Rasmus Wriedt Larsen
|
b30142c1d7
|
Python: Move CommandInjection to new dataflow API
|
2023-08-28 15:27:49 +02:00 |
|
Rasmus Wriedt Larsen
|
700841e9b0
|
Python: Move UnsafeShellCommandConstruction to new dataflow API
|
2023-08-28 15:27:49 +02:00 |
|
erik-krogh
|
6a5d6eb5c2
|
lower precision of py/shell-command-constructed-from-input to medium
|
2023-03-13 14:56:42 +01:00 |
|
erik-krogh
|
759854991a
|
fix various nits based on feedback
|
2023-02-15 11:10:43 +01:00 |
|
erik-krogh
|
7fcc548665
|
add py/shell-command-constructed-from-input, but without a source.
It's a very direct port from Ruby, with only minor adjustments to fit the Python APIs
|
2023-02-03 14:47:55 +01:00 |
|
erik-krogh
|
944ca4a0da
|
fix some more style-guide violations in the alert-messages
|
2022-10-07 11:23:34 +02:00 |
|
erik-krogh
|
089ce5a8a4
|
change alert messages of path queries to use the same template
|
2022-09-02 14:45:40 +02:00 |
|
Erik Krogh Kristensen
|
06afe9c0f4
|
Merge pull request #9816 from erik-krogh/msgConsis
Make alert messages consistent across languages
|
2022-08-25 15:20:01 +02:00 |
|
Ian Lynagh
|
3fcfd32eb1
|
Make *.ql non-executable
|
2022-08-24 16:55:11 +01:00 |
|
erik-krogh
|
9395f156de
|
update {js/py}/command-line-injection to match csharp/java
|
2022-08-22 21:41:46 +02:00 |
|
Rasmus Wriedt Larsen
|
695553ba9f
|
Python: Deprecate old non-Query.qll dataflow defs
|
2022-03-21 15:03:22 +01:00 |
|
Rasmus Wriedt Larsen
|
98e6fc8a88
|
Python/Ruby: Remove owasp tags
These are no longer correct, since the A1 category changed from 2017 to
2021, see https://owasp.org/Top10/#whats-changed-in-the-top-10-for-2021
Since only a very few queries had these tags, I think we're much better
off having them removed.
|
2021-11-16 12:03:50 +01:00 |
|
Rasmus Wriedt Larsen
|
62e4445f45
|
Python: Port py/command-line-injection to use proper source/sink customization
|
2021-07-12 16:22:10 +02:00 |
|
Calum Grant
|
771e686946
|
Update security-severity scores
|
2021-06-15 13:25:17 +01:00 |
|
Calum Grant
|
a594afb828
|
Add security-severity metadata
|
2021-06-10 20:11:08 +01:00 |
|
Rasmus Wriedt Larsen
|
7afe3972d8
|
Revert "Merge pull request #5171 from RasmusWL/restructure-queries"
This reverts commit 8caafb3710, reversing
changes made to ec79094957.
|
2021-02-17 16:32:53 +01:00 |
|
Rasmus Wriedt Larsen
|
3a18881660
|
Python: Restructure query file location
Since I can never remember the CWE numbers
|
2021-02-16 11:36:10 +01:00 |
|
Rasmus Wriedt Larsen
|
6299b73a46
|
Python: Move CommandInjection configuration to own file
|
2020-11-06 14:07:06 +01:00 |
|
Taus Brock-Nannestad
|
fb6a02e060
|
Python: More import fixups
|
2020-11-02 22:17:42 +01:00 |
|
Taus Brock-Nannestad
|
f903e4ffbe
|
Python: Promote experimental queries
DO NOT MERGE
Also adds performance fix to `python.qll`.
|
2020-10-30 19:40:56 +01:00 |
|
Taus Brock-Nannestad
|
f07a7bf8cf
|
Python: Autoformat everything using qlformat.
Will need subsequent PRs fixing up test failures (due to deprecated
methods moving around), but other than that everything should be
straight-forward.
|
2020-07-07 15:43:52 +02:00 |
|
Taus Brock-Nannestad
|
01fb1e3786
|
Python: Get rid of deprecated terms in code and .qhelp.
|
2020-06-19 16:51:09 +02:00 |
|
Rasmus Wriedt Larsen
|
9c75a39b81
|
Python: Extend command-injection to handle fabric.api.execute
|
2020-05-26 10:22:27 +02:00 |
|
Taus Brock-Nannestad
|
ab4cef53c2
|
Python: Autoformat one final straggler.
|
2020-03-30 12:36:43 +02:00 |
|
Rasmus Wriedt Larsen
|
d475bb998e
|
Python: Add abstract class CommandSink
I'm going to add more in a sec, and listing *all* of them in CommandInjection.ql
started to be silly
|
2020-03-23 17:04:08 +01:00 |
|
Rasmus Wriedt Larsen
|
27a7d09c94
|
Python: Fix minor problems in security examples
|
2020-02-03 14:35:09 +01:00 |
|
Rasmus Wriedt Larsen
|
2648e34f1a
|
Python: Autoformat security
|
2020-01-31 14:49:18 +01:00 |
|
Mark Shannon
|
3e5fddd776
|
Python: Update all remaining taint-tracking queries to use configurations.
|
2019-07-26 16:39:10 +01:00 |
|
Mark Shannon
|
61bd8682df
|
Python: Improve API and representation of taint tracking nodes. Update queries and tests accordingly.
|
2018-11-23 12:32:14 +00:00 |
|
Mark Shannon
|
722d89fc75
|
Upgrade taint-tracking security queries to path-problem queries.
|
2018-11-22 11:05:01 +00:00 |
|
Mark Shannon
|
e930b43bf3
|
Python security queries. Choose a precision reflecting actual precision for Security queries.
|
2018-11-19 17:10:40 +00:00 |
|
Mark Shannon
|
5f58824d1b
|
Initial commit of Python queries and QL libraries.
|
2018-11-19 15:10:42 +00:00 |
|