Taus
f5b2eb94a6
Merge pull request #10783 from yoff/python/subscript-nodes
...
Python: API graph improvements for subscripts
2022-10-17 15:21:56 +02:00
Taus
fa2faeb77b
Merge pull request #10802 from jsoref/spelling-python
...
Spelling python
2022-10-17 11:33:27 +02:00
Sylwia Budzynska
e291d61bc7
Add oracledb model
2022-10-13 18:08:47 +02:00
Josh Soref
8669de57e7
spelling: the
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:10 -04:00
Josh Soref
33bc3131f9
spelling: something
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:09 -04:00
Josh Soref
00cc3331ea
spelling: request
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:09 -04:00
Josh Soref
c02b6b3151
spelling: qualified
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:09 -04:00
Josh Soref
6ac31517ac
spelling: method
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:09 -04:00
Josh Soref
c527264198
spelling: execute
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:08 -04:00
Josh Soref
565543a61b
spelling: elliptic
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:08 -04:00
Josh Soref
165514c4ab
spelling: dispatcher
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:08 -04:00
Josh Soref
ac1c5221ef
spelling: attribute
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:08 -04:00
Josh Soref
f2fee60486
spelling: access
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-13 11:21:08 -04:00
sylwia-budzynska
c33dd8fd4b
Merge branch 'main' into python-db-models
2022-10-13 16:48:50 +02:00
Sylwia Budzynska
5f737c82a4
Resolve confilct
2022-10-13 12:43:47 +02:00
Sylwia Budzynska
e41d79e37d
Add python cx_oracle, phoenixdb, pyodbc models
2022-10-13 12:36:41 +02:00
Rasmus Lerchedahl Petersen
fb90089973
python: rewrite model for Aiohttp
2022-10-12 20:15:49 +02:00
sylwia-budzynska
7bcd247128
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-10-12 12:08:20 +02:00
Sylwia Budzynska
319923f445
Add python cx_oracle, phoenixdb, pyodbc models
2022-10-11 15:29:57 +02:00
Rasmus Wriedt Larsen
dba42d6bb8
Python: Model executemany on PEP-249 DB APIs
...
Note: I kept the modeling using the old approach with type-trackers
instead of `DataFlow::MethodCallNode`.
I would like a meta query for DCA to show sinks before doing this, so I
can be absolutely sure we don't loose out on any important sinks on
this... so will postpone this work to a small one-off task (added to my
todo list).
2022-10-10 14:16:47 +02:00
Rasmus Wriedt Larsen
669f4f38b9
Python: Update QLDocs on PEP249Impl.qll
2022-10-10 14:13:01 +02:00
Rasmus Wriedt Larsen
4ee71ae4a1
Python: Add support for pymssql package
...
I also forgot to mention `PyMySQL` in frameworks.rst
2022-10-10 14:02:40 +02:00
Rasmus Wriedt Larsen
584ccf1992
Python: clean up Mysql.qll
2022-10-10 13:49:26 +02:00
Rasmus Wriedt Larsen
4b1f6f0865
Merge pull request #10629 from RasmusWL/fix-flask-source
...
Python: Fix flask request modeling
2022-10-10 09:56:22 +02:00
Rasmus Wriedt Larsen
d7be27a1c0
Python: Fix experimental py/ip-address-spoofing
...
I realized the modeling was done in a non-recommended way, so I changed
the modeling. It was very nice that I could use API graphs for the flask
part, and a little sad when I couldn't for Django/Tornado.
2022-10-03 21:19:30 +02:00
Tom Hvitved
dc432c7774
Sync shared files
2022-09-30 14:56:56 +02:00
CodeQL CI
b66e5c5aee
Merge pull request #10634 from yoff/python/rewrite-typetrackers
...
Approved by tausbn
2022-09-30 03:55:35 -07:00
yoff
8ab5617b51
Merge pull request #10539 from yoff/python/improve-API-graphs
...
Python: add subscript to API graphs
2022-09-29 21:05:22 +02:00
Rasmus Lerchedahl Petersen
0654e39e72
python: rewrite type tracker for compiled regexes
...
we have the option to use `regex.getAValueReachingSink`
rather than `regex.asSink`, but it will likely be used as a
sink for data flow.
2022-09-29 20:30:29 +02:00
Rasmus Wriedt Larsen
0cb8e121e9
Python: Fix flask request modeling
...
This takes us part of the way. We still get multiple paths for the same
alert, but that will be fixed in a different PR.
2022-09-29 17:41:21 +02:00
Asger F
24f2a3cdff
Sync ApiGraphModels.qll
2022-09-28 12:17:44 +02:00
Rasmus Lerchedahl Petersen
b1ae3bfdb2
Python: less eager tracking of flow
2022-09-28 11:46:26 +02:00
Rasmus Lerchedahl Petersen
441fc1bb28
Python: type trackers to API graph
...
base on new subscript in the API graph
There are a few more uses of type tracking
through `SubscriptNode`s, but these start
from an instance given by a data flow node.
2022-09-26 15:05:50 +02:00
Rasmus Wriedt Larsen
71da217b82
Merge pull request #10535 from RasmusWL/flask-jsonify
...
Python: Model `flask.jsonify`
2022-09-23 12:18:27 +02:00
Asger F
11ba0f0bbe
Merge pull request #10253 from asgerf/js/type-defs-squashed
...
JS: Add generated typings to SQL models
2022-09-23 11:34:01 +02:00
Rasmus Wriedt Larsen
d3f811cab3
Python: Accept any arg to flask.jsonify
...
Thanks @tausbn 👍
2022-09-22 14:59:06 +02:00
Rasmus Wriedt Larsen
8174120916
Python: Model flask.jsonify
2022-09-22 14:43:39 +02:00
yoff
ea743173d5
Merge pull request #8781 from yoff/python-dataflow/flow-summaries-from-scratch
...
Python dataflow: flow summaries restart
2022-09-20 14:08:31 +02:00
Asger F
51618b46a8
Sync ApiGraphModels.qll
2022-09-20 11:47:37 +02:00
Rasmus Lerchedahl Petersen
6377e6c575
Python: move summary to Stdlib.qll
2022-09-19 14:36:36 +02:00
Rasmus Lerchedahl Petersen
37fb27fa1c
Python: change type of LibraryCallable::getACall
...
The other callables return control flow nodes,
so it is slightly inconsistent for this to return a
data flow node, but it does make models based
on API graphs nicer.
2022-09-19 14:02:52 +02:00
Erik Krogh Kristensen
a4cd913aea
Merge pull request #10312 from erik-krogh/fix-caseDiff
...
ensure consistent casing of names
2022-09-19 10:43:12 +02:00
Tom Hvitved
4ea1c0050b
Change two ``codeql to ``ql
2022-09-14 13:53:34 +02:00
erik-krogh
03a325ca31
autoformat
2022-09-13 10:06:35 +02:00
Rasmus Lerchedahl Petersen
efc5cfb852
Merge branch 'main' of github.com:github/codeql into python-dataflow/flow-summaries-from-scratch
2022-09-12 19:56:16 +02:00
erik-krogh
80158f8035
fix some python uses of renamed features
2022-09-12 12:08:30 +02:00
Erik Krogh Kristensen
c9ea10b1ef
revise some Python names
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-09-12 12:00:57 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
Rasmus Lerchedahl Petersen
b2fbbc6ac5
Python: add a flow summary
...
we could consider adding non-value-preserving flow from input to output
2022-09-06 21:29:58 +02:00
Asger F
95c60858d4
Export as DataFlow instead of DF
2022-09-06 15:02:48 +02:00