bd039f3
Python: Slight refactor of LxmlParsing
2022-05-09 10:56:39 +02:00
Rasmus Wriedt Larsen
f5854f33da
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-05-09 10:53:25 +02:00
Mathias Vorreiter Pedersen
176e40f139
Merge pull request #9052 from github/post-release-prep/codeql-cli-2.9.1
...
Post-release preparation for codeql-cli-2.9.1
2022-05-06 13:15:17 +01:00
github-actions[bot]
1a25457178
Post-release preparation for codeql-cli-2.9.1
2022-05-05 19:05:50 +00:00
Erik Krogh Kristensen
efe306733e
move path-injection MaD to PathInjectionCustomizations.qll
2022-05-05 16:51:39 +02:00
yoff
6169ac6122
Merge pull request #7776 from RasmusWL/django-filefield-uploadto
...
Python: Support Django FileField.upload_to
2022-05-05 14:25:08 +02:00
Rasmus Wriedt Larsen
dfe99b0b51
Python: Apply suggestions from code review
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2022-05-05 14:14:44 +02:00
Tom Hvitved
d9d5372f28
Data flow: Sync files
2022-05-05 13:36:26 +02:00
Rasmus Wriedt Larsen
0a589bed4e
Python: Add inline test of MaD sinks
...
This enables us to keep the framework modeling tests under `/frameworks`
folder
I had hoped to use `mad-sink[<kind>]` syntax, but that was not allowed
:(
Maybe it oculd be allowed in the future, but for now I'll stick with the
more ugly solution of `mad-sink__<kind>`
2022-05-05 13:11:43 +02:00
yoff
0c7184952b
Merge pull request #9023 from RasmusWL/positional-docs
...
Python: Clarify `getArg` is about positional arguments
2022-05-05 11:28:17 +02:00
Rasmus Wriedt Larsen
6ae5ef9f3b
Revert "move most of asyncpg test into SqlInjection after moving MaD sql-injection sink"
...
This reverts commit 4b9c9b0c8d
2022-05-05 10:20:41 +02:00
Tom Hvitved
66a9759329
Merge pull request #8870 from hvitved/dataflow/expect-content
...
Data flow: Introduce `expectsContent`
2022-05-05 09:01:40 +02:00
Joe Farebrother
c1290d9e2b
Sync shared redos library files.
2022-05-04 15:41:38 +01:00
Joe Farebrother
0a5268aeb4
Sync shared library changes across languages.
2022-05-04 15:41:38 +01:00
Tom Hvitved
8e33653d25
Merge pull request #9017 from hvitved/dataflow/subpaths-perf
...
Data flow: Speedup `subpaths` predicate
2022-05-04 16:37:52 +02:00
Tom Hvitved
9cb63c0a5e
Data flow: Sync files
2022-05-04 14:49:26 +02:00
Erik Krogh Kristensen
4b9c9b0c8d
move most of asyncpg test into SqlInjection after moving MaD sql-injection sink
2022-05-04 10:59:02 +02:00
Erik Krogh Kristensen
a812d4dd34
move the MaD sql-injection sink to SqlInjectionCustomizations.qll
2022-05-04 10:59:02 +02:00
Erik Krogh Kristensen
571fc3e73b
Revert "deprecate SqlConstruction"
...
This reverts commit c0eca0d09a
2022-05-04 10:59:02 +02:00
Erik Krogh Kristensen
1062aae21c
add test that the foo.bar package syntax works
2022-05-04 10:58:59 +02:00
Tom Hvitved
74e99302d6
Address review comments
2022-05-04 09:57:59 +02:00
Tom Hvitved
da72ba46d4
Data flow: Add stub expectsContent for all languages
2022-05-04 09:57:59 +02:00
Tom Hvitved
6e2e8440eb
Data flow: Sync files
2022-05-04 09:57:59 +02:00
Erik Krogh Kristensen
ead978187d
adjust the source-type for remote-flow from MaD
2022-05-03 22:53:41 +02:00
Erik Krogh Kristensen
8ffc05c84b
count both named and positional arguments in the WithArity filter
2022-05-03 21:21:57 +02:00
Rasmus Wriedt Larsen
d012eaa892
Python: Clarify getArg is about positional arguments
2022-05-03 14:26:23 +02:00
yoff
56ed68b3eb
Merge pull request #9001 from RasmusWL/files-refactoring
...
Python: Flask: Improve `request.files` modeing
2022-05-03 12:19:55 +02:00
Tom Hvitved
e9c8f979f9
Data flow: Sync files
2022-05-03 11:46:51 +02:00
Rasmus Wriedt Larsen
7e1be3172e
Python: Add change-note
2022-05-02 14:24:13 +02:00
Rasmus Wriedt Larsen
de4390cdf6
Python: Improve Flask request.files handling even more
2022-05-02 14:19:45 +02:00
Rasmus Wriedt Larsen
fb0133d276
Python: Fix Flask request.files modeling
2022-05-02 14:14:58 +02:00
Rasmus Wriedt Larsen
0c62916af5
Python: Highlight problem with Flask request.files modeling
2022-05-02 14:14:53 +02:00
Erik Krogh Kristensen
c0eca0d09a
deprecate SqlConstruction
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
6c67e51ec3
add test for the .Call token
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
9c3d45a16a
last test of taint steps
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
894252dfa7
third test of taint steps
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
0f1e070d82
second test of taint steps
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
649df1dd31
simple taint-flow test
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
a8790412dd
add support for the Argument[any] and Argument[any-named] tokens
2022-05-02 12:58:21 +02:00
Erik Krogh Kristensen
b1fa7f86a8
add support for the any argument tokens
2022-05-02 12:58:15 +02:00
