Rasmus Wriedt Larsen
6774085e7a
Python: Add note about parseid/XMLID
2022-03-31 11:19:25 +02:00
Rasmus Wriedt Larsen
a315aa84b2
Python: Add some links in QLDocs
2022-03-31 11:16:50 +02:00
Rasmus Wriedt Larsen
64aa503cc3
Python: Promote xml.etree modeling
2022-03-31 11:12:02 +02:00
Rasmus Wriedt Larsen
7f5f7679f8
Python: Promote xmltodict modeling
2022-03-31 10:28:34 +02:00
Rasmus Wriedt Larsen
80b5cde3a2
Python: Promote lxml parsing modeling
2022-03-31 10:19:08 +02:00
Rasmus Wriedt Larsen
3040adfd9b
Python: Handle XMLParser().close() for XPath
2022-03-31 10:08:26 +02:00
Rasmus Wriedt Larsen
c4473c5f65
Python: Rename lxml XPath tests
2022-03-31 10:08:02 +02:00
Rasmus Wriedt Larsen
1ea4bcc59f
Python: Make XMLParsing a Decoding subclass
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
35ccba2ec1
Python: Promote XMLParsing concept test
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e45288e812
Python: => XMLParsingVulnerabilityKind
...
Since there are other XML vulnerabilities that are not about parsing,
this is more correct.
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e005a5c0ab
Python: Promote XMLParsing concept
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
9caf4be21b
Python: Add PortSwigger link to Xxe.qhelp
...
I found this resource quite good myself at least :)
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
56b9c891d8
Python: Adjust XmlBomb.qhelp from JS
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
b00766b054
Python: Adjust XXE qhelp
...
and remove the old copy, we don't need it anymore :)
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
c365337867
Python: Delete XmlEntityInjection.ql
...
Kept the test of SimpleXmlRpcServer, and kept the qhelp so it can be
used to write the new qhelp files
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
769f5691d0
Python: Add taint for StringIO and BytesIO
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
57b9780428
Python: XXE: Add example of exfiltrating data through dtd-retrival
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
a1d88e39a7
Python: Adjust XXE PoC for newer lxml versions
...
Which doesn't raise that syntax error (at least not on my laptop)
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
91795b8577
Python: Add simple test of Xxe/XmlBomb
...
Note that most of the testing happens in the framework specific tests,
with an inline-expectation test
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
e45f9d69cc
Python: Adjust Xxe/XmlBomb for Python
...
I changed a few QLdocs so they fit the style we have used in Python...
although I surely do regret having introduced a new style for how these
QLDocs look :D
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
65907c9762
Python: Copy Xxe/XmlBomb queries from JS
...
After internal discussion, these will replace the `XmlEntityInjection`
query, so we can have separate severities on DoS and the other (more
serious) attacks.
Note: These clearly don't work, since they are verbatim copies of the JS
code, but I split it into multiple commits to clearly highlight what
changes were made.
2022-03-31 09:52:54 +02:00
Arthur Baars
2ae5e8158e
Python: import RegExpTreeView correctly
2022-03-28 12:41:32 +02:00
Arthur Baars
b103679d8a
JS/Ruby/Python: rename RegExpTreeView.qll to ReDoSUtilSpecific.qll
2022-03-28 12:17:26 +02:00
Arthur Baars
af1d949d06
Merge pull request #8489 from aibaars/regex-refactor
...
Ruby: refactor regex libraries
2022-03-28 12:17:00 +02:00
yoff
5efc19c39d
Merge pull request #7806 from erik-krogh/pyDef
...
Python: Add def nodes to API graphs
2022-03-28 08:09:14 +02:00
Taus
b75ac4e827
Merge pull request #8540 from tausbn/python-add-points-to-call-graph-meta-query
...
Python: Add call graph meta-query
2022-03-25 15:36:33 +01:00
Rasmus Wriedt Larsen
d51aaf2f91
Python: Import framework-modeling in regex.qll
2022-03-24 14:28:44 +01:00
Arthur Baars
1a9aaf4543
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-24 11:37:03 +01:00
Arthur Baars
74aea81fe3
Ruby: refactor regex libraries
2022-03-24 11:37:02 +01:00
Taus
af888f7604
Python: Add call graph meta-query
2022-03-23 16:36:28 +00:00
yoff
647d37492d
Merge pull request #8289 from tausbn/python-remove-with-test-syntax-error
...
Python: Fix syntax error in `with` test output
2022-03-23 12:25:11 +01:00
Rasmus Wriedt Larsen
bbf60b875e
Merge pull request #8476 from RasmusWL/shared-concepts-scaffolding
...
Python/JS/Ruby: Shared concepts scaffolding
2022-03-23 10:22:42 +01:00
Taus
f9120167b4
Python: Fix syntax error in with test output
...
Depends on an internal PR. The two lines in question were caused by
the insertion of an extra node due to the failure to parse a trailing
comma corrcetly.
2022-03-22 16:22:03 +00:00
yoff
47e062cfb9
Merge pull request #8486 from aibaars/incomplete-hostname-python
...
Python: switch to shared implementation of IncompleteHostnameRegExp.ql
2022-03-22 15:06:14 +01:00
Rasmus Wriedt Larsen
6bd9d82610
Merge pull request #8061 from RasmusWL/orm
...
Python: Add data-flow through Django ORM models
2022-03-22 11:14:08 +01:00
Rasmus Wriedt Larsen
311cbb4e13
Merge branch 'main' into shared-concepts-scaffolding
2022-03-22 10:36:33 +01:00
Rasmus Wriedt Larsen
414764ccee
Concepts: Minor rewrite in qldoc
...
As suggested by @hmac
2022-03-22 10:33:58 +01:00
Rasmus Wriedt Larsen
758a81cc0f
Python: Remove import of Concepts in DataFlowPrivate
...
As discussed in PR review
2022-03-21 16:22:15 +01:00
Arthur Baars
79cd7bf8ed
Python: create semmle/python/dataflow/new/Regex.qll
2022-03-21 15:57:19 +01:00
Alex Ford
c891c53835
Merge pull request #8395 from alexrford/ruby/clear-text-storage
...
Ruby: add `rb/clear-text-storage-sensitive-data` query
2022-03-21 10:05:39 +00:00
Arthur Baars
9412b331db
Revert "Revert "Python: switch to shared implementation of IncompleteHostnameRegExp.ql""
...
This reverts commit 6d24591416
2022-03-18 16:31:22 +01:00
Arthur Baars
431b60506e
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-18 13:05:34 +01:00
Arthur Baars
6d24591416
Revert "Python: switch to shared implementation of IncompleteHostnameRegExp.ql"
...
This reverts commit ce50f35dda
2022-03-18 13:02:55 +01:00
Mathias Vorreiter Pedersen
abe30457ee
Python: Accept test changes.
2022-03-17 14:03:58 +01:00
Tom Hvitved
79ea2a3a9c
Data flow: Sync files
2022-03-17 14:03:58 +01:00
Rasmus Wriedt Larsen
2b9408b0c3
Concepts: Add some architecture documentation
2022-03-17 13:49:10 +01:00
Harry Maclean
36c421346b
Introduce ConceptsShared.qll
2022-03-17 13:49:10 +01:00
Jeroen Ketema
7a9a9d833a
Merge pull request #8435 from jketema/all-the-barriers
...
Add flow state versions of isBarrierIn, isBarrierOut, and isBarrierGuard
2022-03-16 15:50:19 +01:00
Arthur Baars
ab93b3784b
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-16 12:31:12 +01:00
Rasmus Wriedt Larsen
ae1ba11d57
Merge branch 'main' into orm
2022-03-16 11:23:14 +01:00
