REDMOND\brodes
97ddab0724
Added support for new URIValidator in AntiSSRF library. Updated test caes to use postprocessing results. Currently results for partial ssrf still need work, it is flagging cases where the URL is fully controlled, but is sanitized. I'm not sure if this should be flagged yet.
2026-02-06 11:20:11 -05:00
REDMOND\brodes
27e19813be
Removing an upstream change log, not needed for local fork update.
2026-02-06 11:20:10 -05:00
REDMOND\brodes
88adb05d4b
Adjusting acryonym for SSRF for casing standards.
2026-02-06 11:20:08 -05:00
REDMOND\brodes
265922d2e5
Adding docs.
2026-02-06 11:20:01 -05:00
REDMOND\brodes
7db97799c1
Moved change log to correct location.
2026-02-06 11:19:22 -05:00
Ben Rodes
08b72d0a86
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 11:18:51 -05:00
Ben Rodes
46a2a249f9
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 11:18:49 -05:00
REDMOND\brodes
b8ba905253
Added change logs.
2026-02-06 11:18:23 -05:00
REDMOND\brodes
9912aaaf1a
Adding azure sdk test cases and updated test expected file.
2026-02-06 11:18:16 -05:00
REDMOND\brodes
8459eec239
Moving the SsrfSink concept into Concepts.qll, and renaming to HttpClientRequestFromModel as suggested in PR review.
2026-02-06 09:26:49 -05:00
Ben Rodes
ac1987f264
Update python/ql/lib/change-notes/2025-09-30-azure_ssrf_models.md
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2026-02-05 15:44:44 -05:00
REDMOND\brodes
0a88425170
Python: Altering SSRF MaD to use 'request-forgery' tag. Update to test cases expected results, off by one line. Changed to using ModelOutput::sinkNode.
2026-02-04 09:04:22 -05:00
Ben Rodes
cd73dcfb04
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-04 08:55:38 -05:00
Owen Mansel-Chan
3f08ff88a4
Pretty print models in test
...
Otherwise the tests breaks when unrelated changes are made because the
model numbers change
2026-02-04 10:52:44 +00:00
github-actions[bot]
73d06f26cb
Post-release preparation for codeql-cli-2.24.1
2026-02-02 14:04:26 +00:00
Ben Rodes
7ddfa80399
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-02 09:00:35 -05:00
github-actions[bot]
0db542e9f0
Release preparation for version 2.24.1
2026-02-02 12:09:09 +00:00
Owen Mansel-Chan
5204255615
Merge pull request #21234 from owen-mc/python/convert-sanitizers-to-mad
...
Python: Allow models-as-data sanitizers
2026-01-30 14:28:39 +00:00
Owen Mansel-Chan
0222159df5
Specify vulnerable args instead of safe ones
2026-01-30 14:10:03 +00:00
yoff
8c0baefd3b
Merge pull request #21141 from mbaluda/prompt-injection
...
Python: Prompt injection in OpenAI clients
2026-01-30 12:55:56 +01:00
Owen Mansel-Chan
a3885cd8b2
Replace sanitizer by exclusion from sink definition
2026-01-30 09:28:02 +00:00
Owen Mansel-Chan
b4cb2c3f13
Make qldoc slightly more specific
2026-01-30 09:28:01 +00:00
Owen Mansel-Chan
ef6332c581
Allow MaD sanitizers for queries with MaD sinks
2026-01-30 09:27:59 +00:00
Owen Mansel-Chan
ad6f800022
Pretty print model numbers in tests
2026-01-30 09:21:24 +00:00
yoff
e7a0fc7140
python: Add query for prompt injection
...
This pull request introduces a new CodeQL query for detecting prompt injection vulnerabilities in Python code targeting AI prompting APIs such as agents and openai. The changes includes a new experimental query, new taint flow and type models, a customizable dataflow configuration, documentation, and comprehensive test coverage.
2026-01-29 23:47:52 +01:00
Jon Janego
e54d7c7c73
Update CHANGELOG.md
2026-01-29 16:20:25 -06:00
Jon Janego
813d4639ca
Fix typo in taint flow model for urllib.parse
2026-01-29 16:18:21 -06:00
Taus
34800d1519
Merge pull request #20945 from joefarebrother/python-websockets
...
Python: Model remote flow sources for the `websockets` library
2026-01-29 15:47:46 +01:00
Tom Hvitved
b974a84bef
Merge pull request #21051 from hvitved/shared/flow-summary-provenance-filtering
...
Shared: Provenance-based filtering of flow summaries
2026-01-26 17:24:34 +01:00
Tom Hvitved
0f6bae0ae1
Add change notes
2026-01-26 12:40:22 +01:00
Tom Hvitved
0adece7cde
Python: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:19 +01:00
yoff
55abc52c61
python: format file
2026-01-22 20:51:46 +01:00
yoff
d05901ad3f
python/javascript/ruby: mark internal predicates
2026-01-22 17:30:24 +01:00
yoff
7f00a7f67e
Update python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2026-01-22 17:30:24 +01:00
yoff
3dbfb9fa4b
python: add machinery for MaD barriers
...
and reinstate previously removed barrier
now as a MaD row
2026-01-22 17:30:24 +01:00
yoff
699ed50432
python: remove barrier that can be expressed in MaD
2026-01-22 17:30:24 +01:00
Taus
5414bd2716
Merge pull request #21134 from yoff/python/support-ListElement-in-MaD
...
Python support `ListElement` in MaD
2026-01-20 23:38:02 +01:00
yoff
fa926456ef
python: add changenote
2026-01-20 18:16:03 +01:00
Ian Lynagh
82e9ea2da0
python: Add up/downgrade scripts
2026-01-20 11:56:16 +00:00
Ian Lynagh
d2da49220b
python: Regenerate dbscheme
2026-01-20 11:56:15 +00:00
Ian Lynagh
d1175276ca
python: Use more standard shared dbscheme sections
...
We now use the shared "Overlay support" and "Database metadata".
2026-01-20 11:56:13 +00:00
Ian Lynagh
d125e224ac
python: Add dbscheme regeneration instructions
2026-01-20 11:56:13 +00:00
github-actions[bot]
48475e66af
Post-release preparation for codeql-cli-2.24.0
2026-01-19 15:49:08 +00:00
github-actions[bot]
4142b9c4ce
Release preparation for version 2.24.0
2026-01-19 14:49:14 +00:00
Asger F
ff580410fe
Merge pull request #20733 from asgerf/js/incremental-api-graphs
...
JS: Incremental API graph
2026-01-14 12:49:41 +01:00
yoff
6c4a0bb52b
Merge pull request #20990 from github/tausbn/python-support-relaxed-exception-groups
...
Python: Add support for PEP-758 exception syntax
2026-01-13 19:04:27 +01:00
Ian Lynagh
dcd0a69759
Merge remote-tracking branch 'upstream/main' into igfoo/mb
2026-01-13 01:01:35 +00:00
Taus
8c90c113c2
Update change note to reflect Python 2 changes
2026-01-12 15:27:38 +00:00
Taus
659ec3999b
Mark generated files as generated
2026-01-12 15:24:01 +00:00
Chris Smowton
44089d84a3
Merge pull request #21102 from github/smowton/admin/respect-config-paths-filters-pre-finalize
...
All languages: account for paths and paths-ignore in XML and other ancillary extraction
2026-01-09 16:23:26 +00:00
