Erik Krogh Kristensen
ff73dbc35c
delete redundant imports
2022-04-22 12:55:28 +02:00
Rasmus Wriedt Larsen
2e788ea86e
Python: Accept deprecation warnings for old tests
2022-02-04 12:02:09 +01:00
Rasmus Wriedt Larsen
09a2a6cdfd
Python: Fix django re_path kwarg test
...
Since it was using the wrong keyword argument name before :D
2020-10-16 11:12:12 +02:00
Rasmus Wriedt Larsen
6cba2fe4f8
Python: Model Django response sinks that are not vuln to XSS
...
Since HttpResponse is not *only* used for XSS, it is still valuable to know the
content is send as part of the response.
The *proper* solution to this problem of not all HttpResponses being vulnerable
to XSS is probably to define a new abstract class in Http.qll called
HttpResponseXSSVulnerableSink (or similar). I would like to model a few more
libraries/frameworks before fully comitting to an approach though.
2020-05-26 16:45:46 +02:00
Rasmus Wriedt Larsen
3774310985
Python: Reduce FPs in Django due to bad XSS taint-sinks
...
Fixes https://github.com/github/codeql-python-team/issues/38
2020-05-18 19:14:43 +02:00
Rasmus Wriedt Larsen
fa08676a1d
Python: Proper redirect taint sinks for Django
...
Also a major restructuring of the code. A bit controversial since it
renames/moves classes that are already public.
Fixes https://github.com/github/codeql/issues/3466
2020-05-18 19:14:29 +02:00
Rasmus Wriedt Larsen
72ea4ff0dc
Python: Add more tests of django responses
...
They clearly shouldn't all be XSS sinks
2020-05-18 16:56:47 +02:00
Rasmus Wriedt Larsen
6d72e77cdf
Python: Django: Handle Class-based views
2020-03-11 14:44:14 +01:00
Rasmus Wriedt Larsen
2da1503942
Merge branch 'master' into python-support-django2
2020-03-11 11:21:47 +01:00
Rasmus Wriedt Larsen
f10a86d3ac
Python: Remove --optimize: true from options files
...
Tests will be run with optimizations on by default now.
2020-02-25 15:52:00 +01:00
Rasmus Wriedt Larsen
5a0babe88b
Python: Add support for Django 2.x and 3.x
...
I changed the django mock to support both 1.x and 2.x routing APIs, which is not
really a nice long term solution.
2020-02-18 11:22:35 +01:00
Rasmus Wriedt Larsen
362e7aebbb
Python: Add HttpRedirectSinks test for django
2020-02-17 16:54:06 +01:00
Rasmus Wriedt Larsen
a3c6472b9b
Python: Improve django tests (and prepare for v2 + v3 support)
2020-02-17 16:39:01 +01:00
Taus
895f2f74ab
Merge branch 'master' into python-clean-qltest-options
2020-02-12 13:44:41 +01:00
Rasmus Wriedt Larsen
efedcd26d0
Python: Django tests need --lang=3
2020-02-11 13:16:52 +01:00
Rasmus Wriedt Larsen
397c17c4ff
Python: Use --lang=3 in tests
...
With internal update to qltest it will not actually do something.
- also remove it from the tests that never needed it.
2020-02-06 14:20:59 +01:00
Rasmus Wriedt Larsen
c25782d6da
Python: For web tests, use more precise name HttpResponseSinks
...
Since there are also HttpRedirectTaintSink, using HttpSink is confusing
2020-01-28 13:06:48 +01:00
Rasmus Wriedt Larsen
6b87458c2e
Python: Add explicit tests for HttpSources and HttpSinks
...
Some of the tests currently fail, since they can't reproduce the old tests
results (since the sinks/sources defined in the library code are not
HttpResponseTaintSink/HttpRequestTaintSource)
2020-01-28 13:06:48 +01:00
Rasmus Wriedt Larsen
0a1c91fbb8
Python: Autoformat web tests QL files
2020-01-28 13:05:25 +01:00
Rasmus Wriedt Larsen
fc851b46c3
Python: Fix Django class-based views
2019-10-29 13:58:07 +01:00
Rasmus Wriedt Larsen
fb864b7262
Python: Consolidate tests for django
...
The tests in 3/ was not Python 3 specific anymore
2019-10-29 13:58:07 +01:00
Rasmus Wriedt Larsen
471318369b
Python: Don't quote %s in django example
...
This is vulnerable to SQL injection because of the quotes around %s -- added
some code that highlights this in test.py
Since our examples did this in the safe query, I ended up rewriting them
completely, causing a lot of trouble for myself :D
2019-10-29 13:58:07 +01:00
Rasmus Wriedt Larsen
afe7a0536c
Python: Support positional arguments in Django routes
2019-10-29 13:58:07 +01:00
Mark Shannon
90bbfd3b16
Python: Add library tests for django.
2019-04-26 16:21:46 +01:00
