Rasmus Wriedt Larsen
ae057c74cc
Python: ORM: Store step for constructor
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
f8a51bb994
Python: ORM: Add data-flow steps for Django ORM
...
Added dummy-whitespace to `orm_security_tests.py` so it would be
possible to see what the reflected XSS results are in the diff
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
d3f07cdc10
Python: ORM: Add qltests
...
Which shows that there is no flow yet, which is not really a surprise :D
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
c78fed6594
Python: ORM: Add raw python test files
...
no ql test files yet though, will come in next commit.
2022-02-28 16:38:40 +01:00
Rasmus Wriedt Larsen
f89fb50eb5
Python: ORM: Add boilerplate django project
...
By doing
```
django-admin startproject testproj
django-admin startapp testapp
```
2022-02-28 16:38:40 +01:00
haby0
be40b54b9f
add test
2022-02-28 20:34:58 +08:00
Arthur Baars
5044f89105
Ruby/Python re-introduce normalCharacterSequence
2022-02-25 18:43:43 +01:00
Arthur Baars
69ed121ecb
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-22 16:15:33 +01:00
Rasmus Wriedt Larsen
d2cd77aefb
Merge branch 'main' into dataflow-improvements
2022-02-21 14:49:40 +01:00
Rasmus Wriedt Larsen
2e788ea86e
Python: Accept deprecation warnings for old tests
2022-02-04 12:02:09 +01:00
Rasmus Wriedt Larsen
b2ce0fcb72
Python: Add post-update nodes to args of unresolved calls
...
Besides solving the problem with `setattr`, it also solved some old
problems with json library modeling (yay).
2022-02-04 11:51:53 +01:00
Erik Krogh Kristensen
5e23da813f
rename named-parameters to keyword-parameters
2022-02-03 23:10:39 +01:00
Erik Krogh Kristensen
3801a158a8
remove module exporst nodes from API graphs
2022-02-03 23:10:39 +01:00
Erik Krogh Kristensen
3be3da2eb6
add recursive API-graph test
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
ef5818e243
support import * in ApiGraphs
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
16774ba285
add support for named parameters in API graphs
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
095c73f1fe
redo the ApiGraph testing framework
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
66fd43fc3b
add def edge for function returns
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
d8eea7ba4c
property writes are def nodes
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
a908b219e9
more backtracking of def nodes, and lots of tests
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
038b032a43
get basic module exports to work in API-graphs
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
df9efbe778
get mimimal def nodes to work in python
2022-02-03 23:10:38 +01:00
Erik Krogh Kristensen
52ca0d168b
move API-graph tests out of the experimental test folder
2022-02-03 23:10:37 +01:00
Rasmus Wriedt Larsen
f962d8e72c
Python: Move test to correct location
2022-01-28 11:33:21 +01:00
Rasmus Wriedt Larsen
4338c06b0d
Python: Support Django FileField.upload_to
2022-01-27 17:20:16 +01:00
Rasmus Wriedt Larsen
301318020f
Merge pull request #7455 from haby0/py/add-shutil-module-path-injection-sinks
...
Python: Add shutil module sinks for path injection query
2022-01-24 20:06:36 +01:00
Erik Krogh Kristensen
ddfc3bc00f
use set literals instead of big disjunctions
2022-01-21 11:46:33 +01:00
Rasmus Wriedt Larsen
95e935e9c1
Python: Support SQLAlchemy scoped_session
2022-01-18 14:34:31 +01:00
haby0
759ec31508
Delete shutil_path_injection.py file
2022-01-06 21:38:35 +08:00
haby0
05b0daa0b7
Add the test of shutil module in FileSystemAccess.py
2022-01-06 14:14:42 +08:00
Rasmus Wriedt Larsen
6ce1524192
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-12-16 15:19:37 +01:00
Rasmus Wriedt Larsen
f8fc583af3
Python: client request: getUrl => getAUrlPart
...
I think `getUrl` is a bit too misleading, since from the name, I would
only ever expect ONE result for one request being made.
`getAUrlPart` captures that there could be multiple results, and that
they might not constitute a whole URl.
Which is the same naming I used when I tried to model this a long time ago
a80860cdc6/python/ql/lib/semmle/python/web/Http.qll (L102-L111)
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
6f81685f48
Python: Add modeling of http.client.HTTPResponse
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
a5bae30d81
Python: Add tests of http.client.HTTPResponse
2021-12-15 20:39:46 +01:00
Rasmus Wriedt Larsen
cf2ee0672f
Python: Model requests Responses
2021-12-13 15:09:46 +01:00
Rasmus Wriedt Larsen
35cba17642
Python: Consider taint of client http requests
2021-12-13 14:56:16 +01:00
Rasmus Wriedt Larsen
b68d280129
Python: Add modeling of requests
2021-12-13 14:56:16 +01:00
Rasmus Wriedt Larsen
1ff56d5143
Python: Add tests of requests
...
Also adjusts test slightly. Writing
`clientRequestDisablesCertValidation=False` to mean that certificate
validation was disabled by the `False` expression is just confusing, as
it easily reads as _certificate validate was NOT disabled_ :|
The new one ties to each request that is being made, which seems like
the right setup.
2021-12-13 14:07:32 +01:00
yoff
d8857c7ce8
Merge pull request #7246 from tausbn/python/import-star-flow
...
Python: Support flow through `import *`
2021-12-10 16:34:32 +01:00
yoff
8e11c2c476
Merge pull request #7259 from RasmusWL/even-more-path-injection-sinks
...
Python: Add more path-injection sinks from `os` and `tempfile` modules
2021-12-09 14:46:41 +01:00
Nick Rolfe
05415768c9
Merge remote-tracking branch 'origin/main' into nickrolfe/regexp_g_anchor
2021-12-02 12:07:13 +00:00
yoff
f10f053c36
Merge pull request #7228 from RasmusWL/fastapi-improvements
...
Python: FastAPI improvements
2021-12-02 12:58:53 +01:00
yoff
19802ccb73
Merge pull request #7046 from RasmusWL/django-own-json-response
...
Python: Add test with custom django json response (FP)
2021-11-29 16:05:20 +01:00
Rasmus Wriedt Larsen
cbd7434a7e
Python: Add modeling of tempfile module
2021-11-29 15:08:36 +01:00
Rasmus Wriedt Larsen
b68538376c
Python: Add tests of tempfile module
2021-11-29 15:08:36 +01:00
Rasmus Wriedt Larsen
58f92764f7
Python: Model more file access from os module
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
e79b8f3e23
Python: Treat os.exec*, os.spawn*, and os.posix_spawn* as FileSystemAccess
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
d2d5cce787
Python: Recognize keyword arguments for os.*spawn* calls
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
14590436f9
Python: Expand tests for os.exec*, os.spawn*, and os.posix_spawn*
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
50d3592ad3
Python: Add more complete tests of os module
...
I went through https://docs.python.org/3.10/library/os.html in order,
and added all the functions that works on paths.
`lstat` and `statvfs` were already modeled, but did not have any tests.
2021-11-29 14:54:02 +01:00
