Rasmus Wriedt Larsen
b7f56dd17e
Python: Rewrite concepts to use extends ... instanceof ...
...
This caused compilation time for `ConceptsTest.ql` to go from 1m24s to
7s
2022-04-05 12:31:09 +02:00
Rasmus Wriedt Larsen
a7dab53ed2
Python: Add change-note
2022-04-05 11:46:49 +02:00
Rasmus Wriedt Larsen
1f285b8983
Python: Rename to XmlParsingVulnerabilityKind
...
To keep up with style guide
2022-04-05 11:07:12 +02:00
Rasmus Wriedt Larsen
ab59d5c786
Python: Rename to XmlParsing
...
To follow our style guide
2022-04-05 11:06:22 +02:00
Rasmus Wriedt Larsen
d2b03bb480
Python: Fix SimpleXmlRpcServer.ql
2022-03-31 20:37:28 +02:00
Rasmus Wriedt Larsen
4abab22066
Python: Promote XXE and XML-bomb queries
...
Need to write a change-note as well, but will do that tomorrow
2022-03-31 18:47:50 +02:00
Rasmus Wriedt Larsen
b8d3c5e96f
Python: Remove last bits of experimental XML modeling
2022-03-31 18:40:26 +02:00
Rasmus Wriedt Larsen
5083023aa8
Python: Move XML parsing PoC
...
Since the folder where it used to live is now empty otherwise :O
2022-03-31 18:37:47 +02:00
Rasmus Wriedt Larsen
673220b231
Python: Minor cleanup of XmlParsingTest
2022-03-31 18:18:35 +02:00
Rasmus Wriedt Larsen
b4c0065aeb
Python: Extend FileSystemAccess for xml.sax and xml.dom.* parsing
2022-03-31 18:08:47 +02:00
Rasmus Wriedt Larsen
1d7cec60ae
Python: xml.sax.parse is not a method call
...
And it's not possible to provide a parser argument either
2022-03-31 17:50:23 +02:00
Rasmus Wriedt Larsen
e11269715d
Python: Promote xml.sax and xml.dom.* modeling
2022-03-31 17:44:00 +02:00
Rasmus Wriedt Larsen
05bb0ef976
Python: Align xml.etree.ElementTree modeling
...
I didn't find a good way to actually share the stuff, so we kinda just
have 2 things that look very similar :|
2022-03-31 17:24:16 +02:00
Rasmus Wriedt Larsen
70b3eecdd5
Python: Merge xml.etree.ElementTree models
...
I forgot about the existing ones when I promoted it
2022-03-31 17:13:11 +02:00
Rasmus Wriedt Larsen
db43d043c4
Python: Add test showing misalignment of xml.etree modeling
2022-03-31 11:55:46 +02:00
Rasmus Wriedt Larsen
543454eff2
Python: Model file access from XML parsing
2022-03-31 11:47:29 +02:00
Rasmus Wriedt Larsen
386ff53614
Python: Model lxml.iterparse
2022-03-31 11:32:22 +02:00
Rasmus Wriedt Larsen
12cbdcde28
Python: Model lxml.etree.XMLID
2022-03-31 11:21:24 +02:00
Rasmus Wriedt Larsen
6774085e7a
Python: Add note about parseid/XMLID
2022-03-31 11:19:25 +02:00
Rasmus Wriedt Larsen
a315aa84b2
Python: Add some links in QLDocs
2022-03-31 11:16:50 +02:00
Rasmus Wriedt Larsen
64aa503cc3
Python: Promote xml.etree modeling
2022-03-31 11:12:02 +02:00
Rasmus Wriedt Larsen
7f5f7679f8
Python: Promote xmltodict modeling
2022-03-31 10:28:34 +02:00
Rasmus Wriedt Larsen
80b5cde3a2
Python: Promote lxml parsing modeling
2022-03-31 10:19:08 +02:00
Rasmus Wriedt Larsen
3040adfd9b
Python: Handle XMLParser().close() for XPath
2022-03-31 10:08:26 +02:00
Rasmus Wriedt Larsen
c4473c5f65
Python: Rename lxml XPath tests
2022-03-31 10:08:02 +02:00
Rasmus Wriedt Larsen
1ea4bcc59f
Python: Make XMLParsing a Decoding subclass
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
35ccba2ec1
Python: Promote XMLParsing concept test
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e45288e812
Python: => XMLParsingVulnerabilityKind
...
Since there are other XML vulnerabilities that are not about parsing,
this is more correct.
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e005a5c0ab
Python: Promote XMLParsing concept
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
9caf4be21b
Python: Add PortSwigger link to Xxe.qhelp
...
I found this resource quite good myself at least :)
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
56b9c891d8
Python: Adjust XmlBomb.qhelp from JS
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
b00766b054
Python: Adjust XXE qhelp
...
and remove the old copy, we don't need it anymore :)
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
c365337867
Python: Delete XmlEntityInjection.ql
...
Kept the test of SimpleXmlRpcServer, and kept the qhelp so it can be
used to write the new qhelp files
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
769f5691d0
Python: Add taint for StringIO and BytesIO
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
57b9780428
Python: XXE: Add example of exfiltrating data through dtd-retrival
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
a1d88e39a7
Python: Adjust XXE PoC for newer lxml versions
...
Which doesn't raise that syntax error (at least not on my laptop)
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
91795b8577
Python: Add simple test of Xxe/XmlBomb
...
Note that most of the testing happens in the framework specific tests,
with an inline-expectation test
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
e45f9d69cc
Python: Adjust Xxe/XmlBomb for Python
...
I changed a few QLdocs so they fit the style we have used in Python...
although I surely do regret having introduced a new style for how these
QLDocs look :D
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
65907c9762
Python: Copy Xxe/XmlBomb queries from JS
...
After internal discussion, these will replace the `XmlEntityInjection`
query, so we can have separate severities on DoS and the other (more
serious) attacks.
Note: These clearly don't work, since they are verbatim copies of the JS
code, but I split it into multiple commits to clearly highlight what
changes were made.
2022-03-31 09:52:54 +02:00
Arthur Baars
2ae5e8158e
Python: import RegExpTreeView correctly
2022-03-28 12:41:32 +02:00
Arthur Baars
b103679d8a
JS/Ruby/Python: rename RegExpTreeView.qll to ReDoSUtilSpecific.qll
2022-03-28 12:17:26 +02:00
Arthur Baars
af1d949d06
Merge pull request #8489 from aibaars/regex-refactor
...
Ruby: refactor regex libraries
2022-03-28 12:17:00 +02:00
yoff
5efc19c39d
Merge pull request #7806 from erik-krogh/pyDef
...
Python: Add def nodes to API graphs
2022-03-28 08:09:14 +02:00
Taus
b75ac4e827
Merge pull request #8540 from tausbn/python-add-points-to-call-graph-meta-query
...
Python: Add call graph meta-query
2022-03-25 15:36:33 +01:00
Rasmus Wriedt Larsen
d51aaf2f91
Python: Import framework-modeling in regex.qll
2022-03-24 14:28:44 +01:00
Arthur Baars
1a9aaf4543
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-24 11:37:03 +01:00
Arthur Baars
74aea81fe3
Ruby: refactor regex libraries
2022-03-24 11:37:02 +01:00
Taus
af888f7604
Python: Add call graph meta-query
2022-03-23 16:36:28 +00:00
yoff
647d37492d
Merge pull request #8289 from tausbn/python-remove-with-test-syntax-error
...
Python: Fix syntax error in `with` test output
2022-03-23 12:25:11 +01:00
Rasmus Wriedt Larsen
bbf60b875e
Merge pull request #8476 from RasmusWL/shared-concepts-scaffolding
...
Python/JS/Ruby: Shared concepts scaffolding
2022-03-23 10:22:42 +01:00
