Dave Bartolomeo
311ba8ea1b
Merge from main to resolve conflicts
2024-03-19 10:41:31 -04:00
yoff
f025430431
Merge pull request #15319 from Sim4n6/main
...
[Python] Add Unicode DoS (qhelp, tests and the query)
2024-03-19 10:00:30 +01:00
yoff
44ab36f238
Merge pull request #15729 from yoff/python/hardcoded-credentials-without-pointsto
...
python: Rewrite `HardcodedCredentials` away from `PointsTo`
2024-03-18 20:48:30 +01:00
github-actions[bot]
0a6243d07b
Release preparation for version 2.16.5
2024-03-18 10:14:07 +00:00
Sim4n6
26a16b7857
use of a single var "op" of type Cmpop
2024-03-15 14:17:23 +01:00
Sim4n6
a717bf1b9d
Fix p tag in UnicodeDoS.qhelp
2024-03-15 14:17:23 +01:00
Sim4n6
af19a0342e
Fix UnicodeDoS vulnerability in CWE-770 code
2024-03-15 14:17:23 +01:00
Sim4n6
085d803b14
Fix UnicodeDoS vulnerability in CWE-770
2024-03-15 14:17:23 +01:00
Sim4n6
31dc542111
Update request parameter name in good_1() function
2024-03-15 14:17:23 +01:00
Sim4n6
70ebc58b4c
Refactor Unicode normalization code
2024-03-15 14:17:23 +01:00
Sim4n6${{7*'7'}}
658b88e62f
Update python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql
...
update the Config API
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-03-15 14:17:23 +01:00
Sim4n6
1f767b887e
Add some comments and docs
2024-03-15 14:17:23 +01:00
Sim4n6
5cc9170249
Add UnicodeDoS sink for werkzeug secure_filename
2024-03-15 14:17:23 +01:00
Sim4n6
342465057c
Add Unicode DoS (CWE-770)
2024-03-15 14:17:23 +01:00
github-actions[bot]
dc9092c9ec
Post-release preparation for codeql-cli-2.16.4
2024-03-06 22:19:33 +00:00
github-actions[bot]
2f058ffb4d
Release preparation for version 2.16.4
2024-03-06 20:56:51 +00:00
Angela P Wen
ce31f8641a
Revert "Release preparation for version 2.16.4"
2024-03-06 12:07:33 -08:00
github-actions[bot]
661e68dab5
Release preparation for version 2.16.4
2024-03-05 18:13:58 +00:00
Angela P Wen
967963a653
Revert "Release preparation for version 2.16.4"
2024-03-05 08:53:33 -08:00
github-actions[bot]
a67218a027
Release preparation for version 2.16.4
2024-03-04 17:42:08 +00:00
Rasmus Wriedt Larsen
fbf6727809
Python: Add change-note
2024-03-04 11:46:38 +01:00
Rasmus Lerchedahl Petersen
3eb9491cb4
python: rewrite HardcodedCredentials away from PointsTo
...
- `ModuleValue.attr` and `ClassValue.lookup` are approximated by `Function.getName`
- `ClassValue.getName` is apprximated by `Class.getName`
- `Module::named` is approximated by `Module.getName`
- `Value::named` is approximated by `Builtins::likelyBuiltin`
- `FunctionValue.getNamedArgumentForCall` is approximated by `ArgumentNode.argumentOf`
2024-02-26 17:18:40 +01:00
Rasmus Wriedt Larsen
1cfac50749
Python: Add precision to NoSQL query
...
Due to this, it was not part of any query suite :O
2024-02-26 11:23:43 +01:00
github-actions[bot]
37f8fa3413
Post-release preparation for codeql-cli-2.16.3
2024-02-20 16:50:47 +00:00
github-actions[bot]
6d061fbc35
Release preparation for version 2.16.3
2024-02-20 14:26:23 +00:00
amammad
09d8a75844
Fix QLDoc issues
2024-02-14 23:31:22 +04:00
Rasmus Wriedt Larsen
eb401a205d
Python: Fix test exclusion for stdlib Python 3.12
2024-02-14 16:53:19 +01:00
Rasmus Wriedt Larsen
e5bd633028
Python: Change name/id to Decompression Bomb
...
The old title/id matches how we used to write queries, but I think just
using the normal conversational name is easier for everyone :)
2024-02-14 14:54:25 +01:00
Rasmus Wriedt Larsen
69c8ef9898
Python: Use dataflow instead of taint-tracking
2024-02-14 14:52:37 +01:00
Rasmus Wriedt Larsen
ba7dd38fc9
Python: Delete duplicated file
2024-02-14 14:48:37 +01:00
Rasmus Wriedt Larsen
9ae3ea81ff
Python: Remove spurious results in stdlib
2024-02-14 14:47:28 +01:00
Rasmus Wriedt Larsen
d8fd457310
Python: Use helper predicate
...
Since the helper predicate had nice qldocs
2024-02-14 14:47:28 +01:00
Rasmus Wriedt Larsen
e7772f1062
Python: Use Unit class
2024-02-14 14:47:28 +01:00
Rasmus Wriedt Larsen
9399258e3b
Merge branch 'main' into amammad-python-bombs
2024-02-14 13:37:59 +01:00
github-actions[bot]
b5139078d0
Post-release preparation for codeql-cli-2.16.2
2024-02-06 19:22:35 +00:00
github-actions[bot]
c1b35fbf47
Release preparation for version 2.16.2
2024-02-05 17:58:57 +00:00
Sid Shankar
b1d7a635f5
Renames diagnostic query files and tests
...
This commit renames the files relating to the diagnostic query that produces information on the number of files extracted. The files have been renamed from "SuccessfullExtractedFiles.*" to "ExtractedFiles.*". All related tests and test files have been renamed too.
The `@tags` and `@id` attributes of the queries have been left untouched, consistent with the `@tags` and `@id` for similar queries in other languages.
2024-01-29 20:19:20 +00:00
Henry Mercer
10343dd822
Merge pull request #15416 from github/post-release-prep/codeql-cli-2.16.1
...
Post-release preparation for codeql-cli-2.16.1
2024-01-25 14:15:25 +00:00
yoff
930f1b50b9
Merge pull request #15397 from github/tausbn/python-fix-deepcopy-mutable-default-fp
...
Python: Fix `deepcopy` mutable default FP
2024-01-25 10:32:58 +01:00
github-actions[bot]
d0b74c00fe
Post-release preparation for codeql-cli-2.16.1
2024-01-23 23:02:29 +00:00
github-actions[bot]
7ef611e6dc
Release preparation for version 2.16.1
2024-01-23 19:45:16 +00:00
Erik Krogh Kristensen
f1d6f56621
Merge pull request #15393 from erik-krogh/deps-jan-2024
...
All: delete outdated deprecations
2024-01-23 13:52:38 +01:00
Taus
d6d59377d3
Python: Fix flow through deepcopy
...
Or, more generally, any copy step, as these presumably do not preserve
object identity.
(Arguably, `copy` could still be susceptible to interior mutability, but
I think that's outside the scope of this query anyway.)
2024-01-22 15:40:30 +00:00
Taus
14c958ac4d
Python: Remove mutable default sources from inside stdlib
2024-01-22 15:23:52 +00:00
Max Schaefer
a4639c7ff9
Update qhelp to mention solution using urlparse.
2024-01-22 13:36:12 +00:00
Max Schaefer
98178458d0
Python: Add support for more URL redirect sanitisers.
...
Since some sanitisers don't handle backslashes correctly, I updated the data-flow configuration to incorporate a flow state tracking whether or not backslashes have been eliminated or converted to forward slashes.
2024-01-22 13:24:18 +00:00
erik-krogh
8be7eadace
delete outdated deprecations
2024-01-22 09:11:35 +01:00
Sid Shankar
59098be8c4
Merge branch 'main' into change/adjust-extracted-files-diagnostics
2024-01-16 21:51:41 -05:00
Alexander Eyers-Taylor
934474681d
Merge pull request #15254 from github/post-release-prep/codeql-cli-2.16.0
...
Post-release preparation for codeql-cli-2.16.0
2024-01-16 14:50:40 +00:00
github-actions[bot]
57df8b92df
Post-release preparation for codeql-cli-2.16.0
2024-01-15 15:00:50 +00:00
