REDMOND\brodes
9f9c353806
Update expected files. Copilot suggestions broke unit test expected results (column numbers).
2026-02-10 11:47:23 -05:00
REDMOND\brodes
4bb110beb8
More copilot suggestions.
2026-02-10 11:46:16 -05:00
REDMOND\brodes
a91cf6b7cb
Applying copilot PR suggestions.
2026-02-10 11:37:11 -05:00
Ben Rodes
9f8ed710e2
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-10 11:09:25 -05:00
REDMOND\brodes
23bab81855
Added change log
2026-02-09 13:22:35 -05:00
REDMOND\brodes
df54459552
Restore prior PR change log (accidentally removed)
2026-02-09 13:19:02 -05:00
Ben Rodes
85ae4045c5
Merge branch 'main' into azure_python_sanitizer_upstream2
2026-02-09 13:12:38 -05:00
yoff
5ad42f8bcc
Merge pull request #20563 from microsoft/azure_python_sdk_url_summary_upstream
...
Azure python sdk url summary upstream
2026-02-09 18:34:36 +01:00
REDMOND\brodes
f6c302b68c
Removing commented out test cases.
2026-02-06 11:28:48 -05:00
REDMOND\brodes
4f11913ee5
removing SSRFSink.qll
2026-02-06 11:23:58 -05:00
REDMOND\brodes
42f6e6a19c
Fixing inefficiently passed variable in nested existential quantification.
2026-02-06 11:20:15 -05:00
REDMOND\brodes
97f19d03ad
Updating test case expected alerts.
2026-02-06 11:20:13 -05:00
REDMOND\brodes
97ddab0724
Added support for new URIValidator in AntiSSRF library. Updated test caes to use postprocessing results. Currently results for partial ssrf still need work, it is flagging cases where the URL is fully controlled, but is sanitized. I'm not sure if this should be flagged yet.
2026-02-06 11:20:11 -05:00
REDMOND\brodes
27e19813be
Removing an upstream change log, not needed for local fork update.
2026-02-06 11:20:10 -05:00
REDMOND\brodes
88adb05d4b
Adjusting acryonym for SSRF for casing standards.
2026-02-06 11:20:08 -05:00
REDMOND\brodes
265922d2e5
Adding docs.
2026-02-06 11:20:01 -05:00
REDMOND\brodes
7db97799c1
Moved change log to correct location.
2026-02-06 11:19:22 -05:00
Ben Rodes
08b72d0a86
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 11:18:51 -05:00
Ben Rodes
46a2a249f9
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 11:18:49 -05:00
REDMOND\brodes
b8ba905253
Added change logs.
2026-02-06 11:18:23 -05:00
REDMOND\brodes
9912aaaf1a
Adding azure sdk test cases and updated test expected file.
2026-02-06 11:18:16 -05:00
REDMOND\brodes
8459eec239
Moving the SsrfSink concept into Concepts.qll, and renaming to HttpClientRequestFromModel as suggested in PR review.
2026-02-06 09:26:49 -05:00
Ben Rodes
ac1987f264
Update python/ql/lib/change-notes/2025-09-30-azure_ssrf_models.md
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2026-02-05 15:44:44 -05:00
Taus
8c27437628
Python: Bump extractor version and add change note
2026-02-05 13:50:54 +00:00
REDMOND\brodes
0a88425170
Python: Altering SSRF MaD to use 'request-forgery' tag. Update to test cases expected results, off by one line. Changed to using ModelOutput::sinkNode.
2026-02-04 09:04:22 -05:00
Ben Rodes
cd73dcfb04
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-04 08:55:38 -05:00
Owen Mansel-Chan
3f08ff88a4
Pretty print models in test
...
Otherwise the tests breaks when unrelated changes are made because the
model numbers change
2026-02-04 10:52:44 +00:00
github-actions[bot]
73d06f26cb
Post-release preparation for codeql-cli-2.24.1
2026-02-02 14:04:26 +00:00
Ben Rodes
7ddfa80399
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-02 09:00:35 -05:00
github-actions[bot]
0db542e9f0
Release preparation for version 2.24.1
2026-02-02 12:09:09 +00:00
Owen Mansel-Chan
5204255615
Merge pull request #21234 from owen-mc/python/convert-sanitizers-to-mad
...
Python: Allow models-as-data sanitizers
2026-01-30 14:28:39 +00:00
Owen Mansel-Chan
0222159df5
Specify vulnerable args instead of safe ones
2026-01-30 14:10:03 +00:00
yoff
8c0baefd3b
Merge pull request #21141 from mbaluda/prompt-injection
...
Python: Prompt injection in OpenAI clients
2026-01-30 12:55:56 +01:00
Owen Mansel-Chan
a3885cd8b2
Replace sanitizer by exclusion from sink definition
2026-01-30 09:28:02 +00:00
Owen Mansel-Chan
b4cb2c3f13
Make qldoc slightly more specific
2026-01-30 09:28:01 +00:00
Owen Mansel-Chan
ef6332c581
Allow MaD sanitizers for queries with MaD sinks
2026-01-30 09:27:59 +00:00
Owen Mansel-Chan
ad6f800022
Pretty print model numbers in tests
2026-01-30 09:21:24 +00:00
yoff
e7a0fc7140
python: Add query for prompt injection
...
This pull request introduces a new CodeQL query for detecting prompt injection vulnerabilities in Python code targeting AI prompting APIs such as agents and openai. The changes includes a new experimental query, new taint flow and type models, a customizable dataflow configuration, documentation, and comprehensive test coverage.
2026-01-29 23:47:52 +01:00
Jon Janego
e54d7c7c73
Update CHANGELOG.md
2026-01-29 16:20:25 -06:00
Jon Janego
813d4639ca
Fix typo in taint flow model for urllib.parse
2026-01-29 16:18:21 -06:00
Taus
34800d1519
Merge pull request #20945 from joefarebrother/python-websockets
...
Python: Model remote flow sources for the `websockets` library
2026-01-29 15:47:46 +01:00
Tom Hvitved
b974a84bef
Merge pull request #21051 from hvitved/shared/flow-summary-provenance-filtering
...
Shared: Provenance-based filtering of flow summaries
2026-01-26 17:24:34 +01:00
Tom Hvitved
0f6bae0ae1
Add change notes
2026-01-26 12:40:22 +01:00
Tom Hvitved
0adece7cde
Python: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:19 +01:00
yoff
55abc52c61
python: format file
2026-01-22 20:51:46 +01:00
yoff
d05901ad3f
python/javascript/ruby: mark internal predicates
2026-01-22 17:30:24 +01:00
yoff
7f00a7f67e
Update python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2026-01-22 17:30:24 +01:00
yoff
3dbfb9fa4b
python: add machinery for MaD barriers
...
and reinstate previously removed barrier
now as a MaD row
2026-01-22 17:30:24 +01:00
yoff
699ed50432
python: remove barrier that can be expressed in MaD
2026-01-22 17:30:24 +01:00
Taus
5414bd2716
Merge pull request #21134 from yoff/python/support-ListElement-in-MaD
...
Python support `ListElement` in MaD
2026-01-20 23:38:02 +01:00
