Taus
7176898503
Python: Fix library tests
2025-11-26 12:30:31 +00:00
Taus
b3b87c968b
Python: Fix extractor/experimental tests
2025-11-26 12:30:31 +00:00
Taus
665104e626
Python: Fix Python 3 tests
2025-11-26 12:30:31 +00:00
Taus
85029bd77d
Python: Fix Python 2 tests
2025-11-26 12:30:30 +00:00
Taus
5b63b4957c
Python: Fix query tests
...
Mostly just adding `private import LegacyPointsTo`. Sometimes getting
rid of other imports that are superceded by that module.
2025-11-26 12:30:30 +00:00
Taus
2732a652ab
Python: Fix example snippets
...
One might argue that these should be rewritten entirely to use more
modern APIs, but for now I'll be content with just having them compile
properly.
2025-11-26 12:30:30 +00:00
Taus
0a4ec2ca10
Python: Move some non-points-to methods out of points-to
...
These methods were in `pointsto.Base` but did not actually interact with
the points-to machinery directly, so they were easy to move out.
2025-11-26 12:30:30 +00:00
Taus
f0465f441f
Python: Get rid of some get...Object methods
...
This frees `Class.qll`, `Exprs.qll`, and `Function.qll` from the
clutches of points-to. For the somewhat complicated setup with
`getLiteralObject` (an abstract method), I opted for a slightly ugly but
workable solution of just defining a predicate on `ImmutableLiteral`
that inlines each predicate body, special-cased to the specific instance
to which it applies.
2025-11-26 12:30:30 +00:00
Taus
78c33ab55a
Python: Remove points-to references from python.qll
...
For now, these have just been made into `private` imports. After doing
this, I went through all of the (now not compiling) files and added in
private imports to the modules that they actually depended on.
I also added an explicit import of `LegacyPointsTo` (even though it may
be unnecessary) in cases where the points-to dependency was somewhat
surprising (and one we want to get rid of). This was primarily inside
the various SSA layers.
For modules inside `semmle.python.{types, objects, pointsto}` I did not
bother, as these are fairly clearly related to points-to.
2025-11-26 12:30:30 +00:00
Joe Farebrother
8d313ff85b
qldoc fixes
2025-11-26 11:23:04 +00:00
Joe Farebrother
6207137ef0
Add changenote
2025-11-26 11:21:05 +00:00
Joe Farebrother
eb7fe71557
Fix namespace instances and update tests
2025-11-26 10:51:16 +00:00
Asger F
dbf14c190a
Factor XML discard predicates into OverlayXml.qll
2025-11-26 11:48:32 +01:00
Joe Farebrother
83eadbad60
Add namespace models
2025-11-25 16:56:36 +00:00
Joe Farebrother
b0be8184ac
Add taint test
2025-11-24 16:54:21 +00:00
Joe Farebrother
dada49f402
Fix qldoc and tests
2025-11-24 13:57:43 +00:00
Joe Farebrother
a83c70f99d
Add tests
2025-11-24 11:03:16 +00:00
Joe Farebrother
9c3f4e2bfb
Add changenote
2025-11-20 10:59:05 +00:00
Joe Farebrother
cdc44c3267
Model tornado websockets
2025-11-20 10:49:30 +00:00
Joe Farebrother
ba06990290
Add socketio models
2025-11-20 10:47:41 +00:00
Asger F
613895e0c0
Merge pull request #20424 from asgerf/js/overlay-manual-v4
...
JS: Add overlay annotations
2025-11-20 11:10:46 +01:00
github-actions[bot]
5ee45af3aa
Post-release preparation for codeql-cli-2.23.6
2025-11-18 09:53:12 +00:00
github-actions[bot]
18fa6799ce
Release preparation for version 2.23.6
2025-11-17 16:38:07 +00:00
Asger F
ecfa94600f
Sync ApiGraphModels.qll
2025-11-13 09:46:23 +01:00
Asger F
16e7dc1b8a
Sync ApiGraphModelsExtensions.qll
2025-11-13 09:46:21 +01:00
Napalys Klicius
d122534398
Merge pull request #20671 from github/napalys/adjust_query_severity
...
Adjust query severity ratings
2025-11-11 12:37:31 +01:00
Michael B. Gale
046db0419f
Merge pull request #20758 from github/post-release-prep/codeql-cli-2.23.4
...
Post-release preparation for codeql-cli-2.23.4
2025-11-05 10:45:51 +00:00
github-actions[bot]
4014df9a6e
Post-release preparation for codeql-cli-2.23.4
2025-11-04 17:57:52 +00:00
github-actions[bot]
64fcdd1f2f
Release preparation for version 2.23.4
2025-11-03 14:52:23 +00:00
Taus
e702d3bfc8
Python: Add change note
...
I wasn't entirely sure if this should be classified as `deprecated` or
`breaking`, but seeing as these changes technically _could_ break
existing queries (requiring a small rewrite), I opted for the latter.
2025-10-30 15:16:51 +00:00
Taus
820d8e76c4
Python: Remove points-to from Module
2025-10-30 13:59:30 +00:00
Taus
b93ce98612
Python: Remove points-to from Expr
2025-10-30 13:58:59 +00:00
Taus
b434ce460e
Python: Get rid of getLiteralValue
...
This had only two uses in our libraries, so I simply inlined the
predicate body in both places.
2025-10-30 13:30:04 +00:00
Taus
fef08afff9
Python: Remove points-to to from ControlFlowNode
...
Moves the existing points-to predicates to the newly added class
`ControlFlowNodeWithPointsTo` which resides in the `LegacyPointsTo`
module.
(Existing code that uses these predicates should import this module, and
references to `ControlFlowNode` should be changed to
`ControlFlowNodeWithPointsTo`.)
Also updates all existing points-to based code to do just this.
2025-10-30 13:30:04 +00:00
Nora Dimitrijević
1ff24cbee8
Python/LdapInsecureAuth
...
python/ql/src/experimental/Security/CWE-522/LdapInsecureAuth.ql
2025-10-28 09:40:35 +01:00
Nora Dimitrijević
998de144ea
Python/CorsBypass
2025-10-28 09:40:32 +01:00
Nora Dimitrijević
4bc9ede2e8
Python/UnsafeUsageOfClientSideEncryptionVersion
2025-10-28 09:40:30 +01:00
Nora Dimitrijević
6d57316862
Python/UnsafeUnpackQuery
...
python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.ql
2025-10-28 09:40:27 +01:00
Nora Dimitrijević
37fff48dcd
Python/ServerSideRequestForgeryQuery
...
python/ql/src/Security/CWE-918/PartialServerSideRequestForgery.ql
2025-10-28 09:40:24 +01:00
Nora Dimitrijević
baccdcc07f
Python/PolynomialReDoSQuery
...
python/ql/src/Security/CWE-730/PolynomialReDoS.ql
2025-10-28 09:40:21 +01:00
Joe Farebrother
8c277bd1d9
Merge pull request #20494 from joefarebrother/python-insecure-cookie-split
...
Python: Split Insecure Cookie query into multiple queries
2025-10-24 11:10:20 +01:00
Napalys Klicius
9c70ae04fb
Add change note
2025-10-22 11:48:16 +00:00
Napalys Klicius
fa47174013
CWE-020: Lower security-severity for OverlyLargeRange queries to 4.0
2025-10-22 11:32:33 +00:00
Owen Mansel-Chan
66f95bcbcd
Merge pull request #20603 from owen-mc/update-broken-algo-qhelp
...
Many languages: Update broken algo qhelp
2025-10-17 12:30:43 +01:00
Nora Dimitrijević
e120e5c3ba
Merge pull request #20337 from d10c/d10c/python-overlay-compilation-plus-extractor
...
Python: enable overlay compilation + extractor overlay support
2025-10-16 14:49:01 +02:00
github-actions[bot]
6dd07790ac
Post-release preparation for codeql-cli-2.23.3
2025-10-14 11:16:33 +00:00
Henry Mercer
b737bccb07
Python: Fix "be be" typos in qhelp
2025-10-14 11:33:24 +01:00
github-actions[bot]
33542f7d40
Release preparation for version 2.23.3
2025-10-14 09:30:24 +00:00
Taus
c4b27d5f28
Python: Fix ImportError in imp.py under Python 3.14
...
It seems `_ERR_MSG` was silently removed in Python 3.14, leading to an
`ImportError` when running the extractor.
To fix this, we explicitly set `_ERR_MSG` when the existing import fails
(using `_ERR_MSG_PREFIX` which is available in Python 3.14+, along with
the bits that make up the difference between this and `_ERR_MSG`).
2025-10-13 13:50:43 +00:00
Owen Mansel-Chan
2f22acdd06
Remove hashing example when not covered by query
2025-10-08 16:48:57 +01:00
