Ahmed Farid
85bcaa96ce
Update Concepts.qll
2022-03-01 00:23:06 +01:00
Ahmed Farid
c22b032bbe
Update Zip.qll
2022-03-01 00:11:33 +01:00
Ahmed Farid
67d3498891
Update ZipSlip.ql
2022-03-01 00:07:37 +01:00
Ahmed Farid
b29936716d
Update Frameworks.qll
2022-03-01 00:06:22 +01:00
Ahmed Farid
76bd3317eb
Create Zip.qll
2022-03-01 00:05:30 +01:00
Ahmed Farid
abe25da3df
Create ZipSlip.qll
2022-03-01 00:04:02 +01:00
Ahmed Farid
3eae13161f
Delete ZipSlipCheckLib.ql
2022-03-01 00:01:34 +01:00
Ahmed Farid
21f6ad5190
Update and rename ZipSlipCheck.ql to ZipSlip.ql
2022-03-01 00:01:06 +01:00
Ahmed Farid
c207294dfc
Update zipslip_good.py
2022-02-26 18:31:22 +01:00
Ahmed Farid
d0d14be693
Update ZipSlip.qhelp
2022-02-26 18:25:13 +01:00
root
5ed5e0b105
Add query to detect ZipSlip
2022-02-13 16:44:27 -05:00
Rasmus Wriedt Larsen
eb109828c0
Merge pull request #7252 from museljh/feature/cwe-338
...
Python: CWE-338 insecureRandomness
2022-02-07 19:30:06 +01:00
liangjinhuang
1dd15fa235
style:auto format
2022-02-02 01:30:54 +08:00
liangjinhuang
976e484c57
style:move all source files under src/experimental & feat:modify source regular matching rules
2022-02-02 01:14:51 +08:00
liangjinhuang
1885b683f7
style:formatDocument
2022-02-02 00:21:26 +08:00
museljh
012434b152
Update python/ql/src/experimental/Security/CWE-338/InsecureRandomness.ql
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-02-01 19:00:06 +08:00
museljh
a6002186bd
Update python/ql/src/experimental/Security/CWE-338/InsecureRandomness.ql
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-02-01 18:59:12 +08:00
Rasmus Wriedt Larsen
f7a0b17ed6
Merge pull request #7687 from yoff/python/PathInjection-FlowState
...
python: Rewrite path injection query to use flow state
2022-02-01 11:33:37 +01:00
Rasmus Lerchedahl Petersen
9aa4c4a6a7
python: Add missing input
...
also update test expectation
2022-01-21 13:55:33 +01:00
Rasmus Lerchedahl Petersen
35c9307baa
python: rewrite NoSQLInjection to use flow state
...
This allows a bit more precision. Specifically, we could
require the sanitizer to only affect `ConvertedToDict`.
In practice, most sanitizers woudl probably fail on raw
input also, though.
2022-01-21 12:12:58 +01:00
Rasmus Wriedt Larsen
93b3cd669a
Python: Cleanup: Remove old points-to versions of queries
...
Since we've internally agreed that we've reached the same or better set
of results.
2022-01-19 15:30:12 +01:00
Sam Partington
db7b3bc136
Remove experimental tag from non-ATM queries
2021-12-15 16:17:14 +00:00
liangjinhuang
d0ac11817e
add insecureRandomness
2021-11-28 20:47:06 +08:00
Erik Krogh Kristensen
6ff8d4de5c
add all remaining explicit this
2021-11-26 13:50:10 +01:00
Taus
8cccee6eba
Merge pull request #6972 from yoff/python/promote-redos
...
Python: Promote ReDoS queries
2021-11-23 14:02:09 +01:00
Taus
eed98bd76a
Merge pull request #5588 from jorgectf/jorgectf/python/jwt-queries
...
Python: Add JWT security-related queries
2021-11-16 15:40:45 +01:00
jorgectf
9ad8a85f4d
Delete redundant checks in verifiesSignature()
2021-11-16 15:08:18 +01:00
Jorge
a722631278
Apply suggestions from code review
...
Co-authored-by: Taus <tausbn@github.com >
2021-11-16 15:02:06 +01:00
Rasmus Wriedt Larsen
5c2734c643
Python: Fix experimental Django.qll
2021-11-02 10:55:44 +01:00
jorgectf
47b14f1adc
Polish Concepts.qll qldocs
2021-10-28 17:55:34 +02:00
jorgectf
b3ec82cd36
Merge branch 'jorgectf/python/jwt-queries' of https://github.com/jorgectf/codeql into jorgectf/python/jwt-queries
2021-10-28 17:40:33 +02:00
jorgectf
a6c285ad32
Apply getItem(_) and extend verifiesSignature readability
2021-10-28 17:40:27 +02:00
Jorge
f4d63cc5e7
Apply suggestions from code review
...
Co-authored-by: Taus <tausbn@github.com >
2021-10-28 17:34:11 +02:00
jorgectf
ef4a27ff8c
Apply code review suggestions
2021-10-28 17:31:52 +02:00
jorgectf
3dec222922
Merge remote-tracking branch 'origin/main' into jorgectf/python/jwt-queries
2021-10-28 13:11:46 +02:00
jorgectf
7069f45864
Polish documentation
2021-10-28 13:09:28 +02:00
jorgectf
350cbb4c5d
Polish qhelp and libraries
2021-10-27 18:47:19 +02:00
Rasmus Lerchedahl Petersen
fed6a97eb8
Python: Promote ReDoS queries
2021-10-27 11:03:57 +02:00
jorgectf
14c50e993b
Add django GET.get RFS
2021-10-16 13:10:48 +02:00
jorgectf
45146bc798
Merge branch 'main' into jorgectf/python/headerInjection
2021-10-16 12:46:57 +02:00
jorgectf
2db1ffef1e
Merge remote-tracking branch 'origin/main' into jorgectf/python/headerInjection
2021-10-16 10:40:52 +02:00
Rasmus Lerchedahl Petersen
61008fd3d0
Merge branch 'main' of github.com:github/codeql into python/promote-regex-injection
2021-10-12 11:28:12 +02:00
yoff
43f7eede0b
Merge pull request #6182 from haby0/python/LogInjection
...
Python: CWE-117 Log injection
2021-10-12 10:54:45 +02:00
haby0
d52f95d24d
Auto Formatting
2021-10-12 09:36:44 +08:00
yoff
0629ce00de
Merge pull request #6214 from haby0/python/ClientSuppliedIpUsedInSecurityCheck
...
[Python] CWE-348: Client supplied ip used in security check
2021-10-11 16:38:04 +02:00
haby0
538bf7c321
Update python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-10-07 19:44:25 +08:00
haby0
a17b0d4e5c
Modify Sanitizer
2021-10-05 17:12:04 +08:00
Rasmus Wriedt Larsen
547cbb6322
Merge pull request #6331 from porcupineyhairs/pythonXpath
...
Python : Improve Xpath Injection Query
2021-09-24 18:11:08 +02:00
Rasmus Wriedt Larsen
26d2fbd217
Python: Fix new XPath injection query
...
Fixes the typo `ETXpath` => `ETXPath`
2021-09-24 15:11:34 +02:00
Rasmus Wriedt Larsen
913a679ef5
Python: Replace old XPath injection query
2021-09-24 15:10:41 +02:00
