Tom Hvitved
3b1146bf98
Python: Adopt shared type tracking library
2023-12-14 13:22:44 +01:00
Max Schaefer
3939167ba2
Include more details in the message for py/weak-cryptographic-algorithm.
...
Specifically, we add a link to the location where the cryptographic algorithm is configured, which can be far away from its use.
2023-10-26 11:28:09 +01:00
Taus
25043f51a4
Merge pull request #11376 from RasmusWL/call-graph-code
...
Python: New type-tracking based call-graph
2023-02-27 14:51:21 +01:00
Rasmus Wriedt Larsen
c4fbfb0d07
Merge branch 'main' into call-graph-code
2023-02-15 20:15:04 +01:00
Alex Ford
1556b1a728
Merge branch 'main' into js-use-shared-cryptography
2023-02-15 17:13:53 +00:00
Alex Ford
43af306d60
dynamic: more detailed qldoc for CryptographicOperation#getBlockMode()
2023-02-15 16:55:18 +00:00
Alex Ford
d4d0b91085
dynamic: switch CryptographicOperation::Range#getBlockMode() back to being an abstract predicate
2023-02-15 16:23:46 +00:00
Alex Ford
c7aaad9ed0
JS: avoid adding a deprecated CryptographicOperation#getInput to py/ruby
2023-02-15 16:23:46 +00:00
Rasmus Wriedt Larsen
b2e79e2948
Python/Ruby/JS Crypto: Add a few algorithms + block modes
...
I have tried to add a few links to support the claim that these
algorithms are strong/safe. It wasn't always super easy, so in some
cases I have ended up just linking to the documentation of the
`cryptography` Python package.
Co-authored-by: REDMOND\brodes <brodes@microsoft.com >
2023-02-13 10:40:47 +01:00
Alex Ford
6c35feaa98
ConceptsShared: add a default implementation of BlockMode CryptographicOperation#getBlockMode() for compatibility with external code
2023-02-03 14:39:32 +00:00
Alex Ford
e5dfbe2c8d
ConceptsShared: Add BlockMode#matchesString(string) predicate
2023-02-02 20:27:52 +00:00
Alex Ford
61095b3c58
ConceptsShared: Add deprecated DataFlow::Node CryptographicOperation#getInput() predicate
2023-02-02 20:27:05 +00:00
Rasmus Wriedt Larsen
d151e21f15
Python: Move ControlFlowNode.toString() to AST cached stage
...
This means points-to is no longer evaluated for sql injection 🎉
Thanks @asgerf 💪
2022-11-24 10:14:39 +01:00
Rasmus Wriedt Larsen
36e8b8bfb9
Python: Add call-graph to cached dataflow stage
...
I didn't do any performance investigation on this, since it just seems
so much like the right approach.
2022-11-22 14:46:32 +01:00
Rasmus Wriedt Larsen
fc0545561e
Python: Introduce points-to cached stage
...
With points-to not being used for the call-graph any longer, it's time
to split them.
2022-11-22 14:46:32 +01:00
Rasmus Wriedt Larsen
635fd1902d
Python: Move HTTP::Client::Request to shared concepts
...
New shared concepts uses correct casing of HTTP according to our
style-guide.
2022-08-18 13:42:52 +02:00
Asger F
b096f9ec72
Python: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:06 +02:00
Rasmus Wriedt Larsen
85fa6fba63
Concepts: Move CryptographicOperation.isWeak to be Ruby specific
2022-05-23 14:39:06 +02:00
Alex Ford
d3662cf54a
Deprecate CryptographicOperation#isWeak and add a default implementation
2022-05-19 15:46:13 +01:00
Alex Ford
3d66905dc6
Share the CryptographicOperation and BlockMode concepts between dynamic langs
2022-05-19 15:46:03 +01:00
Erik Krogh Kristensen
7ca6426ea5
revert the Taint stage, as it caused an alert for ql/abstract-class-import
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
b74852ffd6
cache a bit more (again)
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
040196f40d
cache more basicblock predicates
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
79713e0ef8
a bit more caching
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
4089788629
revert caching of some large predicates that caused the DB size to increase too much
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
0da80f90d3
rename the SSA stages to AST
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
c9e3a62953
cached stages iteration 5
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
a8f9a91e38
cached stages iteration 4
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
f68357a063
cached stages iteration 3.5
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
37a9b41e26
cached stages iteration 3
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
60b5af215f
cached stages iteration 2
2022-03-30 22:53:59 +02:00
Erik Krogh Kristensen
71eacea90b
add the cached stages pattern to Python
2022-03-30 22:53:59 +02:00
Rasmus Wriedt Larsen
414764ccee
Concepts: Minor rewrite in qldoc
...
As suggested by @hmac
2022-03-22 10:33:58 +01:00
Rasmus Wriedt Larsen
2b9408b0c3
Concepts: Add some architecture documentation
2022-03-17 13:49:10 +01:00
Harry Maclean
36c421346b
Introduce ConceptsShared.qll
2022-03-17 13:49:10 +01:00
yoff
8f9741ae72
Update python/ql/lib/semmle/python/internal/Awaited.qll
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-10-28 19:13:08 +02:00
Rasmus Lerchedahl Petersen
826f44d98e
Python: Share implementation of awaited
2021-10-27 11:41:18 +02:00
