Rasmus Wriedt Larsen
89eeaf85d5
Python: Handle get_database on MongoClient instance
2022-04-07 16:31:17 +02:00
Rasmus Wriedt Larsen
7ca19653df
Python: mongoDBInstance refactor
2022-04-07 16:22:57 +02:00
Rasmus Wriedt Larsen
e58e9a273b
Python: mongoClientInstance refactoring
2022-04-07 16:22:16 +02:00
Rasmus Wriedt Larsen
0ce2ced1aa
Python: Model pymongo.mongo_client.MongoClient
2022-04-07 16:22:16 +02:00
Rasmus Wriedt Larsen
8191be9d75
Python: Move last XXE/XML bomb out of experimental
2022-04-07 15:37:56 +02:00
Rasmus Wriedt Larsen
405480c410
Python: Rename sink definitions for XXE/XML bomb
2022-04-07 15:37:56 +02:00
Erik Krogh Kristensen
50bfc8eaa0
refactor uses of API::Node::getAUse() that should have been something else
2022-04-07 13:52:13 +02:00
Erik Krogh Kristensen
4e5afab082
refactor more python type-trackers to API-graphs
2022-04-07 13:51:40 +02:00
Rasmus Wriedt Larsen
7728b6cf1b
Python: Change XmlBomb vulnerability kind
2022-04-07 10:56:35 +02:00
Ahmed Farid
dfe7f532ac
Update CopyFile.qll
2022-04-05 12:42:05 +00:00
Ahmed Farid
0d6d07886b
Rename Zip.qll to CopyFile.qll
2022-04-05 12:37:14 +00:00
Ahmed Farid
8882bc1533
Update Frameworks.qll
2022-04-05 12:32:10 +00:00
Ahmed Farid
68bfe38529
Update Zip.qll
2022-04-05 12:31:30 +00:00
Rasmus Wriedt Larsen
1f285b8983
Python: Rename to XmlParsingVulnerabilityKind
...
To keep up with style guide
2022-04-05 11:07:12 +02:00
Rasmus Wriedt Larsen
ab59d5c786
Python: Rename to XmlParsing
...
To follow our style guide
2022-04-05 11:06:22 +02:00
Rasmus Wriedt Larsen
d2b03bb480
Python: Fix SimpleXmlRpcServer.ql
2022-03-31 20:37:28 +02:00
Rasmus Wriedt Larsen
4abab22066
Python: Promote XXE and XML-bomb queries
...
Need to write a change-note as well, but will do that tomorrow
2022-03-31 18:47:50 +02:00
Rasmus Wriedt Larsen
b8d3c5e96f
Python: Remove last bits of experimental XML modeling
2022-03-31 18:40:26 +02:00
Rasmus Wriedt Larsen
e11269715d
Python: Promote xml.sax and xml.dom.* modeling
2022-03-31 17:44:00 +02:00
Rasmus Wriedt Larsen
64aa503cc3
Python: Promote xml.etree modeling
2022-03-31 11:12:02 +02:00
Rasmus Wriedt Larsen
7f5f7679f8
Python: Promote xmltodict modeling
2022-03-31 10:28:34 +02:00
Rasmus Wriedt Larsen
80b5cde3a2
Python: Promote lxml parsing modeling
2022-03-31 10:19:08 +02:00
Rasmus Wriedt Larsen
1ea4bcc59f
Python: Make XMLParsing a Decoding subclass
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e45288e812
Python: => XMLParsingVulnerabilityKind
...
Since there are other XML vulnerabilities that are not about parsing,
this is more correct.
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e005a5c0ab
Python: Promote XMLParsing concept
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
9caf4be21b
Python: Add PortSwigger link to Xxe.qhelp
...
I found this resource quite good myself at least :)
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
56b9c891d8
Python: Adjust XmlBomb.qhelp from JS
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
b00766b054
Python: Adjust XXE qhelp
...
and remove the old copy, we don't need it anymore :)
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
c365337867
Python: Delete XmlEntityInjection.ql
...
Kept the test of SimpleXmlRpcServer, and kept the qhelp so it can be
used to write the new qhelp files
2022-03-31 09:52:55 +02:00
Rasmus Wriedt Larsen
e45f9d69cc
Python: Adjust Xxe/XmlBomb for Python
...
I changed a few QLdocs so they fit the style we have used in Python...
although I surely do regret having introduced a new style for how these
QLDocs look :D
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
65907c9762
Python: Copy Xxe/XmlBomb queries from JS
...
After internal discussion, these will replace the `XmlEntityInjection`
query, so we can have separate severities on DoS and the other (more
serious) attacks.
Note: These clearly don't work, since they are verbatim copies of the JS
code, but I split it into multiple commits to clearly highlight what
changes were made.
2022-03-31 09:52:54 +02:00
haby0
1e6893e230
Update python/ql/src/experimental/semmle/python/security/injection/CsvInjection.qll
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-30 22:54:30 +08:00
haby0
8f2013c32e
Simplify StartsWithCheck
2022-03-30 19:04:03 +08:00
Porcupiney Hairs
92033047a5
Python : Add query to detect PAM authorization bypass
...
Using only a call to `pam_authenticate` to check the validity of a login can
lead to authorization bypass vulnerabilities. A `pam_authenticate` only
verifies the credentials of a user. It does not check if a user has an
appropriate authorization to actually login. This means a user with a
expired login or a password can still access the system.
This PR includes a qhelp describing the issue, a query which detects instances where a call to
`pam_acc_mgmt` does not follow a call to `pam_authenticate` and it's
corresponding tests.
This PR has multiple detections. Some of the public one I can find are :
* [CVE-2022-0860](https://nvd.nist.gov/vuln/detail/CVE-2022-0860 ) found
in [cobbler/cobbler](https://www.github.com/cobbler/cobbler )
* [fredhutch/motuz](https://www.huntr.dev/bounties/d46f91ca-b8ef-4b67-a79a-2420c4c6d52b/ )
2022-03-30 00:47:58 +05:30
haby0
bf8c7a2ea7
Added Sanitizer Guard
2022-03-29 14:29:33 +08:00
Ahmed Farid
d89ed8b98b
Update zipslip_bad.py
2022-03-28 01:40:08 +00:00
Ahmed Farid
cafbd98454
Update zipslip_bad.py
2022-03-28 01:08:39 +00:00
Ahmed Farid
ddba3b7784
Update ZipSlip.qll
2022-03-28 00:59:56 +00:00
Ahmed Farid
0fac4f195d
Update Concepts.qll
2022-03-28 00:47:27 +00:00
Ahmed Farid
413f1945ce
Update Zip.qll
2022-03-28 00:44:56 +00:00
Ahmed Farid
eab6568cda
Update zipslip_good.py
2022-03-24 00:35:24 +01:00
Ahmed Farid
b5f1e9de08
Update zipslip_bad.py
2022-03-24 00:33:28 +01:00
Ahmed Farid
1836723ecb
Merge branch 'main' into ZipSlip
2022-03-23 19:27:12 -04:00
Erik Krogh Kristensen
879680057e
fix all ql/unused-field warnings
2022-03-17 09:41:42 +01:00
Jonas Jensen
d89c52f4b0
Merge pull request #8403 from erik-krogh/noUpper
...
Rename all upper-case variables, and all lower-case modules
2022-03-15 09:00:37 +01:00
haby0
e11c74c580
Delete redundant comments
2022-03-15 15:25:08 +08:00
haby0
4195eef9ba
Add CSV injection model
2022-03-15 15:15:38 +08:00
Erik Krogh Kristensen
ad2ab5602e
PY: rename remaining private python modules
2022-03-14 12:22:33 +01:00
Jeroen Ketema
4c2081b7fc
Merge pull request #8401 from jketema/taint-flow
...
Extend taint tracking interface with flow states
2022-03-14 12:06:10 +01:00
Rasmus Wriedt Larsen
2f4a22c86c
Merge pull request #6112 from jorgectf/jorgectf/python/deserialization
...
Python: Port and extend XXE modeling
2022-03-14 11:59:28 +01:00
