hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-24 20:02:58 +01:00
Code Issues Packages Projects Releases Wiki Activity
8,396 Commits 1,686 Branches 158 Tags
55010d030d376bd6cc03258655d00690fe106531
Commit Graph

456 Commits

Author SHA1 Message Date
Rasmus Wriedt Larsen
9151a7e433 Python: Always enable legacy taint tracking configuration 
If the legacy configuration is only enabled if there are no other
configurations, defining a configuration in an imported library can lead to
unwanted results. For example, code that uses `any(MyTaintKind t).taints(node)`
would *stop* working, if it did not define its own configuration. (this actually
happened to us)

We performed a dist-compare to ensure there is not a performance deg ration by
doing this. Results at https://git.semmle.com/gist/rasmuswl/a1eca07f3a92f5f65ee78d733e5d260e

Tests that were affected by this:

- RockPaperScissors + Simple: new edges because no configuration was defined for
  SqlInjectionTaint or CommandInjectionTaint
- CleartextLogging + CleartextStorage: new edges because no configuration was
  defined before, AND duplicate deges.
- TestNode: new edges because no configuration was defined before

- PathInjection: Duplicate edges
- TarSlip: Duplicate edges
- CommandInjection: Duplicate edges
- ReflectedXss: Duplicate edges
- SqlInjection: Duplicate edges
- CodeInjection: Duplicate edges
- StackTraceExposure: Duplicate edges
- UnsafeDeserialization: Duplicate edges
- UrlRedirect: Duplicate edges
 2019-11-11 11:17:21 +01:00
Taus
e9336fe30e Merge pull request #2129 from RasmusWL/python-update-django 
Python: update django support
 2019-11-05 20:51:55 +01:00
Taus
aa7a997c7a Merge pull request #2248 from RasmusWL/python-sensitive-data-fewer-fp 
Python: Limit what functions we treat as returning sensitive data
 2019-11-04 15:09:52 +01:00
Rasmus Wriedt Larsen
b075103198 Merge pull request #2163 from tausbn/python-undefined-export-fp 
Python: Modernise and fix FP in `py/undefined-export`
 2019-11-04 13:10:48 +01:00
Rasmus Wriedt Larsen
6593477d0b Python: Limit what functions we treat as returning sensitive data 
Before this change, any function that has a parameter that was called
password/credentials would be treated as returning sensitive data of that
kind. `py/clear-text-logging-sensitive-data` would alert if one of these are
logged, which has a LOT of false-positives.
 2019-11-04 11:32:21 +01:00
Rasmus Wriedt Larsen
fc851b46c3 Python: Fix Django class-based views 2019-10-29 13:58:07 +01:00
Rasmus Wriedt Larsen
91f269ed7b Python: Remove unused django sinks 
This would find instances of `thing = MyThing.objects.get(field=userinput)`, and
what seems to be a query that wants to match on `thing = MyThing();
thing.field=userinput`. Both are not vulnerable to user-input, due to the
build-in escaping by django.

The DjangoModelFieldWrite actually matches on `MyThing.field=userinput` and not
`thing.field=userinput`. I suspect this to be a mistake.

Matching on `thing.field=userinput`, would require this CodeQL:

attr.getObject(_).pointsTo().getClass() = model
 2019-10-29 13:58:07 +01:00
Rasmus Wriedt Larsen
afe7a0536c Python: Support positional arguments in Django routes 2019-10-29 13:58:07 +01:00
Rasmus Wriedt Larsen
49dd2216a6 Python: Refactor django library 
Use General.qll for routing, like in other web libraries
 2019-10-29 13:58:07 +01:00
Taus
6e6dab9ab8 Merge pull request #2178 from RasmusWL/python-minor-qldoc-fix 
Python: Fix qldoc for TaintTracking Configuration
 2019-10-29 10:40:12 +01:00
Taus
04e3683035 Merge pull request #2194 from RasmusWL/python-improve-getbasetype-qldoc 
Python: Improve qldoc for ClassValue::getABaseType
 2019-10-28 17:07:19 +01:00
Rasmus Wriedt Larsen
f1004b10ba Merge pull request #2147 from tausbn/python-cyclic-import-package-fp 
Python: Fix cyclic import FP relating to packages.
 2019-10-25 11:57:55 +02:00
Rasmus Wriedt Larsen
c50d366527 Python: Improve qldoc for ClassValue::getABaseType 
Hopefully it is more clear that you can get multiple results from getABaseType
because of multiple inheritance, and not because we are following the chain of
inheritance
 2019-10-24 17:10:42 +02:00
Rasmus Wriedt Larsen
8767d29d21 Python: Use src for naming in TaintTrackign::Configuration 
We picked `src` since this is used much more than `source` in our existing code.
 2019-10-23 15:56:37 +02:00
Taus Brock-Nannestad
8a1d1e7b7a Python: Modernise and false positive in py/undefined-export. 2019-10-21 16:07:48 +02:00
Rasmus Wriedt Larsen
9cf0e244b1 Python: Fix toString for CookieSet classes 
The old implementation would result in empty recursion.
 2019-10-21 11:26:10 +02:00
Taus
45158a7177 Merge pull request #2053 from RasmusWL/python-modernise-falcon-library 
Python modernise falcon library
 2019-10-18 14:47:33 +02:00
Taus Brock-Nannestad
067bdf5ec4 Python: Disregard packages when looking for cyclic imports. 2019-10-17 12:47:34 +02:00
Rasmus Wriedt Larsen
d3f3cefa54 Python: Autoformat (4 spaces) falcon library 2019-10-15 11:23:51 +02:00
Rasmus Wriedt Larsen
7a112f37cb Python: Modernise falcon library 2019-10-15 11:22:46 +02:00
Rasmus Wriedt Larsen
36bb5f54ce Python: Fix hasFlowPath default implementation of isSink/2 
If hasFlowPath was used, and isSink/2 was not overridden,
hasFlowPath(src, sink) would not use isSink/1 to restrict the allowed TaintSink.
This resulted in false-positives when we had flows with unrelated TaintSinks.

FP: 1a8e7ffc2e/files/webapp/graphite/dashboard/views.py (x2d486922081db956):1

Fixes https://github.com/Semmle/ql/issues/2081
 2019-10-10 15:34:54 +02:00
Rasmus Wriedt Larsen
3f45d8614b Merge pull request #2047 from taus-semmle/python-modernise-and-fix-cyclic-import-fp 
Python: modernise and fix cyclic import false positive.
 2019-10-07 14:28:36 +02:00
Taus
fb20cab4c8 Merge pull request #2012 from RasmusWL/python-modernise-cls-self-checks 
Python: modernise cls self argument name checks
 2019-09-30 15:50:32 +02:00
Taus
9a8b62250f Merge pull request #2043 from RasmusWL/python-modernise-django 
Python: modernise django library
 2019-09-30 11:57:09 +02:00
Taus
04f14f1fe7 Merge pull request #2040 from RasmusWL/python-modernise-cherrypy 
Python: Modernise cherrypy library
 2019-09-30 11:53:59 +02:00
Taus Brock-Nannestad
921371d544 Python: Modernise the cyclic import queries. 2019-09-27 13:51:56 +02:00
Rasmus Wriedt Larsen
fc59b10ba4 Python: Autoformat (4 spaces) django library 2019-09-27 13:15:28 +02:00
Rasmus Wriedt Larsen
f4e0abd4c4 Python: Modernise django library 2019-09-27 13:14:52 +02:00
Rasmus Wriedt Larsen
bc8e4d2005 Python: Autoformat (4 spaces) cherrypy library 2019-09-27 13:06:09 +02:00
Rasmus Wriedt Larsen
ff28b3f1b4 Python: Modernise cherrypy library 2019-09-27 11:23:33 +02:00
Rasmus Wriedt Larsen
41f16aaf7a Python: Autoformat (4 spaces) bottle library 2019-09-26 15:05:51 +02:00
Rasmus Wriedt Larsen
12c49031e8 Python: Modernise bottle library 2019-09-26 15:03:47 +02:00
Rasmus Wriedt Larsen
5271d6a063 Python: Add min/max #parameters to FunctionValue 
So we don't loose this information on the newly migrated/modernise zope
interface
 2019-09-26 13:25:14 +02:00
Rasmus Wriedt Larsen
a81bf720f5 Python: Modernise the py/not-named-self query. 2019-09-26 13:25:14 +02:00
Rasmus Wriedt Larsen
3f974fbc14 Python: Modernise the py/not-named-cls query. 2019-09-26 13:25:14 +02:00
Taus
3f3b0e5149 Merge pull request #2013 from RasmusWL/python-random-bag 
Python: small improvements
 2019-09-26 11:08:36 +02:00
Rasmus Wriedt Larsen
752615fb56 Python: Fix doc for Expr::isDeletion 2019-09-24 16:56:07 +02:00
Rasmus Wriedt Larsen
f870b21d2f Python: Use Builtin::special for floats ClassValue 
We could find no reason for using `Builtin::builtin` instead of
`Builtin::special`. Since all the other base types use `special`, and the old
Object API is using `special`, let's also do that :)
 2019-09-24 16:55:49 +02:00
Taus
594a50e066 Merge pull request #1955 from RasmusWL/python-modernise-explicit-return-in-init 
Python: Modernise the `py/explicit-return-in-init` query.
 2019-09-24 16:23:37 +02:00
Taus Brock-Nannestad
e1012d8d5a Python: Add __aiter__ as a recognised iterator method. 2019-09-23 12:26:16 +02:00
Rasmus Wriedt Larsen
f0479687d8 Python: Fix documentation for Function.isInitMethod 2019-09-23 11:22:55 +02:00
Rebecca Valentine
f503e042fc Merge pull request #1877 from taus-semmle/python-modernise-non-iterator-query 
Python: Modernise the `py/non-iterable-in-for-loop` query.
 2019-09-12 11:14:40 -07:00
Rebecca Valentine
9eebe00b33 Merge pull request #1869 from taus-semmle/python-fix-typehint-divergence 
Python: Prevent divergence in type-hint analysis. (ODASA-8075)
 2019-09-06 14:33:20 -07:00
Taus Brock-Nannestad
d336140c19 Python: Modernise the py/non-iterable-in-for-loop query. 
Also adds a small test case exhibiting the same false positive seen in
ODASA-8042.
 2019-09-05 12:24:51 +02:00
Taus Brock-Nannestad
1b432076c4 Python: Prevent divergence in type-hint analysis. (ODASA-8075) 2019-09-03 13:38:46 +02:00
Taus
89778ef61d Merge pull request #1849 from markshannon/python-add-syntax-comments 
Python: Add syntax example comments for automatic document generation.
 2019-08-30 17:46:50 +02:00
Mark Shannon
ad463038f8 Python: Clarify comment about 'syntax:' comment and add ... to for and async for comments. 2019-08-30 15:34:14 +01:00
Taus
f8bd3770d6 Merge pull request #1848 from markshannon/python-rationalize-taint-tracking 
Python: Move TaintTracking.qll
 2019-08-30 16:21:49 +02:00
Mark Shannon
637677d515 Python: Move TaintTracking.qll from semmle.python.security to semmle.python.dataflow, for consistency with other code. 2019-08-30 12:57:47 +01:00
Mark Shannon
a256945938 Python: Add syntax example comments for document generation. 2019-08-30 12:46:08 +01:00