ALJI Mohamed
2801b8495a
A fix of the tag name
2022-12-06 14:50:47 +01:00
ALJI Mohamed
4896e62117
Use of more generic terms
2022-12-06 14:44:52 +01:00
Sim4n6
58570b4d2c
Update python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.ql
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-12-06 14:40:48 +01:00
Sim4n6
9a60202de6
Update python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.qhelp
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-12-06 14:40:35 +01:00
Sim4n6
c22c0b5029
Update python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.qhelp
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-12-06 14:39:16 +01:00
ALJI Mohamed
a5849eb9b0
Improved the additional taint step using InstanceSource
2022-12-06 14:00:08 +01:00
ALJI Mohamed
054c06be65
Update UnsafeUnpack.ql
2022-12-06 02:51:07 +01:00
Henry Mercer
5b040a9476
Python: Fix duplicate query IDs
2022-12-05 19:04:10 +00:00
ALJI Mohamed
68fd75ca34
UnpackUnsafe query and tests
2022-12-05 17:20:22 +01:00
Daniel Santos
feece6f7b4
Merge branch 'github:main' into main
2022-10-25 10:43:20 -05:00
Daniel Santos
5b080481aa
TokenBuiltFromUuid formatting
2022-10-25 09:51:48 -05:00
Daniel Santos
b8d60edb49
TokenBuiltFromUuid isAdditionalTaintStep refactor
2022-10-25 09:51:07 -05:00
Daniel Santos
375edf7455
TokenAssignmentValueSink refactor
2022-10-25 09:50:04 -05:00
Daniel Santos
5ab068a3cc
Update python/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql
...
Co-authored-by: Taus <tausbn@github.com >
2022-10-24 11:55:21 -05:00
Daniel Santos
be8780742b
Update python/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql
...
You are totally right! I just scanned the module's document and assumed it would implement it all. Pasting the documentation here for future reference https://docs.python.org/3/library/uuid.html?highlight=uuid#uuid.UUID .
Co-authored-by: Taus <tausbn@github.com >
2022-10-24 11:49:17 -05:00
Daniel Santos
a2ad924376
Minor formatting fixes
2022-10-24 09:38:17 -05:00
Daniel Santos
066ffb7520
Tokens built from predictable UUIDs
2022-10-22 11:15:43 -05:00
ALJI Mohamed
92a3846102
Fix query to omit sinks within std lib files
2022-10-22 09:35:55 +01:00
ALJI Mohamed
7319052495
Delete the examples/
2022-10-21 21:47:00 +01:00
Sim4n6
925f9d09e5
Update python/ql/src/experimental/Security/CWE-022bis/TarSlipImprov.ql
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-10-21 21:06:51 +01:00
ALJI Mohamed
9163cbec09
Restrict the reach for an additional taint step
2022-10-19 16:08:49 +01:00
ALJI Mohamed
25a7fcffc0
Add an additional taint step
2022-10-19 16:01:34 +01:00
ALJI Mohamed
d6fa745279
Add TarSlip Improv query
2022-10-19 14:01:40 +01:00
Josh Soref
ad7dc81bdc
spelling: sanitize
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:09 -04:00
Jeroen Ketema
d389a183f0
Merge pull request #10743 from jsoref/spelling
...
Spelling
2022-10-12 12:48:22 +02:00
erik-krogh
4da0508dae
Merge branch 'main' into py-last-msg
2022-10-11 10:49:19 +02:00
Josh Soref
704aba8c1c
spelling: necessitates
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 03:59:17 -04:00
erik-krogh
6fdfd40880
changes to address reviews
2022-10-07 22:31:00 +02:00
erik-krogh
944ca4a0da
fix some more style-guide violations in the alert-messages
2022-10-07 11:23:34 +02:00
Rasmus Wriedt Larsen
d7be27a1c0
Python: Fix experimental py/ip-address-spoofing
...
I realized the modeling was done in a non-recommended way, so I changed
the modeling. It was very nice that I could use API graphs for the flask
part, and a little sad when I couldn't for Django/Tornado.
2022-10-03 21:19:30 +02:00
Ahmed Farid
13d1a4fdc1
Update TimingAttackAgainstHeaderValue.ql
2022-08-31 12:46:17 +01:00
Ahmed Farid
f2688c4a02
Update select statement
2022-08-31 12:39:00 +01:00
Ahmed Farid
275ed0d6e5
Update select statement
2022-08-31 12:37:36 +01:00
Ahmed Farid
141b65fea8
Fix typo
2022-08-29 18:18:19 +01:00
Ahmed Farid
199e3d9462
Rename the query ID
2022-08-29 18:13:45 +01:00
Ahmed Farid
66fb420d00
Update PossibleTimingAttackAgainstHash.ql
2022-08-29 18:08:09 +01:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
Taus
bd45ea94d0
Python: Fix TimingAttackAgainstHash.ql select
2022-08-19 12:31:12 +00:00
Taus
3d17989107
Python: Fix broken select statement
...
Based on the alert description, "message" seemed like a suitable word to
use here.
2022-08-17 17:09:18 +00:00
Taus
76de2f4203
Python: Remove trailing newlines
...
These were causing the autoformatting check to fail. I'm not really sure
how these newlines got introduced. Possibly some editor option or
`git-commit` hook?
2022-08-17 15:12:51 +00:00
Ahmed Farid
313dbc9120
Autoformat PossibleTimingAttackAgainstSensitiveInfo.ql
2022-08-17 12:59:09 +01:00
Ahmed Farid
9f3de035c7
Autoformat PossibleTimingAttackAgainstHash.ql
2022-08-17 12:57:57 +01:00
Ahmed Farid
cb5331bdd8
Autoformat TimingAttackAgainstHeaderValue.ql
2022-08-17 12:54:34 +01:00
Ahmed Farid
a7dcf96f55
Autoformat TimingAttackAgainstSensitiveInfo.ql
2022-08-17 12:53:07 +01:00
erik-krogh
8066e39d07
delete some redundant imports
2022-08-17 13:50:04 +02:00
Ahmed Farid
9b4d1789b1
Autoformat TimingAttackAgainstHash.ql
2022-08-17 12:49:58 +01:00
Ahmed Farid
5daeea7aeb
Adjust the @id property
2022-08-17 12:24:40 +01:00
Ahmed Farid
01828936e2
fix qhelp
2022-08-17 12:19:44 +01:00
Ahmed Farid
10d5ab20f5
fix qhelp
2022-08-17 12:19:02 +01:00
Ahmed Farid
169d27951a
Update UnSafeComparisonOfSensitiveInfo.py
2022-08-15 15:19:13 +01:00
