Rasmus Wriedt Larsen
e1801f3a29
Python: Proper threat-model handling for argparse
2024-09-10 14:32:36 +02:00
Rasmus Wriedt Larsen
56c85ffe54
Python: Fixup threat-models for os.environ.get()
...
Since using `.DictionaryElementAny` doesn't actually do a store on the
source, (so we can later follow any dict read-steps).
I added the ensure_tainted steps to highlight that the result of the
WHOLE expression ends up "tainted", and that we don't just mark
`os.environ` as the source without further flow.
2024-09-10 14:32:36 +02:00
Rasmus Wriedt Larsen
b9239d7101
Python: Add basic support for environment/commandargs threat-models
2024-09-10 14:32:36 +02:00
Kevin Stubbings
bd2564ee44
Formatting
2024-09-03 14:34:25 -07:00
Kevin Stubbings
5c8c99d31f
Add header support for bottle and tornado
2024-08-30 18:16:01 -07:00
Tom Hvitved
c92c96fa78
Data flow: Compute local big step relation per stage
2024-08-26 09:15:27 +02:00
Rasmus Wriedt Larsen
8f7dec07b8
Python: Remove 'response' from default threat-models
...
I didn't want to put the configuration file in
`semmle/python/frameworks/**/*.model.yml`, so created `ext/` as in other
languages
2024-08-19 10:54:48 +02:00
Rasmus Wriedt Larsen
617ab27c75
Python: Add test showing default active threat-models
2024-08-19 10:54:48 +02:00
Joe Farebrother
62c2fe6b17
Merge pull request #16933 from joefarebrother/python-cookie-concept-promote
...
Python: Promote the insecure cookie query from experimental
2024-08-07 09:06:05 +01:00
yoff
251036c6b4
Merge pull request #17080 from sylwia-budzynska/streamlit
...
Python: Add Streamlit models
2024-07-31 18:20:11 +02:00
yoff
123dcc75d1
Merge pull request #16971 from RasmusWL/mad-dict-source
...
Python: Add MaD support for DictionaryElement/DictionaryElementAny for sources
2024-07-31 13:40:07 +02:00
Sylwia Budzynska
9bd00c9e1e
Change Gradio rfs test to use shared rfs test module
2024-07-31 13:25:32 +02:00
Sylwia Budzynska
9741ddb926
Add remoteflowsoucre test
2024-07-30 17:20:14 +02:00
Sylwia Budzynska
bfd2e4350b
Add StreamlitConnection model
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2024-07-30 12:58:49 +02:00
Joe Farebrother
e68ef87662
update inline tests for rest_framework tests
2024-07-29 23:35:36 +01:00
Joe Farebrother
f10d007496
Add additional test for kwargs case
2024-07-29 23:27:22 +01:00
Joe Farebrother
1127b08635
Merge branch 'main' into python-cookie-concept-promote
2024-07-29 10:26:03 +01:00
yoff
d23d138e7d
Merge pull request #16923 from RasmusWL/impossible-isinstance
...
Python: Add test for impossible isinstance flow
2024-07-29 09:33:30 +02:00
Sylwia Budzynska
358a1b3a20
Fix tests
2024-07-26 14:19:06 +02:00
Sylwia Budzynska
6d1c00742f
Add tests and change note
2024-07-26 14:15:43 +02:00
Joe Farebrother
db27fd934a
Add tests for tornado and twisted
2024-07-23 13:21:37 +01:00
Joe Farebrother
b28d79960b
Update ConceptsTests and make a fix
2024-07-23 10:15:09 +01:00
Rasmus Wriedt Larsen
db8a5306cf
Python: Add MaD support for DictionaryElement/DictionaryElementAny for sources
2024-07-12 15:19:40 +02:00
Rasmus Wriedt Larsen
eed8b3e87b
Python: Add more tests for MaD sources
2024-07-12 15:10:23 +02:00
Joe Farebrother
8152ec7472
Merge pull request #16696 from joefarebrother/python-cookie-write-headers
...
Python: Model CookieWrites from HeaderWrites
2024-07-11 14:25:54 +01:00
Rasmus Wriedt Larsen
173cd13ded
Python: Add test for impossible isinstance flow
2024-07-08 12:06:53 +02:00
Joe Farebrother
b81d41ba7b
Add django header write models for direct subscript write
2024-07-01 11:26:54 +01:00
Rasmus Lerchedahl Petersen
77a00873a9
Python: add tests for loggers
2024-06-28 15:25:17 +02:00
Joe Farebrother
6538d22d3f
Fix tornado model of httheaders.add.
2024-06-26 09:21:53 +01:00
yoff
58b6b3f601
Merge pull request #16789 from yoff/python/document-models-as-data
...
python: Document MaD format
2024-06-25 15:46:28 +02:00
Rasmus Lerchedahl Petersen
aa4fd1992e
Python: compact types in type models
2024-06-25 11:59:55 +02:00
Joe Farebrother
d0f735ac28
Update tests for restframework
2024-06-24 20:52:09 +01:00
Joe Farebrother
c404f00a9b
Add additional header write models for aiohttp and tornado + added qldoc
2024-06-24 17:27:25 +01:00
Joe Farebrother
79c0ed6074
Add additional fastapi mheader write models
2024-06-24 17:27:21 +01:00
Joe Farebrother
5ced5c010c
Add django header writes
2024-06-24 17:27:15 +01:00
Joe Farebrother
7704801e47
Change fastapi raw cookie header models to header write models
2024-06-24 17:27:12 +01:00
Joe Farebrother
a0201e9c4f
Update tests for new cookie write from headers
2024-06-24 17:27:06 +01:00
Joe Farebrother
6b8080a5b3
Update concept tests for header writes
2024-06-24 17:27:02 +01:00
Rasmus Lerchedahl Petersen
00fbada41d
Python: recognize fabric.operations
2024-06-24 10:54:59 +02:00
Taus
4a448f445e
Merge pull request #15715 from am0o0/am0o0-python-codeExec
...
Python: New command execution sinks
2024-06-21 14:26:33 +02:00
Rasmus Lerchedahl Petersen
5cb37f5c4c
python: Document MaD format
...
- add a few tests reflecting the documentation
- make the mentioned sink-kinds have an effect on relevant queries
2024-06-19 17:00:15 +02:00
Paolo Tranquilli
b7a2ea8981
CI: accept other diagnostic format related test changes
2024-06-19 11:33:50 +02:00
am0o0
8a7fdfa6fe
fix conflict
2024-06-18 17:18:59 +02:00
Joe Farebrother
2db1fbc713
Merge branch 'main' into python-flask-session-interface
2024-05-22 21:48:01 +01:00
yoff
358c7410c8
Merge pull request #16490 from yoff/python/rich-type-column-MaD
...
Python: Rich `type` column in MaD
2024-05-21 11:55:41 +02:00
Joe Farebrother
7727e465f4
Model Flask SessionInterface request parameter
2024-05-20 09:46:54 +01:00
Rasmus Lerchedahl Petersen
a568873a8e
Python: update test expectations
2024-05-17 10:59:49 +02:00
Rasmus Lerchedahl Petersen
d4d6b48f98
python: add test for subclass instance method
2024-05-17 00:03:01 +02:00
Rasmus Lerchedahl Petersen
3d0c42f44d
python: rewrite text models to use rich paths
2024-05-17 00:03:01 +02:00
yoff
ea3cc51286
Merge pull request #16194 from yoff/python/test-constructor-MaD-path
...
Python: test the MaD path for constructor calls
2024-05-16 13:52:30 +02:00
