erik-krogh
944ca4a0da
fix some more style-guide violations in the alert-messages
2022-10-07 11:23:34 +02:00
erik-krogh
089ce5a8a4
change alert messages of path queries to use the same template
2022-09-02 14:45:40 +02:00
Rasmus Wriedt Larsen
695553ba9f
Python: Deprecate old non-Query.qll dataflow defs
2022-03-21 15:03:22 +01:00
Rasmus Wriedt Larsen
98e6fc8a88
Python/Ruby: Remove owasp tags
...
These are no longer correct, since the A1 category changed from 2017 to
2021, see https://owasp.org/Top10/#whats-changed-in-the-top-10-for-2021
Since only a very few queries had these tags, I think we're much better
off having them removed.
2021-11-16 12:03:50 +01:00
Rasmus Wriedt Larsen
7f53781ba7
Python: Port py/code-injection to use proper source/sink customization
2021-07-12 16:22:10 +02:00
Calum Grant
771e686946
Update security-severity scores
2021-06-15 13:25:17 +01:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Rasmus Wriedt Larsen
7afe3972d8
Revert "Merge pull request #5171 from RasmusWL/restructure-queries"
...
This reverts commit 8caafb3710ec79094957
2021-02-17 16:32:53 +01:00
Rasmus Wriedt Larsen
3a18881660
Python: Restructure query file location
...
Since I can never remember the CWE numbers
2021-02-16 11:36:10 +01:00
Rasmus Wriedt Larsen
7c04c59456
Python: Move CodeInjection configuration to own file
...
This makes it easy to extend the sources/sinks of the configuration and re-run
the query from the query console on LGTM.com.
File location in `semmle.<lang>.security.dataflow.<QueryName>.qll` is matching
what we currently do in other languages (JS and C# sampled).
I did not follow the pattern in other languages for wrapping all the code in a
`module CodeInjection`, since I didn't understand the value in doing so -- I
would like confirmation from the other teams if we _should_ actually do that,
before merging.
2020-11-06 13:58:06 +01:00
Taus Brock-Nannestad
fb6a02e060
Python: More import fixups
2020-11-02 22:17:42 +01:00
Taus Brock-Nannestad
f903e4ffbe
Python: Promote experimental queries
...
DO NOT MERGE
Also adds performance fix to `python.qll`.
2020-10-30 19:40:56 +01:00
Taus Brock-Nannestad
f07a7bf8cf
Python: Autoformat everything using qlformat.
...
Will need subsequent PRs fixing up test failures (due to deprecated
methods moving around), but other than that everything should be
straight-forward.
2020-07-07 15:43:52 +02:00
Rasmus Wriedt Larsen
5bc592514a
Python: Consistenly use "a user-provided value"
...
ReflectedXss was the only query that used it with the "a"
2020-02-03 14:35:09 +01:00
Rasmus Wriedt Larsen
2648e34f1a
Python: Autoformat security
2020-01-31 14:49:18 +01:00
Taus
adf8cdcde5
Merge pull request #1203 from markshannon/python-taint-tracking-configuration-2
...
Python: Use taint tracking configuration for queries.
2019-04-09 10:01:35 +02:00
Mark Shannon
c2e814a11a
Fix CWE tag for Code injection query.
2019-04-04 15:09:12 +01:00
Mark Shannon
bc19769e6d
Python: make sure code injection query is using correct sources.
2019-04-04 10:56:45 +01:00
Mark Shannon
3c1a5bb046
Python: Use new taint-tracking query in code-injection query.
2019-04-04 10:56:44 +01:00
Mark Shannon
61bd8682df
Python: Improve API and representation of taint tracking nodes. Update queries and tests accordingly.
2018-11-23 12:32:14 +00:00
Mark Shannon
722d89fc75
Upgrade taint-tracking security queries to path-problem queries.
2018-11-22 11:05:01 +00:00
Mark Shannon
e930b43bf3
Python security queries. Choose a precision reflecting actual precision for Security queries.
2018-11-19 17:10:40 +00:00
Mark Shannon
5f58824d1b
Initial commit of Python queries and QL libraries.
2018-11-19 15:10:42 +00:00
