Taus
3bb7e28712
Merge pull request #10176 from RasmusWL/import-problem
...
Python: Add testcase for import problem
2022-09-06 18:12:37 +02:00
Rasmus Wriedt Larsen
d708abfc80
Python: Accept more .expected changes
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
e979dffc08
Python: Fix variable access from extractor-change
...
These changes are from internal PR.
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
985e87ccde
Python: Add variable scope example with subclass
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
0e3d520712
Python: Add variables regression test
...
As illustrated when running the python file, the non qualified reads in
the `use` method all refer to the global variables, whereas `ex =
func(baz)` are to the things defined on the class.
The important part of the .expected changes is that the _global_
variable `bar` is used inside the function, whereas it's the local
variable for `foo` (on class scope) that is used inside the function
(which is wrong).
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
98db1af898
Python: Also show variable access
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
fd4f60dd1b
Python: Adjust variables tests
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
ebd97f4496
Python: Add type-tracking regession example
2022-09-06 10:11:36 +02:00
erik-krogh
0de0325c8e
change the alert-message for py/modification-of-default-value
2022-09-05 13:30:56 +02:00
erik-krogh
089ce5a8a4
change alert messages of path queries to use the same template
2022-09-02 14:45:40 +02:00
erik-krogh
1d1aa7c8b4
update some expected output
2022-08-25 20:52:30 +02:00
erik-krogh
cc7a9ef97a
rename more acronyms
2022-08-25 20:52:27 +02:00
Rasmus Wriedt Larsen
0728ecebbb
Python: Highlight that import problem is not just a relative problem
2022-08-25 15:54:21 +02:00
Rasmus Wriedt Larsen
1ca19533e0
Python: Add import problem test from the wild
2022-08-25 15:50:55 +02:00
Erik Krogh Kristensen
06afe9c0f4
Merge pull request #9816 from erik-krogh/msgConsis
...
Make alert messages consistent across languages
2022-08-25 15:20:01 +02:00
Ian Lynagh
3fcfd32eb1
Make *.ql non-executable
2022-08-24 16:55:11 +01:00
Ian Lynagh
4cd618f81c
Make *.expected non-executable
2022-08-24 16:51:50 +01:00
erik-krogh
014dcd1454
fixup a Python query, it didn't select something with a location
2022-08-24 16:23:20 +02:00
erik-krogh
1c0f2251e2
Merge branch 'main' into msgConsis
2022-08-24 14:38:57 +02:00
erik-krogh
1a7d3ee831
update expected output after changing queries
2022-08-23 12:35:32 +02:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
Chris Smowton
f3ef8510d3
Merge pull request #10093 from smowton/smowton/feature/java-singular-locations
...
Java: pick an arbitrary representative location when an entity has many candidate locations.
2022-08-22 09:32:43 +01:00
Chris Smowton
8d20b9cf52
Use hasLocationInfo to match several Location fields at once
2022-08-19 19:03:17 +01:00
Chris Smowton
1ea7caf559
Fix join ordering in inline-expectations test
2022-08-19 18:17:22 +01:00
erik-krogh
2e44fba67d
add explicit this
2022-08-17 13:33:31 +02:00
Erik Krogh Kristensen
f106e064fa
Merge pull request #9422 from erik-krogh/refacReDoS
...
Refactorizations of the ReDoS libraries
2022-08-16 09:32:08 +02:00
Erik Krogh Kristensen
0adb588fe8
Merge pull request #9712 from erik-krogh/badRange
...
JS/RB/PY/Java: add suspicious range query
2022-08-15 13:55:44 +02:00
Erik Krogh Kristensen
49276b1f38
Merge branch 'main' into refacReDoS
2022-08-09 16:18:46 +02:00
Rasmus Wriedt Larsen
f89b32183f
Merge branch 'main' into typetracker-decorators
2022-08-08 11:52:09 +02:00
Rasmus Wriedt Larsen
3d0c23e441
Python: Accept .expected for TarSlip
...
Changed after merging https://github.com/github/codeql/pull/9579 ,
which improved our handling of `not` for guards.
2022-08-03 09:52:11 +02:00
Rasmus Wriedt Larsen
1737d08145
Merge pull request #9579 from yoff/python/more-logic-tests
...
Python: Improve `BarrierGuard`
2022-08-01 11:36:11 +02:00
Erik Krogh Kristensen
ff25451699
rename query to overly-large-range, and rewrite the @description
2022-07-12 16:02:46 +02:00
yoff
1105cd569b
Merge branch 'main' into python/port-tarslip
2022-06-28 22:17:28 +02:00
yoff
6087bc6888
Merge branch 'main' into python/more-logic-tests
2022-06-28 22:16:38 +02:00
Asger F
a522562f93
Merge pull request #9369 from asgerf/python/api-graph-api
...
Python: API graph renaming and documentation
2022-06-28 14:48:12 +02:00
Erik Krogh Kristensen
a343ceaf8b
add suspicious-regexp-range query
2022-06-28 09:49:27 +02:00
Rasmus Lerchedahl Petersen
a1fe8a5b2b
python: handle not in BarrierGuard
...
in the program
```python
if not is_safe(path):
return
```
the last node in the `ConditionBlock` is `not is_safe(path)`,
so it would never match "a call to is_safe".
Thus, guards inside `not` would not be part of `GuardNode`
(nor `BarrierGuard`). Now they can.
2022-06-27 20:10:47 +00:00
Rasmus Lerchedahl Petersen
882000afb3
python: not is confusing our logic
...
- added `is_unsafe`
- added "negated version" of two tests.
These versions do not use `not` and the analysis gets the taint right.
2022-06-27 20:10:47 +00:00
Rasmus Wriedt Larsen
9e154ff4bd
Merge branch 'main' into python/port-tarslip
2022-06-27 14:36:15 +02:00
Erik Krogh Kristensen
13482fc97b
rename ReDoSUtil to NfaUtils, and rename the "performance" folder to "regexp"
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
7fb3d81d2f
add further normalization of char classses
2022-06-23 14:36:25 +02:00
Rasmus Wriedt Larsen
3248f7b423
Merge pull request #9649 from RasmusWL/certificate-modeling
...
Python/JS/Ruby: Ignore common words (like certain) as sensitive data source
2022-06-23 12:04:58 +02:00
Rasmus Wriedt Larsen
4be375521f
Python: Handle _ in sensitive-data-sources
2022-06-22 11:05:14 +02:00
Rasmus Wriedt Larsen
4a844312f4
Python: _ in var name not handled by sensitive-data-sources
2022-06-22 11:05:14 +02:00
Rasmus Wriedt Larsen
5dc2bb717a
Python: ignore common words (certain/concert) as sensitive source
2022-06-22 11:05:05 +02:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
Rasmus Wriedt Larsen
abdcfd55c3
Python: uncertainty is treated as a certificate :O
2022-06-22 10:16:28 +02:00
Asger F
b096f9ec72
Python: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:06 +02:00
Asger F
181a53bd03
Python: Rename getAnImmediateUse -> asSource
2022-06-21 12:44:06 +02:00
