Taus
665104e626
Python: Fix Python 3 tests
2025-11-26 12:30:31 +00:00
Taus
85029bd77d
Python: Fix Python 2 tests
2025-11-26 12:30:30 +00:00
Taus
f0465f441f
Python: Get rid of some get...Object methods
...
This frees `Class.qll`, `Exprs.qll`, and `Function.qll` from the
clutches of points-to. For the somewhat complicated setup with
`getLiteralObject` (an abstract method), I opted for a slightly ugly but
workable solution of just defining a predicate on `ImmutableLiteral`
that inlines each predicate body, special-cased to the specific instance
to which it applies.
2025-11-26 12:30:30 +00:00
Joe Farebrother
eb7fe71557
Fix namespace instances and update tests
2025-11-26 10:51:16 +00:00
Joe Farebrother
83eadbad60
Add namespace models
2025-11-25 16:56:36 +00:00
Joe Farebrother
b0be8184ac
Add taint test
2025-11-24 16:54:21 +00:00
Joe Farebrother
dada49f402
Fix qldoc and tests
2025-11-24 13:57:43 +00:00
Joe Farebrother
a83c70f99d
Add tests
2025-11-24 11:03:16 +00:00
Joe Farebrother
cdc44c3267
Model tornado websockets
2025-11-20 10:49:30 +00:00
Taus
820d8e76c4
Python: Remove points-to from Module
2025-10-30 13:59:30 +00:00
Taus
b93ce98612
Python: Remove points-to from Expr
2025-10-30 13:58:59 +00:00
Taus
fef08afff9
Python: Remove points-to to from ControlFlowNode
...
Moves the existing points-to predicates to the newly added class
`ControlFlowNodeWithPointsTo` which resides in the `LegacyPointsTo`
module.
(Existing code that uses these predicates should import this module, and
references to `ControlFlowNode` should be changed to
`ControlFlowNodeWithPointsTo`.)
Also updates all existing points-to based code to do just this.
2025-10-30 13:30:04 +00:00
Joe Farebrother
8c277bd1d9
Merge pull request #20494 from joefarebrother/python-insecure-cookie-split
...
Python: Split Insecure Cookie query into multiple queries
2025-10-24 11:10:20 +01:00
Nora Dimitrijević
9d7c52423a
Basic python overlay tests
...
The base source is in basic-overlay-eval/orig_src,
the overlay source is in basic-full-eval.
We run two tests: a full evaluation test in basic-full-eval,
and an overlay evaluation test in basic-overlay-eval.
The test source and expected results are the SAME,
due to the .qlref, meaning we expect the same results
for full and overlay evaluation.
2025-10-06 12:30:08 +02:00
Ben Rodes
d790c6df57
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-09-30 14:00:25 -04:00
Ben Rodes
fab96d9539
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-09-30 14:00:16 -04:00
REDMOND\brodes
704e2966cb
Adding azure sdk test cases and updated test expected file.
2025-09-30 13:32:56 -04:00
Taus
e592fd60ff
Merge pull request #20495 from github/tausbn/python-fix-unmatchable-dollar-in-lookahead
...
Python: Fix false positive for unmatchable dollar/caret
2025-09-25 15:27:32 +02:00
Joe Farebrother
cb7b1efe81
Update alert message
2025-09-25 09:52:27 +01:00
Joe Farebrother
9f5bfeb7f4
Update test output
2025-09-24 15:03:40 +01:00
Joe Farebrother
2cffb21604
Update and fix tests
2025-09-23 15:41:09 +01:00
Joe Farebrother
d28e8004fd
Add sensitive data heuristic
2025-09-23 10:08:08 +01:00
Joe Farebrother
463f79bed2
Merge pull request #20263 from joefarebrother/python-qual-exceptions
...
Python: Modernize the Unreachable Except Block query
2025-09-22 09:42:09 +01:00
Taus
b9f073e596
Python: Update test output
2025-09-19 15:39:12 +00:00
Taus
95a84ad655
Python: Fix false positive for unmatchable dollar/caret
...
Our previous modelling did not account for the fact that a lookahead can
potentially extend all the way to the end of the input (and similarly,
that a lookbehind can extend all the way to the beginning).
To fix this, I extended `firstPart` and `lastPart` to handle lookbehinds
and lookaheads correctly, and added some test cases (all of which yield
no new results).
Fixes #20429 .
2025-09-19 15:06:46 +00:00
Joe Farebrother
2e95c2b3c2
Split test cases for insecure cookie queries
2025-09-19 14:41:02 +01:00
Joe Farebrother
2cd1d2fd2f
Merge pull request #20392 from joefarebrother/python-qual-file-not-closed
...
Python: Improve File Not Closed query to reduce false positives and provide clearer alerts
2025-09-18 09:33:08 +01:00
Joe Farebrother
f3802ec60f
Merge pull request #20217 from joefarebrother/python-qual-signature-mismatch
...
Python: Modernize the Signature Mismatch query
2025-09-17 13:29:33 +01:00
Napalys Klicius
8393ccf39d
Python: Update globalVariableAttrPathAtDepth base case
2025-09-16 18:08:53 +02:00
Napalys Klicius
e60d0c88f1
Python: Add global variable nested field jump steps
2025-09-16 18:08:53 +02:00
Napalys Klicius
9d4b168977
Python: Added extra test for global variable nested attribute reads/writes.
2025-09-16 18:08:53 +02:00
Napalys Klicius
6c779c7fa5
Python: Added extra test cases for path injection with FastAPI
2025-09-16 18:08:53 +02:00
Napalys Klicius
f209e3a0fe
Python: Updated PathInjection tests to use inline test expectations
2025-09-16 18:08:53 +02:00
Joe Farebrother
ea562de3e6
Fix tests
2025-09-09 15:17:16 +01:00
Joe Farebrother
b01b40b51b
Update test output
2025-09-09 13:44:03 +01:00
Joe Farebrother
e382f7cd43
Improve check for containment in with statement
2025-09-09 11:26:17 +01:00
Joe Farebrother
869b7e09d7
Merge pull request #19932 from joefarebrother/python-qual-init-del-calls
...
Python: Modernize 4 queries for missing/multiple calls to init/del methods
2025-09-08 09:29:38 +01:00
Joe Farebrother
ff4c11f503
Update test output. Accepting some FNs due to dataflow issue.
2025-09-06 00:45:15 +01:00
Joe Farebrother
0b293eaba5
Update test output
2025-09-05 22:43:21 +01:00
Joe Farebrother
bd3fa7fb21
Switch to dataflow check for guards exceptions
...
This reduces some confusing FPs, though appears to introduce another
2025-09-05 16:03:55 +01:00
Arthur Baars
5d3ec35e29
Remove non-breaking spaces from code
2025-09-05 09:41:15 +02:00
Joe Farebrother
cd6a151d9b
Add missing predicate + update test output
2025-09-03 09:48:07 +01:00
Joe Farebrother
318d1cd392
Increase precision in detecting call matches signature
2025-09-02 12:02:08 +01:00
Joe Farebrother
502ea82c91
Updae other test output
2025-09-01 16:31:04 +01:00
Joe Farebrother
2bbf24b3ea
Add additional test cases
2025-09-01 16:30:53 +01:00
Joe Farebrother
f429b9038c
Update tests, update alert messages
2025-09-01 16:30:44 +01:00
Joe Farebrother
f7097136f1
Rank multiple calls so only the first 2 calls are alerted
2025-09-01 16:23:42 +01:00
Joe Farebrother
ba8658491a
Update qhelp + alert messages
2025-09-01 14:11:01 +01:00
Joe Farebrother
daa5525a10
Update tests and add an additional test
2025-09-01 14:10:55 +01:00
Joe Farebrother
9619ae8a2d
Add additional test case + update missing del tests
2025-09-01 14:10:47 +01:00
