Mathias Vorreiter Pedersen
09ba9a74ce
Merge pull request #12959 from MathiasVP/identity-consistency-check
...
DataFlow: Add an "identity-step" consistency check
2023-05-05 10:03:20 +01:00
Kasper Svendsen
d9f29a85d6
Python: Enable implicit this warnings
2023-05-04 10:16:52 +02:00
Mathias Vorreiter Pedersen
77001a070b
Merge branch 'main' into identity-consistency-check
2023-05-03 22:01:06 +01:00
Mathias Vorreiter Pedersen
e650df810d
Python: Accept consistency changes.
2023-05-03 20:33:00 +01:00
yoff
a905917123
Merge pull request #12937 from RasmusWL/fix-module-variable-node
...
Python: Hide `ModuleVariableNode` in data-flow paths
2023-05-03 17:58:26 +02:00
yoff
0bc6f10a71
Merge pull request #12220 from amammad/amammad-python-paramiko
...
add some python sinks for paramiko ssh clients
2023-05-01 11:38:50 +02:00
Rasmus Wriedt Larsen
1bba5258d6
Merge pull request #11280 from RasmusWL/dict-dataflow-steps
...
Python: Support more dictionary read/store steps
2023-04-30 16:07:29 +02:00
Rasmus Wriedt Larsen
aa216e6535
Python: Update inline expectations
2023-04-27 12:04:05 +02:00
Rasmus Wriedt Larsen
d73289ac4e
Python: Accept .expected changes
2023-04-27 11:54:39 +02:00
amammad
1bf159e9a9
Merge branch 'github:main' into amammad-python-paramiko
2023-04-26 23:28:29 -07:00
Arthur Baars
128d102bbc
Merge pull request #12871 from aibaars/py-yaml
...
Python: add YAML support
2023-04-26 18:13:26 +02:00
Rasmus Wriedt Larsen
abc1d658e0
Python: More .expected accepting
2023-04-26 14:10:13 +02:00
Arthur Baars
5b6d3afd89
Python: Yaml printAst and tests
2023-04-26 13:41:57 +02:00
Rasmus Wriedt Larsen
b178c9cfe6
Python: Accept dataflow/basic/*.expected
2023-04-26 13:30:11 +02:00
Rasmus Wriedt Larsen
3f39648065
Python: Remove duplicated test
2023-04-26 13:30:11 +02:00
Rasmus Wriedt Larsen
1a97e8f329
Python: Add flow-step for arg[1] to dict.setdefault
2023-04-26 13:30:11 +02:00
yoff
b35637e1c5
Merge pull request #12858 from RasmusWL/paramiko-modeling
...
Python: Expand modeling of `paramiko`
2023-04-25 14:04:50 +02:00
Rasmus Wriedt Larsen
7453533ba4
Python: Expand setdefault tests
2023-04-24 12:29:58 +02:00
Rasmus Wriedt Larsen
7fa84a3613
Python: Only test UnsafeUnpacking with Python 3
...
Apparently the fixup of .expected in the latest commit was only required
when extracting as Python 3, but not as Python 2... I honestly don't
understand why.
2023-04-24 12:29:58 +02:00
Rasmus Wriedt Larsen
b60cab254a
Python: Accept .expected change
2023-04-21 15:25:47 +02:00
Rasmus Wriedt Larsen
f80a0916ac
Python: Don't report get/setdefault as unresolved calls for dict tests
2023-04-21 14:42:20 +02:00
Rasmus Wriedt Larsen
b56869551d
Python: Support more dictionary read/store steps
...
The `setdefault` behavior is kinda strange, but no reason not to support
it.
2023-04-21 14:18:50 +02:00
Rasmus Wriedt Larsen
6e31f64aaa
Python: Add test for dictionary flow
2023-04-21 14:18:46 +02:00
Rasmus Wriedt Larsen
a168af349e
Python: Expand modeling of paramiko
2023-04-18 11:57:20 +02:00
Rasmus Wriedt Larsen
a5a0861be0
Python: Expand test of py/paramiko-missing-host-key-validation
2023-04-18 11:56:07 +02:00
Tom Hvitved
3cc9dec9c8
Remove all queries.xml files
2023-04-13 11:18:58 +02:00
Rasmus Wriedt Larsen
f3937a4a12
Python: Update .expected from PostUpdateNode commit
2023-03-30 10:17:33 +02:00
Raul Garcia
cf8a683d7d
Merge branch 'main' into main
2023-03-29 20:27:03 -07:00
Rasmus Wriedt Larsen
86333e3ba5
Python: Remove duplicate results from azure blob query
2023-03-29 11:47:29 +02:00
Rasmus Wriedt Larsen
32d52c023e
Python: Allow any order for azure blob query
...
By only allowing the sink in the state where encryption v1 is used, we
can handle the new case where the order of attribute assignment is
flipped.
However, we get a few too many paths because we can have multiple
sources reaching the same sink... let's fix in next commit.
2023-03-29 11:42:01 +02:00
Rasmus Wriedt Larsen
480f171d9b
Python: Add azure blob tests with swapped order
...
Just shows we need to use some state in the query to get the correct
behavior.
2023-03-29 11:25:37 +02:00
Rasmus Wriedt Larsen
683985a00a
Python: Expand azure blob modeling
...
Now we can differentiate between the classes
2023-03-29 11:24:36 +02:00
Rasmus Wriedt Larsen
8ea6b6f256
Python: Update py/azure-storage/unsafe-client-side-encryption-in-use to use datafow
2023-03-28 10:09:22 +02:00
Rasmus Wriedt Larsen
691ffcd3a4
Python: Add tests of py/azure-storage/unsafe-client-side-encryption-in-use
...
Notice that it doesn't find the potentially unsafe version, or the vuln that spans calls.
2023-03-28 10:05:09 +02:00
Taus
df192383b2
Merge pull request #9722 from ahmed-farid-dev/timing-attack-py
2023-03-27 18:09:35 +02:00
Rasmus Wriedt Larsen
0b9d16a43e
Merge pull request #12636 from RasmusWL/sql-modeling
...
Python: Some more SQL modeling
2023-03-27 15:52:30 +02:00
Taus
af060e8c6b
Merge branch 'main' into timing-attack-py
2023-03-27 15:27:13 +02:00
Erik Krogh Kristensen
d3c3f2dc90
Merge pull request #12628 from erik-krogh/betterReDoS
...
ReDoS: better super-linear algorithm
2023-03-27 15:26:49 +02:00
Taus
eaf2930205
Python: Accept test changes
...
(These look like they were the result of changes elsewhere in the
analysis.)
2023-03-27 12:17:13 +00:00
yoff
2121ed784f
Merge branch 'main' into python/rewrite-InsecureContextConfiguration
2023-03-27 10:20:53 +02:00
Taus
11c89adbe3
Merge branch 'main' into timing-attack-py
2023-03-24 15:40:33 +01:00
Taus
c0eb611dae
Merge pull request #12244 from RasmusWL/import-refined
...
Python: Fix import of refined variable
2023-03-24 13:22:19 +01:00
erik-krogh
e189b36e3f
materialize less strings when ranking states
2023-03-23 10:35:58 +01:00
Rasmus Wriedt Larsen
7b3f710e91
Python: Model aiosqlite
2023-03-22 15:51:47 +01:00
Rasmus Wriedt Larsen
2b4ebf7377
Python: Add support for .executescript
2023-03-22 15:20:06 +01:00
Rasmus Wriedt Larsen
5930499f1d
Python: Add test for missing .executescript SQL method
2023-03-22 14:57:08 +01:00
Rasmus Wriedt Larsen
170a93cc4f
Python: Model cassandra-driver PyPI package
2023-03-22 10:28:04 +01:00
Rasmus Wriedt Larsen
e4db5f9a64
Python: Model asyncpg.connection.connect()
2023-03-22 10:28:04 +01:00
Rasmus Wriedt Larsen
4f9117963d
Python: Model sqlite3.dbapi2
2023-03-22 10:28:04 +01:00
erik-krogh
b071d3557e
JS/PY/RB: add a worst-case test, that now performs OK
2023-03-22 10:13:18 +01:00
