Tom Hvitved
24b1da4d02
Python: Implement ContentApprox
2022-12-13 09:53:01 +01:00
Tom Hvitved
0c2eee2a72
Data flow: Sync files
2022-12-13 09:52:55 +01:00
yoff
557a5b469f
Merge pull request #11555 from pwntester/new_python_cmdi_sinks
...
Added two new CMDi sinks for python's stdlib
2022-12-13 09:00:34 +01:00
Jami
93d8a03e73
Merge branch 'main' into jcogs33/mad-metrics-query
2022-12-12 20:31:53 -05:00
Jami Cogswell
623068c4b9
Java: add hasProvenance predicate, remove isManuallyGenerated and isBothAutoAndManuallyGenerated
2022-12-12 11:23:46 -05:00
erik-krogh
b3a9c1ca06
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
Jami Cogswell
6854845b75
Java: refactor isManuallyGenerated and isBothAutoAndManuallyGenerated
2022-12-09 18:37:50 -05:00
Michael Nebel
f4f7d83349
Python: Rename Negative Summary Model to Neutral Model.
2022-12-09 15:04:43 +01:00
Michael Nebel
079d48c42a
Sync files.
2022-12-09 15:04:42 +01:00
Asger F
387a673c10
Merge pull request #11567 from asgerf/js/data-extensions2
...
JS: Move MaD models to data extensions
2022-12-09 10:09:24 +01:00
Jami Cogswell
0b2f2a3f88
Java: remove predicates from NegativeSummarizedCallable
2022-12-08 23:46:55 -05:00
Rasmus Wriedt Larsen
d684dbdf5c
Merge pull request #10656 from porcupineyhairs/PyPamImprove
...
Python: Improve the PAM authentication bypass query
2022-12-08 11:59:10 +01:00
Jami Cogswell
aa7e6d7811
Java: add negative numbers
2022-12-07 17:17:35 -05:00
Jami
5e694b5983
Merge pull request #11192 from jcogs33/jcogs33/share-key-sizes
...
Share encryption key sizes between Java and Python
2022-12-07 08:08:24 -05:00
Asger F
5af1b367c7
Support data extensions
2022-12-07 11:35:05 +01:00
Jami Cogswell
b82f9b1911
Java: add draft of generated vs manual MaD metrics query
2022-12-06 22:15:19 -05:00
Tom Hvitved
b5e2e1e469
Merge pull request #11564 from hvitved/dataflow/parameter-position-consistency-checks
...
Data flow: Add consistency checks for parameter positions
2022-12-06 09:33:36 +01:00
Tom Hvitved
52f3a48638
Data flow: Sync files
2022-12-05 12:57:27 +01:00
Tom Hvitved
faca4b5b56
Merge pull request #11461 from hvitved/ruby/unique-hash-splat-param
...
Ruby: At most one hash-splat `ParameterNode` per callable
2022-12-05 11:53:28 +01:00
Alvaro Muñoz
fc56843c04
improve predicate QLdoc
2022-12-03 16:34:14 +01:00
Alvaro Muñoz
7e0e56dadc
Added two new CMDi sinks fot python's stdlib
2022-12-02 22:16:40 +01:00
Asger F
2d578c1a73
Merge branch 'main' into merge-package-type-columns
2022-12-02 10:00:44 +01:00
Jami Cogswell
1f4bd00993
split rsa/dsa/dh
2022-12-01 11:56:44 -05:00
Jami Cogswell
0fa05d47e3
add shared key sizes
2022-12-01 11:56:44 -05:00
Tom Hvitved
b33f5925bb
Data flow: Sync files
2022-11-30 13:39:25 +01:00
Owen Mansel-Chan
55c4643b20
Dataflow: Sync.
2022-11-30 11:00:07 +00:00
Tom Hvitved
f3dca95958
Merge pull request #11087 from hvitved/dataflow/summary-ctx
...
Data flow: Add summary/return context to pruning stages 2-4
2022-11-29 10:36:53 +01:00
Rasmus Wriedt Larsen
3d9556e5a3
Python: Use proper Query suffix
2022-11-28 16:03:17 +01:00
Rasmus Wriedt Larsen
c310948521
Python: Remove enclosing module for PAM Auth Bypass.qll
2022-11-28 16:02:38 +01:00
Tom Hvitved
cde05e1190
Data flow: Sync files
2022-11-28 12:11:38 +01:00
Erik Krogh Kristensen
03737543d4
Merge pull request #11403 from erik-krogh/additional
...
ReDoS: add missing additional keywords
2022-11-24 15:53:51 +01:00
Erik Krogh Kristensen
1eec067474
Merge pull request #11294 from erik-krogh/fileDoc
...
QL: improve the "this block-comment should have been a QLDoc"-query
2022-11-23 22:23:36 +01:00
erik-krogh
95f35196e4
add missing additional keywords
2022-11-23 20:45:51 +01:00
Asger F
abf0c0f296
Python: update more comments referring to the package column
2022-11-23 15:02:08 +01:00
Asger F
1c910550e6
Python: merge package/type columns
2022-11-23 11:17:42 +01:00
Rasmus Wriedt Larsen
04a68f8d52
Merge pull request #11372 from RasmusWL/getpass
...
Python: Model `getpass.getpass` as source of passwords
2022-11-22 14:49:04 +01:00
Rasmus Wriedt Larsen
9195b73d84
Python: Model getpass.getpass as source of passwords
2022-11-22 14:11:52 +01:00
Rasmus Wriedt Larsen
80e71b202a
Python: Cleartext queires: Remove flow from getpass.py
2022-11-22 14:08:00 +01:00
Taus
8f4eb7107a
Merge pull request #10861 from tausbn/python-clean-up-import-resolution
...
Python: Clean up import resolution
2022-11-21 15:18:08 +01:00
Tom Hvitved
99e70e9a50
Data flow: Sync files
2022-11-20 10:19:23 +01:00
Porcupiney Hairs
db231a111c
Python : Improve the PAM authentication bypass query
...
The current PAM auth bypass query which was contributed by me a few months back, alert on a vulenrable function but does not check if the function is actually function. This leads to a lot of fasle positives.
With this PR, I add a taint-tracking configuration to check if the username parameter can actually be supplied by an attacker.
This should bring the FP's significantly down.
2022-11-19 01:29:25 +05:30
Taus
d79eed533b
Python: Remove unwanted recursion
...
Depending on `localFlowStep` meant that this predicate ended up being
recursive with itself (by way of flow summaries which depend on API
graphs, which in turn depend on import resolution).
Changing this to use the simple local flow step predicate that we use
for type tracking should fix this issue.
2022-11-18 13:50:50 +00:00
Taus
e76ab8c78c
Merge branch 'main' into python-clean-up-import-resolution
2022-11-17 22:47:50 +00:00
erik-krogh
468a879c1f
Python: delete dead code. thanks QL-for-QL
2022-11-17 22:12:51 +01:00
erik-krogh
e491b61e09
Python: move the contents of PEP249Impl to PEP249, which is possible now that the deprecations have been deleted
2022-11-17 22:12:50 +01:00
erik-krogh
a7ba693ccb
Python: delete old deprecations
2022-11-17 22:12:50 +01:00
Taus
811426c586
Python: Remove manual magic entirely
...
This was causing issues with imports with many "dots" in the name.
Previously, the test added in this commit would not have the desired
result for the `check` call.
2022-11-17 14:15:55 +00:00
yoff
505f454878
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswl@github.com >
2022-11-16 22:20:19 +01:00
Taus
81348049df
Python: Fix missing module resolution
...
This was due to bad manual magic: restricting the attribute name makes
sense when we're talking about submodules of a package, but it doesn't
when we're talking about reexported modules.
Also (hopefully) fixes the tests so that the Python 3-specific bits are
ignored under Python 2.
2022-11-16 19:58:32 +00:00
Taus
19261ecfbf
Python: Remove spurious module references
2022-11-16 18:19:54 +00:00
