Taus
25e88ed585
Merge pull request #4588 from yoff/python-pep-249
...
Python: Model PEP 249
2020-11-02 18:57:15 +01:00
Rasmus Lerchedahl Petersen
ea74c7f12b
Python: add tests
2020-11-02 17:59:51 +01:00
Taus
2dfffdbab8
Merge pull request #4590 from RasmusWL/python-model-base64
...
Python: Model encoding/decoding with base64 module
2020-11-02 17:00:21 +01:00
Rasmus Wriedt Larsen
247fd4f5f3
Python: Make encoding/decoding preserve taint automatically
...
With the way we have set things up, there is no way to opt out of this behavior.
2020-11-02 14:53:30 +01:00
Rasmus Wriedt Larsen
66f5d0d9d5
Python: Model encoding/decoding with base64 module
2020-11-02 14:44:53 +01:00
Rasmus Wriedt Larsen
eff244db71
Python: Add Encoding concept
...
I wasn't able to find a good opposite of "parsing", so left that out of the list
of intended purposes.
2020-11-02 14:19:20 +01:00
Taus Brock-Nannestad
f84ab2fa99
Python: Remove old data-flow tests
2020-11-02 14:07:04 +01:00
Taus Brock-Nannestad
9d6c07c8df
Python: Add copy of old queries
2020-11-02 13:35:20 +01:00
Taus Brock-Nannestad
b620b9b7c6
Python: Fixup CWE-022 tests
...
This was a bit of a mess, since there was crosstalk between the
TarSlip and PathInjection queries. (Also one of these needs the
`options` file to be in one way, and the other not). To fix this, I
split these out into separate directories.
2020-11-02 11:46:28 +01:00
Taus Brock-Nannestad
af7626a6b3
Python: Fixup CWE-079 tests
2020-11-02 11:46:02 +01:00
Taus Brock-Nannestad
57b51090ef
Python: Fixup CWE-094 tests
2020-11-02 11:45:44 +01:00
Taus Brock-Nannestad
ebb593466d
Python: Fixup CWE-089 tests
2020-11-02 11:45:14 +01:00
Taus Brock-Nannestad
7a395bf7c8
Python: Fixup CWE-078 tests.
2020-11-02 11:44:42 +01:00
Taus Brock-Nannestad
52dc905037
Python: Fixup CWE-502 tests.
2020-11-02 11:44:00 +01:00
Mathias Vorreiter Pedersen
6d0783a3bd
Python: Make sure that expected values with tag mimetype is wrapped in quotes if the value contains a space.
2020-10-31 18:13:12 +01:00
Mathias Vorreiter Pedersen
870ed0039b
Python: Allow single quote strings and accept test changes.
2020-10-31 18:01:55 +01:00
Mathias Vorreiter Pedersen
0bc4d52d66
Python: Update more tests annotations. It looks like we need to allow single-quote strings to support the existing Python use-cases, but let's do that in the next commit.
2020-10-31 17:40:19 +01:00
Mathias Vorreiter Pedersen
ed9ad8b5e3
Merge branch 'main' into better-syntax-for-false-positives-and-negatives-inline-expectation
2020-10-31 16:52:16 +01:00
Rasmus Lerchedahl Petersen
80360450de
Merge branch 'main' of github.com:github/codeql into RasmusWL-python-port-reflected-xss
2020-10-30 17:56:36 +01:00
Rasmus Lerchedahl Petersen
ef9999a4a1
Python: fix test annotation
2020-10-30 17:43:56 +01:00
Rasmus Lerchedahl Petersen
37ad59a92a
Python: subclas of known subclasses
2020-10-30 17:37:54 +01:00
Mathias Vorreiter Pedersen
45b24a9bc8
Python: Update inline-expectation tests
2020-10-30 16:53:33 +01:00
Mathias Vorreiter Pedersen
6ac740a490
Python: Sync identical file
2020-10-30 16:53:17 +01:00
Rasmus Lerchedahl Petersen
e7c9bc388b
Python: support some custom subclasses
2020-10-30 14:16:48 +01:00
Rasmus Lerchedahl Petersen
e69349791a
Python: django.http.response.HttpRequest.write
2020-10-30 12:51:23 +01:00
Rasmus Lerchedahl Petersen
ffe10d1b7c
Python: test HttpResponse.write
2020-10-30 12:16:12 +01:00
Rasmus Lerchedahl Petersen
fa3a7e6686
Python: Known subclasses of HttpResponse
2020-10-30 11:53:24 +01:00
Rasmus Lerchedahl Petersen
c962377ef4
Python: test for subclasses
2020-10-30 10:37:40 +01:00
Rasmus Lerchedahl Petersen
08af839757
Python: django.http.response.HttpResponseRedirect
2020-10-30 01:29:49 +01:00
Rasmus Lerchedahl Petersen
52be896666
Python: django.http.response.JsonResponse
...
It s possible this class is not relevant to XSS
2020-10-30 01:05:36 +01:00
Rasmus Lerchedahl Petersen
0f9b8595d1
Python: rename functions by vulnerability
2020-10-30 00:51:09 +01:00
Rasmus Lerchedahl Petersen
97153b56ad
Python: add false negatives to test
2020-10-30 00:48:19 +01:00
Rasmus Lerchedahl Petersen
2ca86f5ea7
Python: django.http.response.HttpResponse
2020-10-30 00:22:53 +01:00
Mathias Vorreiter Pedersen
acf6ffb990
Python: Sync identical file
2020-10-29 19:07:10 +01:00
Rasmus Lerchedahl Petersen
96e79a2702
Python: restrict to python files
2020-10-29 15:00:47 +01:00
Rasmus Lerchedahl Petersen
6658ee9dc8
Merge branch 'python-port-reflected-xss' of https://github.com/RasmusWL/codeql into RasmusWL-python-port-reflected-xss
2020-10-29 12:46:44 +01:00
Rasmus Lerchedahl Petersen
9fd1bf60fa
Merge branch 'main' of github.com:github/codeql into python-port-path-injection
2020-10-28 10:24:23 +01:00
Rasmus Lerchedahl Petersen
164acf4055
Python: test that aliasing is not a problem
2020-10-27 11:25:58 +01:00
Rasmus Lerchedahl Petersen
2baed20067
Python: Test false negative from review
2020-10-27 08:30:16 +01:00
Rasmus Lerchedahl Petersen
b6313dddb9
Python: Add concept tests
2020-10-27 08:26:00 +01:00
Rasmus Lerchedahl Petersen
8350d64763
Python: Add concept test definitions
2020-10-27 08:00:53 +01:00
Rasmus Lerchedahl Petersen
d89e985246
Python: Test showing chaining FP
2020-10-24 09:20:30 +02:00
Rasmus Lerchedahl Petersen
022cf0b2cc
Python: Add test from tracking issue
...
All tests pass, but there are spurious paths
due to configuration chaining.
2020-10-24 09:07:43 +02:00
Rasmus Lerchedahl Petersen
821b0c918a
Python: Additional taintstep for normpath
...
Is it ok to have this in general?
2020-10-23 16:35:10 +02:00
Rasmus Wriedt Larsen
aa9f15af76
Python: Fix typo
...
Co-authored-by: Taus <tausbn@github.com >
2020-10-23 15:39:38 +02:00
Rasmus Lerchedahl Petersen
f87845b1ec
Python: Copy old test
2020-10-23 14:52:07 +02:00
Rasmus Wriedt Larsen
d295c64ccd
Python: Add example of flask response .set_data
2020-10-23 14:31:36 +02:00
Rasmus Wriedt Larsen
eb545204ec
Python: Show that reflected XSS works now
...
Also did autoformatting, but the important part is the change to the .expected file
2020-10-23 14:31:35 +02:00
Rasmus Wriedt Larsen
d2cfa91155
Python: Add some tricky tests of return in flask route handler
...
In these cases the `return` might end up creating a new HTTP response, so they
need to be modeled as such.
Initially I created a very naive solution that didn't handle either
tricky_return1 or tricky_return2.
The interaction in tricky_return2/helper highlighted for me that to handle this
properly, due to the fact that the flow is across functions, we either need to
use a global dataflow/taint-tracking configuration, or some clever use of
type-trackers.
In the end, this extra effort for not modeling all returns in a flask route
handler as a creation of a HTTP response doesn't really seem to be worth it (at
least not right now). Sicne we use it with taint-tracking for the Reflected XSS
query, and use a HTTP response _creation_ as the sink (without propagating taint
to the HTTP response), we won't get into trouble where we report a path to BOTH
`make_response(...)` and the `return`
```
resp = make_response(...)
return resp
```
If we change this setup in the future, we will probably need to do something to
avoid this double-path reporting.
2020-10-23 14:31:35 +02:00
Rasmus Wriedt Larsen
d60221b168
Python: Model return from flask handler as HTTP response
...
When dealing with
```
resp = make_response(...)
return resp
```
ideally we don't want to mark the return as a creation of a HTTP response. I'll
deal with this in a second commit, to show off how annoying it looks in the
tests right now :D
2020-10-23 14:31:34 +02:00
