5468 Commits

Author	SHA1	Message	Date
Alex Ford	9f2c59cd6d	python: implement getBlockMode for CryptographicOperations	2022-05-13 16:32:36 +01:00
Anders Schack-Mulligen	8c8440a58a	Merge pull request #9101 from hvitved/dataflow/include-hidden ... Data flow: Add `Configuration::includeHiddenNodes()`	2022-05-12 15:36:12 +02:00
Joe Farebrother	59e400d2e0	Merge pull request #7723 from joefarebrother/redos ... Java: Add ReDoS queries	2022-05-12 13:50:38 +01:00
Rasmus Wriedt Larsen	7cd51d6147	Merge pull request #9126 from RasmusWL/moduleimport-with-dots ... Python: Fully disallow `API::moduleImport` of module with dots	2022-05-12 14:16:25 +02:00
Rasmus Wriedt Larsen	795adf0566	Python: Fix API::moduleImport("foo.bar")	2022-05-12 13:33:00 +02:00
Rasmus Wriedt Larsen	3844c5b5c0	Python: Add change-note	2022-05-12 13:32:59 +02:00
Rasmus Wriedt Larsen	f8253f5fef	Python: Fully disallow API::moduleImport of module with dots ... Inspired by discussion about this for MaD in https://github.com/github/codeql/pull/8883#discussion_r865858084	2022-05-12 13:30:26 +02:00
Rasmus Wriedt Larsen	597a8414d9	Python: Add test of API::moduleImport with dots ... This is currently semi-works -- the import is allowed, but doesn't always work when used :|	2022-05-12 13:29:16 +02:00
Nick Rolfe	234a36ff61	Merge pull request #9119 from github/nickrolfe/non-us-spelling-fixes ... Fix non-US spellings and the corresponding query	2022-05-12 12:29:14 +01:00
Tom Hvitved	46ab25b61e	Merge pull request #9098 from aschackmull/dataflow/perf ... Dataflow: Performance fixes	2022-05-11 20:41:48 +02:00
Nick Rolfe	e1b277386a	Fix non-US spellings: s/analyse/analyze	2022-05-11 17:48:27 +01:00
Anders Schack-Mulligen	4884520ee1	Dataflow: Review fix.	2022-05-11 15:40:49 +02:00
Rasmus Wriedt Larsen	cff950f5f7	Python: Fix select of py/insecure-cookie	2022-05-11 14:06:30 +02:00
Rasmus Wriedt Larsen	fc8633cc01	Python: Fix select for py/cookie-injection	2022-05-11 13:18:14 +02:00
Rasmus Wriedt Larsen	27b99c51e9	Python: Add placeholder precision for py/insecure-cookie	2022-05-11 11:36:06 +02:00
Rasmus Wriedt Larsen	a902d3d8f0	Python: Add security-severity for py/insecure-cookie ... Matching the Java query 7d4767a4f5/java/ql/src/Security/CWE/CWE-614/InsecureCookie.ql (L7)	2022-05-11 11:34:16 +02:00
Rasmus Wriedt Larsen	84ad45c665	Python: Fix Django import	2022-05-11 11:33:35 +02:00
Rasmus Wriedt Larsen	d127d2164a	Merge branch 'main' into jorgectf/python/insecure-cookie	2022-05-11 11:13:47 +02:00
Rasmus Wriedt Larsen	2b6e0cfb44	Merge pull request #8340 from yoff/python/simple-csrf ... python: minimal CSRF implementation	2022-05-10 13:36:38 +02:00
Rasmus Wriedt Larsen	cb17e2a649	Merge pull request #8595 from porcupineyhairs/pypam ... Python : Add query to detect PAM authorization bypass	2022-05-10 13:35:12 +02:00
Tom Hvitved	712fe002b9	Data flow: Sync files	2022-05-10 12:41:10 +02:00
Rasmus Lerchedahl Petersen	aa3d7babf4	python: fix bad merge ... caused by an optimistic attempt at solving a merge conflict in the online GUI.	2022-05-10 11:37:41 +02:00
Rasmus Wriedt Larsen	2421076d2f	Merge pull request #8696 from RasmusWL/new-nosql-examples ... Python: Improve experimental modeling for `pymongo`	2022-05-10 11:03:05 +02:00
yoff	6c3e2db7fd	Merge branch 'main' into python/simple-csrf	2022-05-10 10:55:28 +02:00
Anders Schack-Mulligen	f85e06c2e4	Dataflow: Sync.	2022-05-10 10:12:39 +02:00
yoff	b6605bc330	Merge pull request #8634 from RasmusWL/promote-xxe ... Python: Promote XXE and XML-bomb queries	2022-05-09 21:54:55 +02:00
Rasmus Lerchedahl Petersen	1c7e533144	python: format	2022-05-09 21:22:27 +02:00
Rasmus Lerchedahl Petersen	2a5908ff49	python: require all settings be vulnerable ... at least all thos not in tests	2022-05-09 17:08:49 +02:00
Rasmus Wriedt Larsen	4a6789182d	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2022-05-09 16:37:12 +02:00
Anders Schack-Mulligen	f24364d951	Merge pull request #9045 from hvitved/dataflow/subpaths-perf-take2 ... Data flow: Speedup `subpaths` predicate (take 2)	2022-05-09 15:39:11 +02:00
Rasmus Wriedt Larsen	c218162104	Merge branch 'main' into pypam	2022-05-09 14:20:05 +02:00
Rasmus Wriedt Larsen	ab1252d196	Python: Add @precision high for py/pam-auth-bypass	2022-05-09 14:19:40 +02:00
Rasmus Wriedt Larsen	de05b108fa	Python: Fix singleton set	2022-05-09 11:01:13 +02:00
Rasmus Wriedt Larsen	36349222a9	Python: Fix casing of XMLDomParsing	2022-05-09 11:00:25 +02:00
Rasmus Wriedt Larsen	f22bd039f3	Python: Slight refactor of LxmlParsing	2022-05-09 10:56:39 +02:00
Rasmus Wriedt Larsen	f5854f33da	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2022-05-09 10:53:25 +02:00
Mathias Vorreiter Pedersen	176e40f139	Merge pull request #9052 from github/post-release-prep/codeql-cli-2.9.1 ... Post-release preparation for codeql-cli-2.9.1	2022-05-06 13:15:17 +01:00
github-actions[bot]	1a25457178	Post-release preparation for codeql-cli-2.9.1	2022-05-05 19:05:50 +00:00
yoff	6169ac6122	Merge pull request #7776 from RasmusWL/django-filefield-uploadto ... Python: Support Django FileField.upload_to	2022-05-05 14:25:08 +02:00
Tom Hvitved	d9d5372f28	Data flow: Sync files	2022-05-05 13:36:26 +02:00
yoff	0c7184952b	Merge pull request #9023 from RasmusWL/positional-docs ... Python: Clarify `getArg` is about positional arguments	2022-05-05 11:28:17 +02:00
Tom Hvitved	66a9759329	Merge pull request #8870 from hvitved/dataflow/expect-content ... Data flow: Introduce `expectsContent`	2022-05-05 09:01:40 +02:00
Joe Farebrother	c1290d9e2b	Sync shared redos library files.	2022-05-04 15:41:38 +01:00
Joe Farebrother	0a5268aeb4	Sync shared library changes across languages.	2022-05-04 15:41:38 +01:00
Tom Hvitved	8e33653d25	Merge pull request #9017 from hvitved/dataflow/subpaths-perf ... Data flow: Speedup `subpaths` predicate	2022-05-04 16:37:52 +02:00
Tom Hvitved	9cb63c0a5e	Data flow: Sync files	2022-05-04 14:49:26 +02:00
Tom Hvitved	74e99302d6	Address review comments	2022-05-04 09:57:59 +02:00
Tom Hvitved	da72ba46d4	Data flow: Add stub expectsContent for all languages	2022-05-04 09:57:59 +02:00
Tom Hvitved	6e2e8440eb	Data flow: Sync files	2022-05-04 09:57:59 +02:00
Rasmus Wriedt Larsen	d012eaa892	Python: Clarify getArg is about positional arguments	2022-05-03 14:26:23 +02:00