Rasmus Wriedt Larsen
c70b32f7eb
Python: Require quote escaping for html.escape
2024-01-30 12:17:01 +01:00
Rasmus Wriedt Larsen
cbed6e861d
Python: Add html.escape as HTML sanitizer
2024-01-22 17:32:28 +01:00
Rasmus Wriedt Larsen
d056706af5
Merge pull request #14725 from RasmusWL/re-modeling
...
Python: Add taint-flow modeling for `re` module
2023-11-23 11:35:36 +01:00
Rasmus Wriedt Larsen
3d46129bbf
Python: Remove intermediary steps from taint-test
...
These were leftovers from old way of propagating taint
2023-11-23 10:40:25 +01:00
Rasmus Wriedt Larsen
71c017f053
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2023-11-21 10:07:42 +01:00
Rasmus Wriedt Larsen
25d3af9236
Merge branch 'main' into clean-tests
2023-11-16 11:21:01 +01:00
Rasmus Wriedt Larsen
55f5b26ba6
Python: Accept new ordering of query predicates in .expected
2023-11-15 10:09:54 +01:00
Rasmus Wriedt Larsen
e1c47f5584
Python: Reorganize taint tests of re
...
Mostly to highlight that with flow-summary modeling, we don't expect
taint for a lot of these.
I aslo opted to make `finditer()` tainted for consistency.
2023-11-13 10:56:29 +01:00
Rasmus Wriedt Larsen
4943fc5a57
Python: Model taint from re.<func> calls
2023-11-08 17:18:40 +01:00
Rasmus Wriedt Larsen
851c30e797
Python: Add taint modeling of re.Match objects
2023-11-08 17:18:09 +01:00
Rasmus Wriedt Larsen
ea4761d3b6
Python: Add tests of taint-flow for re module
2023-11-08 16:05:22 +01:00
amammad
6c8cc79b4d
v1
2023-10-08 21:24:54 +02:00
Peter Stöckli
7aa5d2dc8a
Python: move asyncio CMDi related tests to stdlib tests
2023-09-06 16:54:18 +02:00
Jeroen Ketema
dba4460526
Python: Update more inline expectation tests to use the paramterized module
2023-06-20 10:16:15 +02:00
Rasmus Wriedt Larsen
2b4ebf7377
Python: Add support for .executescript
2023-03-22 15:20:06 +01:00
Rasmus Wriedt Larsen
5930499f1d
Python: Add test for missing .executescript SQL method
2023-03-22 14:57:08 +01:00
Rasmus Wriedt Larsen
4f9117963d
Python: Model sqlite3.dbapi2
2023-03-22 10:28:04 +01:00
erik-krogh
d001cc40d3
Merge branch 'main' into py-shell
2023-03-13 14:56:04 +01:00
Rasmus Wriedt Larsen
1c7fe97427
Python: Add modeling of hmac
2023-02-13 15:39:43 +01:00
Rasmus Wriedt Larsen
df22181963
Python: Add tests of hmac
2023-02-13 15:38:14 +01:00
erik-krogh
848b24cfe4
adjust concept tests after changing subprocess model
2023-02-03 14:47:55 +01:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
Anders Schack-Mulligen
a7c268f804
Python: adjust test.
2022-06-20 15:46:38 +02:00
Rasmus Wriedt Larsen
0d02ca07d7
Python: Add certificate disable test of urllib/urllib2
2022-06-08 17:41:45 +02:00
Rasmus Wriedt Larsen
5f01fc24e4
Merge branch 'main' into promote-xxe
2022-05-02 11:25:55 +02:00
Rasmus Wriedt Larsen
059dea713d
Python: Fix os.path.samefile modeling
2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen
7728b6cf1b
Python: Change XmlBomb vulnerability kind
2022-04-07 10:56:35 +02:00
Rasmus Wriedt Larsen
b4c0065aeb
Python: Extend FileSystemAccess for xml.sax and xml.dom.* parsing
2022-03-31 18:08:47 +02:00
Rasmus Wriedt Larsen
e11269715d
Python: Promote xml.sax and xml.dom.* modeling
2022-03-31 17:44:00 +02:00
Rasmus Wriedt Larsen
05bb0ef976
Python: Align xml.etree.ElementTree modeling
...
I didn't find a good way to actually share the stuff, so we kinda just
have 2 things that look very similar :|
2022-03-31 17:24:16 +02:00
Rasmus Wriedt Larsen
db43d043c4
Python: Add test showing misalignment of xml.etree modeling
2022-03-31 11:55:46 +02:00
Rasmus Wriedt Larsen
543454eff2
Python: Model file access from XML parsing
2022-03-31 11:47:29 +02:00
Rasmus Wriedt Larsen
64aa503cc3
Python: Promote xml.etree modeling
2022-03-31 11:12:02 +02:00
Rasmus Wriedt Larsen
769f5691d0
Python: Add taint for StringIO and BytesIO
2022-03-31 09:52:54 +02:00
haby0
7e6666bc63
Merge branch 'main' into py/add-ssrf-sinks
2022-03-07 12:09:14 +08:00
Rasmus Wriedt Larsen
02a97b08bb
Python: Move urllib and urllib2 to be part of stdlib modeling
2022-03-04 11:31:47 +01:00
yoff
d0a393e8d1
Update python/ql/test/library-tests/frameworks/stdlib/XPathExecution.py
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-03-04 10:56:53 +01:00
Rasmus Lerchedahl Petersen
80be767a7a
python: implement stdlib xpath support
2022-03-02 12:59:34 +01:00
Rasmus Lerchedahl Petersen
06e0f140c5
python: add tests for stdlib xpath
2022-03-02 12:58:37 +01:00
haby0
759ec31508
Delete shutil_path_injection.py file
2022-01-06 21:38:35 +08:00
haby0
05b0daa0b7
Add the test of shutil module in FileSystemAccess.py
2022-01-06 14:14:42 +08:00
Rasmus Wriedt Larsen
f8fc583af3
Python: client request: getUrl => getAUrlPart
...
I think `getUrl` is a bit too misleading, since from the name, I would
only ever expect ONE result for one request being made.
`getAUrlPart` captures that there could be multiple results, and that
they might not constitute a whole URl.
Which is the same naming I used when I tried to model this a long time ago
a80860cdc6/python/ql/lib/semmle/python/web/Http.qll (L102-L111)
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
6f81685f48
Python: Add modeling of http.client.HTTPResponse
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
a5bae30d81
Python: Add tests of http.client.HTTPResponse
2021-12-15 20:39:46 +01:00
Rasmus Wriedt Larsen
cbd7434a7e
Python: Add modeling of tempfile module
2021-11-29 15:08:36 +01:00
Rasmus Wriedt Larsen
b68538376c
Python: Add tests of tempfile module
2021-11-29 15:08:36 +01:00
Rasmus Wriedt Larsen
58f92764f7
Python: Model more file access from os module
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
e79b8f3e23
Python: Treat os.exec*, os.spawn*, and os.posix_spawn* as FileSystemAccess
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
d2d5cce787
Python: Recognize keyword arguments for os.*spawn* calls
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
14590436f9
Python: Expand tests for os.exec*, os.spawn*, and os.posix_spawn*
2021-11-29 14:54:02 +01:00
