Taus
283231bdbc
Python: Port ShouldBeContextManager.ql
...
Only trivial test changes.
2026-03-20 13:28:45 +00:00
Taus
8cfdea2001
Python: Port PropertyInOldStyleClass.ql
...
Only trivial test changes.
2026-03-20 13:28:45 +00:00
Taus
3d20050c0a
Python: Port SlotsInOldStyleClass.ql
...
Only trivial test changes.
2026-03-20 13:28:45 +00:00
Taus
a99b3f2c3b
Merge pull request #21459 from github/tausbn/python-fix-missing-relative-imports
...
Python: Fix resolution of relative imports from namespace packages
2026-03-16 14:59:44 +01:00
Taus
92718a98d0
Python: Add test for package inside namespace package
2026-03-16 12:41:09 +00:00
Taus
e70727524a
Python: Rename prints tag to flow
...
The former was a remnant of copying the setup over from
`ql/test/experimental/import-resolution/importflow.ql`.
2026-03-16 12:37:00 +00:00
Taus
e16bb226c0
Python: Fix resolution of relative imports from namespace packages
...
The fix may look a bit obscure, so here's what's going on.
When we see `from . import helper`, we create an `ImportExpr` with level
equal to 1 (corresponding to the number of dots). To resolve such
imports, we compute the name of the enclosing package, as part of
`ImportExpr.qualifiedTopName()`. For this form of import expression, it
is equivalent to `this.getEnclosingModule().getPackageName()`. But
`qualifiedTopName` requires that `valid_module_name` holds for its
result, and this was _not_ the case for namespace packages.
To fix this, we extend `valid_module_name` to include the module names
of _any_ folder, not just regular package (which are the ones where
there's a `__init__.py` in the folder). Note that this doesn't simply
include all folders -- only the ones that result in valid module names
in Python.
2026-03-12 13:29:23 +00:00
Taus
48bf4fd82a
Python: Add test for missing relative import in namespace packages
2026-03-12 13:29:19 +00:00
Taus
fa61f6f3df
Python: Model @typing.overload in method resolution
...
Adds `hasOverloadDecorator` as a predicate on functions. It looks for
decorators called `overload` or `something.overload` (usually
`typing.overload` or `t.overload`). These are then filtered out in the
predicates that (approximate) resolving methods according to the MRO.
As the test introduced in the previous commit shows, this removes the
spurious resolutions we had before.
2026-03-05 22:20:03 +00:00
Taus
0561a63003
Python: Add test for overloaded __init__ resolution
...
Adds a test showing that `@typing.overload` stubs are spuriously
resolved as call targets alongside the actual `__init__` implementation.
2026-03-05 22:20:03 +00:00
Owen Mansel-Chan
99a4fe4828
Update expected test output column numbers
2026-03-04 15:02:53 +00:00
Owen Mansel-Chan
aa28c94562
Remove double space after $ in inline expectations tests
2026-03-04 14:12:42 +00:00
Owen Mansel-Chan
91b6801db1
py: Inline expectation should have space before $
2026-03-04 13:11:38 +00:00
Owen Mansel-Chan
5a97348e78
python: Inline expectation should have space after $
...
This was a regex-find-replace from `# \$(?! )` (using a negative lookahead) to `# $ `.
2026-03-04 12:45:05 +00:00
yoff
600f585a31
Merge pull request #21296 from yoff/python/bool-comparison-guards
...
Python: Handle guards being compared to boolean literals
2026-02-26 21:13:51 +01:00
Taus
6bfb1e1fae
Merge pull request #21344 from github/tausbn/python-remove-points-to-from-metrics-libraries
...
Python: Remove points-to from metrics library
2026-02-24 15:55:16 +01:00
yoff
7351e82c92
python: handle guards compared to boolean literals
2026-02-24 10:00:22 +01:00
yoff
8488039fb9
python: add tests for guards compared to booleans
2026-02-24 10:00:21 +01:00
Taus
480ae619e6
Merge pull request #21116 from github/tausbn/python-add-dataflow-overlay-annotations
...
Add `overlay[local]` annotations
2026-02-21 13:44:09 +01:00
Taus
e8de8433f4
Python: Update all metrics-dependant queries
...
The ones that no longer require points-to no longer import
`LegacyPointsTo`. The ones that do use the specific
`...MetricsWithPointsTo` classes that are applicable.
2026-02-19 12:32:27 +00:00
Taus
6b6d8862b0
Merge pull request #21288 from microsoft/azure_python_sanitizer_upstream2
...
Azure python sanitizer upstream2
2026-02-18 14:59:59 +01:00
Taus
248932db7a
Python: Fix frameworks/data/warnings.ql
2026-02-16 13:48:32 +00:00
Taus
df0f2f8ce4
Python: Simple dataflow annotations
...
None of these required any changes to the dataflow libraries, so it
seemed easiest to put them in their own commit.
2026-02-16 13:48:32 +00:00
REDMOND\brodes
4d4e7a1b5c
Pretty print for tests.
2026-02-12 08:28:08 -05:00
Taus
7d17454a3b
Merge pull request #21138 from github/tausbn/python-prepare-for-overlay-annotations
...
Prepare dataflow for local annotations
2026-02-12 14:23:45 +01:00
REDMOND\brodes
9f9c353806
Update expected files. Copilot suggestions broke unit test expected results (column numbers).
2026-02-10 11:47:23 -05:00
REDMOND\brodes
4bb110beb8
More copilot suggestions.
2026-02-10 11:46:16 -05:00
REDMOND\brodes
a91cf6b7cb
Applying copilot PR suggestions.
2026-02-10 11:37:11 -05:00
Ben Rodes
9f8ed710e2
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-10 11:09:25 -05:00
REDMOND\brodes
f6c302b68c
Removing commented out test cases.
2026-02-06 11:28:48 -05:00
REDMOND\brodes
97f19d03ad
Updating test case expected alerts.
2026-02-06 11:20:13 -05:00
REDMOND\brodes
97ddab0724
Added support for new URIValidator in AntiSSRF library. Updated test caes to use postprocessing results. Currently results for partial ssrf still need work, it is flagging cases where the URL is fully controlled, but is sanitized. I'm not sure if this should be flagged yet.
2026-02-06 11:20:11 -05:00
Ben Rodes
08b72d0a86
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 11:18:51 -05:00
Ben Rodes
46a2a249f9
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-06 11:18:49 -05:00
REDMOND\brodes
9912aaaf1a
Adding azure sdk test cases and updated test expected file.
2026-02-06 11:18:16 -05:00
REDMOND\brodes
0a88425170
Python: Altering SSRF MaD to use 'request-forgery' tag. Update to test cases expected results, off by one line. Changed to using ModelOutput::sinkNode.
2026-02-04 09:04:22 -05:00
Ben Rodes
cd73dcfb04
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-04 08:55:38 -05:00
Owen Mansel-Chan
3f08ff88a4
Pretty print models in test
...
Otherwise the tests breaks when unrelated changes are made because the
model numbers change
2026-02-04 10:52:44 +00:00
Ben Rodes
7ddfa80399
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-02 09:00:35 -05:00
Owen Mansel-Chan
5204255615
Merge pull request #21234 from owen-mc/python/convert-sanitizers-to-mad
...
Python: Allow models-as-data sanitizers
2026-01-30 14:28:39 +00:00
Taus
958c798c3f
Python: Accept dataflow test changes
...
New nodes means new results. Luckily we rarely have a test that selects
_all_ dataflow nodes.
2026-01-30 12:50:25 +00:00
Taus
ac5a74448f
Python: Fix tests
...
With `ModuleVariableNode`s now appearing for _all_ global variables (not
just the ones that actually seem to be used), some of the tests changed
a bit. Mostly this was in the form of new flow (because of new nodes
that popped into existence). For some inline expectation tests, I opted
to instead exclude these results, as there was no suitable location to
annotate. For the normal tests, I just accepted the output (after having
vetted it carefully, of course).
2026-01-30 12:50:25 +00:00
Owen Mansel-Chan
ad6f800022
Pretty print model numbers in tests
2026-01-30 09:21:24 +00:00
yoff
e7a0fc7140
python: Add query for prompt injection
...
This pull request introduces a new CodeQL query for detecting prompt injection vulnerabilities in Python code targeting AI prompting APIs such as agents and openai. The changes includes a new experimental query, new taint flow and type models, a customizable dataflow configuration, documentation, and comprehensive test coverage.
2026-01-29 23:47:52 +01:00
Taus
34800d1519
Merge pull request #20945 from joefarebrother/python-websockets
...
Python: Model remote flow sources for the `websockets` library
2026-01-29 15:47:46 +01:00
Tom Hvitved
b974a84bef
Merge pull request #21051 from hvitved/shared/flow-summary-provenance-filtering
...
Shared: Provenance-based filtering of flow summaries
2026-01-26 17:24:34 +01:00
Tom Hvitved
0adece7cde
Python: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:19 +01:00
yoff
3dbfb9fa4b
python: add machinery for MaD barriers
...
and reinstate previously removed barrier
now as a MaD row
2026-01-22 17:30:24 +01:00
yoff
699ed50432
python: remove barrier that can be expressed in MaD
2026-01-22 17:30:24 +01:00
Taus
5414bd2716
Merge pull request #21134 from yoff/python/support-ListElement-in-MaD
...
Python support `ListElement` in MaD
2026-01-20 23:38:02 +01:00
