Rasmus Lerchedahl Petersen
ef32488596
Merge branch 'main' of github.com:github/codeql into python-port-unsafe-deserialization
2020-10-15 15:45:35 +02:00
Rasmus Lerchedahl Petersen
172e058438
Python: unsafe -> mayExecuteInput
2020-10-15 12:56:29 +02:00
Rasmus Lerchedahl Petersen
3a281a1bd6
Python: Adjust comments and tests
2020-10-14 14:40:11 +02:00
yoff
ffe79f688d
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2020-10-14 14:08:16 +02:00
Rasmus Lerchedahl Petersen
b0ebb5b6d1
Python: Adjust tag format
2020-10-14 09:51:24 +02:00
Rasmus Lerchedahl Petersen
93383747bd
Python: Use more common name for concept
2020-10-14 09:28:58 +02:00
Rasmus Lerchedahl Petersen
a76d276b48
Python: Adjust getARelevantTag
2020-10-14 08:44:04 +02:00
Rasmus Lerchedahl Petersen
b7e8b48e9e
Python: Move concept tests out
...
These tests should be fleshed out at some point, but currently
they test all that we model.
2020-10-13 13:06:47 +02:00
Rasmus Wriedt Larsen
46ec7fbf6e
Python: Make builtin compile function additional taint step
2020-10-07 21:17:39 +02:00
Rasmus Wriedt Larsen
c69a61bac5
Python: Model exec and eval calls as CodeExecution
2020-10-07 21:14:19 +02:00
Rasmus Wriedt Larsen
453c391bb0
Python: Add CodeExecution tests for stdlib
2020-10-07 21:12:31 +02:00
Rasmus Wriedt Larsen
e5b9ac8d9c
Python: Use getCommand as tag in ConceptsTest
2020-10-02 14:12:41 +02:00
Rasmus Wriedt Larsen
6cb2ca63a6
Python: tests to show modeling is very syntactical
2020-09-28 11:23:06 +02:00
Rasmus Wriedt Larsen
3af5c720cc
Python: Add test of more indirect command injection sinks
2020-09-28 11:16:52 +02:00
Rasmus Wriedt Larsen
f7f6564189
Python: Model subprocess.Popen (and helpers)
2020-09-28 11:13:04 +02:00
Rasmus Wriedt Larsen
62dc0dd263
Python: Model os.exec* os.spawn* and os.posix_spawn*
...
I also had to exclude the inline expectation tests from files outside the test
repo.
2020-09-28 11:05:33 +02:00
Rasmus Wriedt Larsen
c440fd0c09
Python: Adjust expectations for system command executions
...
I mostly did this to show my reviewers that the tests actually run and do
something ;)
2020-09-28 11:05:33 +02:00
Rasmus Wriedt Larsen
060720aae7
Python: Add tests for all SystemCommandExecution from stdlib
...
Overall idea is that `test/experimental/meta/ConceptsTest.qll` will set up
inline expectation tests for all the classes defined in `Concepts.qll`, so any
time you model a new instance of Concepts, you simply just import that
file. That makes the tests a little verbose, but allows us to share test-setup
between all the different frameworks we model.
Note that since the definitions of SystemCommandExecution subclasses are
scattered across multieple framework modeling qll files, it think it makes the
most sense to have the tests for each framework in one location.
I'm not 100% convinced about if this is the right choice or not (especially when
we want to write tests for sanitizers), but for now I'm going to try it out at
least.
2020-09-28 11:05:32 +02:00
