Mathias Vorreiter Pedersen
103c589c1d
Update python/ql/lib/change-notes/released/0.3.0.md
2022-05-12 11:47:19 +01:00
Mathias Vorreiter Pedersen
499878a44d
Update python/ql/lib/CHANGELOG.md
2022-05-12 11:47:08 +01:00
Mathias Vorreiter Pedersen
43265c4133
Update python/ql/lib/change-notes/released/0.3.0.md
2022-05-12 11:43:39 +01:00
Mathias Vorreiter Pedersen
b069d1bd17
Update python/ql/lib/CHANGELOG.md
2022-05-12 11:43:33 +01:00
github-actions[bot]
ee9980b31c
Release preparation for version 2.9.2
2022-05-12 10:17:28 +00:00
Tom Hvitved
46ab25b61e
Merge pull request #9098 from aschackmull/dataflow/perf
...
Dataflow: Performance fixes
2022-05-11 20:41:48 +02:00
Nick Rolfe
e1b277386a
Fix non-US spellings: s/analyse/analyze
2022-05-11 17:48:27 +01:00
Anders Schack-Mulligen
4884520ee1
Dataflow: Review fix.
2022-05-11 15:40:49 +02:00
Rasmus Wriedt Larsen
044829c3bb
Python: Add @security-severity to py/pam-auth-bypass
...
The value 8.1 was calculated by our internal tool. This corresponds to a
'High' severity, which from my gut feeling seems reasonable for
authorization bypass.
2022-05-11 14:57:21 +02:00
Rasmus Wriedt Larsen
cff950f5f7
Python: Fix select of py/insecure-cookie
2022-05-11 14:06:30 +02:00
Rasmus Wriedt Larsen
0956d506de
Python: Actually promote py/pam-auth-bypass
...
🤦
2022-05-11 13:44:47 +02:00
Rasmus Wriedt Larsen
fc8633cc01
Python: Fix select for py/cookie-injection
2022-05-11 13:18:14 +02:00
Rasmus Wriedt Larsen
27b99c51e9
Python: Add placeholder precision for py/insecure-cookie
2022-05-11 11:36:06 +02:00
Rasmus Wriedt Larsen
a902d3d8f0
Python: Add security-severity for py/insecure-cookie
...
Matching the Java query
7d4767a4f5/java/ql/src/Security/CWE/CWE-614/InsecureCookie.ql (L7)
2022-05-11 11:34:16 +02:00
Rasmus Wriedt Larsen
84ad45c665
Python: Fix Django import
2022-05-11 11:33:35 +02:00
Rasmus Wriedt Larsen
d127d2164a
Merge branch 'main' into jorgectf/python/insecure-cookie
2022-05-11 11:13:47 +02:00
Erik Krogh Kristensen
f5329a3d1b
PY: fix ql/field-only-used-in-charpred warning
2022-05-11 09:54:55 +02:00
Erik Krogh Kristensen
94a9b3e873
fix all ql/counting-to-zero in some languages
2022-05-11 09:54:53 +02:00
Rasmus Wriedt Larsen
c890f9c4ac
Python: Fix change-note
2022-05-10 18:08:43 +02:00
Rasmus Wriedt Larsen
f68b281762
Python: Add change-note
2022-05-10 18:04:52 +02:00
Rasmus Wriedt Larsen
7e87e18b32
Python: Adjust name/description/select of PamAuthorization.ql
...
Thought that calling out the actual vulnerability would make things
easier for our end users :)
2022-05-10 18:02:17 +02:00
Rasmus Wriedt Larsen
c84f693151
Python: Adjust PamAuthorization examples
...
They did not have proper formatting (only 2 spaces), and I restructured
them a bit more so they look like code in the wild
2022-05-10 18:00:20 +02:00
Rasmus Wriedt Larsen
0c534444ad
Python: Format .qhelp file
...
99% of our .qhelp files have manually wrapped lines, so just wanted to
keep things consistent
2022-05-10 17:59:21 +02:00
Rasmus Wriedt Larsen
2b6e0cfb44
Merge pull request #8340 from yoff/python/simple-csrf
...
python: minimal CSRF implementation
2022-05-10 13:36:38 +02:00
Rasmus Wriedt Larsen
cb17e2a649
Merge pull request #8595 from porcupineyhairs/pypam
...
Python : Add query to detect PAM authorization bypass
2022-05-10 13:35:12 +02:00
Tom Hvitved
712fe002b9
Data flow: Sync files
2022-05-10 12:41:10 +02:00
Rasmus Lerchedahl Petersen
aa3d7babf4
python: fix bad merge
...
caused by an optimistic attempt at solving a
merge conflict in the online GUI.
2022-05-10 11:37:41 +02:00
Rasmus Wriedt Larsen
2421076d2f
Merge pull request #8696 from RasmusWL/new-nosql-examples
...
Python: Improve experimental modeling for `pymongo`
2022-05-10 11:03:05 +02:00
yoff
6c3e2db7fd
Merge branch 'main' into python/simple-csrf
2022-05-10 10:55:28 +02:00
Anders Schack-Mulligen
f85e06c2e4
Dataflow: Sync.
2022-05-10 10:12:39 +02:00
yoff
b6605bc330
Merge pull request #8634 from RasmusWL/promote-xxe
...
Python: Promote XXE and XML-bomb queries
2022-05-09 21:54:55 +02:00
Rasmus Lerchedahl Petersen
1c7e533144
python: format
2022-05-09 21:22:27 +02:00
Rasmus Lerchedahl Petersen
2a5908ff49
python: require all settings be vulnerable
...
at least all thos not in tests
2022-05-09 17:08:49 +02:00
Rasmus Wriedt Larsen
4a6789182d
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-05-09 16:37:12 +02:00
Anders Schack-Mulligen
f24364d951
Merge pull request #9045 from hvitved/dataflow/subpaths-perf-take2
...
Data flow: Speedup `subpaths` predicate (take 2)
2022-05-09 15:39:11 +02:00
Rasmus Wriedt Larsen
c218162104
Merge branch 'main' into pypam
2022-05-09 14:20:05 +02:00
Rasmus Wriedt Larsen
ab1252d196
Python: Add @precision high for py/pam-auth-bypass
2022-05-09 14:19:40 +02:00
Erik Krogh Kristensen
fc1ab06c1c
autoformat
2022-05-09 12:39:38 +02:00
Rasmus Wriedt Larsen
de05b108fa
Python: Fix singleton set
2022-05-09 11:01:13 +02:00
Rasmus Wriedt Larsen
36349222a9
Python: Fix casing of XMLDomParsing
2022-05-09 11:00:25 +02:00
Rasmus Wriedt Larsen
f22bd039f3
Python: Slight refactor of LxmlParsing
2022-05-09 10:56:39 +02:00
Rasmus Wriedt Larsen
f5854f33da
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-05-09 10:53:25 +02:00
Mathias Vorreiter Pedersen
176e40f139
Merge pull request #9052 from github/post-release-prep/codeql-cli-2.9.1
...
Post-release preparation for codeql-cli-2.9.1
2022-05-06 13:15:17 +01:00
github-actions[bot]
1a25457178
Post-release preparation for codeql-cli-2.9.1
2022-05-05 19:05:50 +00:00
Erik Krogh Kristensen
efe306733e
move path-injection MaD to PathInjectionCustomizations.qll
2022-05-05 16:51:39 +02:00
yoff
6169ac6122
Merge pull request #7776 from RasmusWL/django-filefield-uploadto
...
Python: Support Django FileField.upload_to
2022-05-05 14:25:08 +02:00
Rasmus Wriedt Larsen
dfe99b0b51
Python: Apply suggestions from code review
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2022-05-05 14:14:44 +02:00
Tom Hvitved
d9d5372f28
Data flow: Sync files
2022-05-05 13:36:26 +02:00
Rasmus Wriedt Larsen
0a589bed4e
Python: Add inline test of MaD sinks
...
This enables us to keep the framework modeling tests under `/frameworks`
folder
I had hoped to use `mad-sink[<kind>]` syntax, but that was not allowed
:(
Maybe it oculd be allowed in the future, but for now I'll stick with the
more ugly solution of `mad-sink__<kind>`
2022-05-05 13:11:43 +02:00
yoff
0c7184952b
Merge pull request #9023 from RasmusWL/positional-docs
...
Python: Clarify `getArg` is about positional arguments
2022-05-05 11:28:17 +02:00
