2587 Commits

Author	SHA1	Message	Date
Taus	3745526d69	Merge pull request #9108 from RasmusWL/promote-pam ... Python: Promote `py/pam-auth-bypass`	2022-05-23 15:27:12 +02:00
yoff	23d64ffa04	Merge pull request #9135 from tausbn/python-modernise-py-jinja2-autoescape-false ... Python: Modernise py/jinja2/autoescape-false	2022-05-23 14:18:06 +02:00
Rasmus Wriedt Larsen	6611e5b4b8	Merge branch 'main' into promote-pam	2022-05-18 10:35:39 +02:00
Rasmus Wriedt Larsen	b54de13d97	Python: Apply suggestions from code review ... Co-authored-by: Taus <tausbn@github.com>	2022-05-18 10:30:29 +02:00
Erik Krogh Kristensen	7245591468	Merge pull request #7763 from erik-krogh/unused-field ... QL: add unused-field query	2022-05-18 09:15:16 +02:00
Taus	ea32299ab0	Python: Use API-graph flow for boolean tracking ... Introduces a false positive, but arguably that false positive should have been there with the local flow as well.	2022-05-17 13:14:55 +00:00
Nick Rolfe	2efa38aaa6	Python: fix typos in comments	2022-05-12 16:02:20 +01:00
Rasmus Wriedt Larsen	795adf0566	Python: Fix API::moduleImport("foo.bar")	2022-05-12 13:33:00 +02:00
Rasmus Wriedt Larsen	f8253f5fef	Python: Fully disallow API::moduleImport of module with dots ... Inspired by discussion about this for MaD in https://github.com/github/codeql/pull/8883#discussion_r865858084	2022-05-12 13:30:26 +02:00
Rasmus Wriedt Larsen	597a8414d9	Python: Add test of API::moduleImport with dots ... This is currently semi-works -- the import is allowed, but doesn't always work when used :|	2022-05-12 13:29:16 +02:00
Rasmus Wriedt Larsen	cff950f5f7	Python: Fix select of py/insecure-cookie	2022-05-11 14:06:30 +02:00
Rasmus Wriedt Larsen	0956d506de	Python: Actually promote py/pam-auth-bypass ... 🤦	2022-05-11 13:44:47 +02:00
Rasmus Wriedt Larsen	fc8633cc01	Python: Fix select for py/cookie-injection	2022-05-11 13:18:14 +02:00
Rasmus Wriedt Larsen	d127d2164a	Merge branch 'main' into jorgectf/python/insecure-cookie	2022-05-11 11:13:47 +02:00
Rasmus Wriedt Larsen	7e87e18b32	Python: Adjust name/description/select of PamAuthorization.ql ... Thought that calling out the actual vulnerability would make things easier for our end users :)	2022-05-10 18:02:17 +02:00
Rasmus Wriedt Larsen	2b6e0cfb44	Merge pull request #8340 from yoff/python/simple-csrf ... python: minimal CSRF implementation	2022-05-10 13:36:38 +02:00
Rasmus Wriedt Larsen	cb17e2a649	Merge pull request #8595 from porcupineyhairs/pypam ... Python : Add query to detect PAM authorization bypass	2022-05-10 13:35:12 +02:00
Rasmus Lerchedahl Petersen	aa3d7babf4	python: fix bad merge ... caused by an optimistic attempt at solving a merge conflict in the online GUI.	2022-05-10 11:37:41 +02:00
Rasmus Wriedt Larsen	2421076d2f	Merge pull request #8696 from RasmusWL/new-nosql-examples ... Python: Improve experimental modeling for `pymongo`	2022-05-10 11:03:05 +02:00
yoff	6c3e2db7fd	Merge branch 'main' into python/simple-csrf	2022-05-10 10:55:28 +02:00
yoff	b6605bc330	Merge pull request #8634 from RasmusWL/promote-xxe ... Python: Promote XXE and XML-bomb queries	2022-05-09 21:54:55 +02:00
Rasmus Wriedt Larsen	c218162104	Merge branch 'main' into pypam	2022-05-09 14:20:05 +02:00
Rasmus Wriedt Larsen	de05b108fa	Python: Fix singleton set	2022-05-09 11:01:13 +02:00
yoff	6169ac6122	Merge pull request #7776 from RasmusWL/django-filefield-uploadto ... Python: Support Django FileField.upload_to	2022-05-05 14:25:08 +02:00
yoff	56ed68b3eb	Merge pull request #9001 from RasmusWL/files-refactoring ... Python: Flask: Improve `request.files` modeing	2022-05-03 12:19:55 +02:00
Rasmus Wriedt Larsen	fb0133d276	Python: Fix Flask request.files modeling	2022-05-02 14:14:58 +02:00
Rasmus Wriedt Larsen	0c62916af5	Python: Highlight problem with Flask request.files modeling	2022-05-02 14:14:53 +02:00
yoff	1d44694280	Merge pull request #8732 from RasmusWL/dataflow-imports ... Python: Don't re-export `python` under `DataFlow::`	2022-05-02 12:08:28 +02:00
Taus	231def026f	Merge pull request #8890 from tausbn/python-add-global-attribute-writes ... Python: Add support for global attribute writes	2022-05-02 12:03:41 +02:00
yoff	c67b06b1fd	Update python/ql/test/experimental/dataflow/typetracking/attribute_tests.py ... Co-authored-by: Taus <tausbn@github.com>	2022-05-02 11:36:58 +02:00
Rasmus Wriedt Larsen	5f01fc24e4	Merge branch 'main' into promote-xxe	2022-05-02 11:25:55 +02:00
Rasmus Wriedt Larsen	3c1a37e7e1	Merge branch 'main' into new-nosql-examples	2022-05-02 11:21:36 +02:00
Taus	b4a31e572f	Python: Add global attribute writes	2022-04-27 16:45:00 +00:00
Taus	f71cf2e1fc	Python: Add test	2022-04-27 15:48:11 +00:00
yoff	39753d5a0b	Merge pull request #8693 from erik-krogh/pyApi ... PY: more API-graphs refactorings	2022-04-27 13:19:50 +02:00
Erik Krogh Kristensen	e1c7d369be	Merge pull request #8796 from erik-krogh/redundantImport ... Remove redundant imports	2022-04-27 12:39:51 +02:00
yoff	9d774463f5	Merge pull request #8859 from tausbn/python-fix-bad-essa-joins ... Python: Fix a bunch of bad joins	2022-04-27 12:27:50 +02:00
Taus	7d736952db	Python: Update expected output	2022-04-26 15:49:40 +00:00
Erik Krogh Kristensen	d389012b75	Merge branch 'main' into redundantImport	2022-04-26 14:24:51 +02:00
yoff	76f2eca1ee	Merge pull request #8560 from erik-krogh/movePolyTest ... PY: move the polynomialbacktracking-test to the test folder	2022-04-26 14:21:30 +02:00
Tom Hvitved	bffa8fa7cb	Merge pull request #8641 from hvitved/dataflow/interpret-read-store ... Data flow: Introduce `ContentSet`	2022-04-25 12:17:34 +02:00
Erik Krogh Kristensen	acac8919b3	PY: update expected output for deprecation warning in test file	2022-04-22 15:28:31 +02:00
Tom Hvitved	b033f107df	Merge remote-tracking branch 'upstream/main' into dataflow/interpret-read-store	2022-04-22 14:35:02 +02:00
Rasmus Wriedt Larsen	03c0366fd4	Merge branch 'main' into stdlib-FileSystemAccess-improvement	2022-04-22 14:31:31 +02:00
Erik Krogh Kristensen	8fcbaea273	Merge branch 'main' into labelNaming	2022-04-22 13:19:44 +02:00
Erik Krogh Kristensen	ff73dbc35c	delete redundant imports	2022-04-22 12:55:28 +02:00
Erik Krogh Kristensen	a96489b23d	delete duplicate imports	2022-04-22 12:41:30 +02:00
Rasmus Wriedt Larsen	650d57083b	Python: Recognize path arguments to pathlib methods	2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen	bcaba45202	Python: Expand pathlib tests	2022-04-22 11:01:59 +02:00
Rasmus Wriedt Larsen	059dea713d	Python: Fix os.path.samefile modeling	2022-04-22 11:01:59 +02:00