Rasmus Wriedt Larsen
01d426dc58
Python: Replace rest of from testlib import *
...
I think we should write our tests in a way that puts points-to in the
best condition to resolve calls. Although this specific change did not
change much, it should help set us up for success in the future 👍
2022-02-28 10:58:44 +01:00
Rasmus Wriedt Larsen
ead0b658d2
Python: Fix fieldflow tests by increasing max-import-depth
2022-02-28 10:58:44 +01:00
Rasmus Wriedt Larsen
a0d1cea490
Python: Add investigation of field-flow problem
...
TL;DR; we used a too low value for `--max-import-depth` :(
2022-02-28 10:58:44 +01:00
Arthur Baars
5044f89105
Ruby/Python re-introduce normalCharacterSequence
2022-02-25 18:43:43 +01:00
Rasmus Wriedt Larsen
f988e1f0d8
Python: Improve field-flow by removing import *
...
Since that apparently impacts call graph resolution with points-to :O
Also interesting that global flow was only not working for those cases
because of the tricky ifs... still need to 100% figure out how those ifs
are messing up the analysis :|
2022-02-25 16:01:08 +01:00
Rasmus Wriedt Larsen
999af15bd5
Python: Show unresolved calls for field-flow tests
2022-02-25 15:58:07 +01:00
yoff
8b926f6859
Merge pull request #7873 from RasmusWL/fix-attribute-taint
...
Python: Fix attribute taint
2022-02-25 15:02:24 +01:00
Rasmus Wriedt Larsen
2d0034c40d
Python: Replicate global field-flow failures
2022-02-25 14:14:00 +01:00
Rasmus Wriedt Larsen
faaa63a73c
Python: Ensure no cross-talk in global tests
...
By giving all variables unique names
I also added a comment with the function name from the normal tests, so
its' easily visible what these tests are testing
2022-02-25 13:41:51 +01:00
Rasmus Wriedt Larsen
0642610ee9
Python: Global flow works when in own file???
...
This is very suspicious
2022-02-25 13:36:00 +01:00
Rasmus Wriedt Larsen
d83a9ef8d3
Python: Fix global field-flow for validTest.py
2022-02-25 13:35:43 +01:00
Rasmus Wriedt Larsen
abe4d8da62
Python: Accept global field-flow inconsistencies
...
Yikes
2022-02-24 15:07:18 +01:00
Rasmus Wriedt Larsen
94d23f3817
Python: Also do all field-flow tests in global scope
...
Notice that these tests don't pass, to show how they differ in the next
commit!
2022-02-24 15:06:40 +01:00
Rasmus Wriedt Larsen
2da4b39844
Python: Add global field-flow tests
...
I thought it was interesting that it did not propagate flow to the uses
inside the functions :O
2022-02-24 13:15:48 +01:00
Rasmus Wriedt Larsen
aeba497832
Merge pull request #7735 from yoff/python/promote-log-injection
...
Python: promote log injection
2022-02-23 16:21:12 +01:00
Taus
3ce7d47b5b
Merge pull request #7452 from jorgectf/python_jwt
...
Python: Add Python_JWT to JWT security query
2022-02-23 15:23:20 +01:00
jorgectf
4aa1c0a11e
Update .expected
2022-02-23 00:55:39 +01:00
jorgectf
7c108c7892
Polish test
2022-02-22 20:57:20 +01:00
Arthur Baars
69ed121ecb
Ruby/Python: regex parser: group sequences of 'normal' characters
2022-02-22 16:15:33 +01:00
Rasmus Wriedt Larsen
d2cd77aefb
Merge branch 'main' into dataflow-improvements
2022-02-21 14:49:40 +01:00
Rasmus Wriedt Larsen
b59ab7f5f3
Merge branch 'main' into python/promote-log-injection
2022-02-21 09:59:31 +01:00
Rasmus Wriedt Larsen
9d81fd3b95
Python: Improve sanitizer/guards tests
...
Based on review conversation
2022-02-18 14:12:41 +01:00
Rasmus Wriedt Larsen
7aa559f4aa
Python: Restore dataflow consistency queries
2022-02-18 13:47:29 +01:00
Rasmus Wriedt Larsen
c5b6fb37b7
Python: Clean up NormalDataflowTest.qll
2022-02-18 13:47:29 +01:00
Rasmus Wriedt Larsen
67ca14876a
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-02-18 13:47:07 +01:00
Rasmus Wriedt Larsen
5a90214ece
Merge pull request #7783 from yoff/python/promote-ldap-injection
...
Python: promote LDAP injection query
2022-02-15 10:24:18 +01:00
yoff
de5b3a272d
Merge pull request #7660 from RasmusWL/deprecate-old-modeling
...
Python: Deprecate old points-to based modeling
2022-02-14 19:48:03 +01:00
Rasmus Lerchedahl Petersen
84447e4710
python: more detailed alert message
2022-02-14 11:55:07 +01:00
Taus
d7f30de5b0
Merge pull request #7874 from RasmusWL/set-store-step
...
Python: Fix setStoreStep to use `SetElementContent`
2022-02-11 12:50:02 +01:00
Rasmus Wriedt Larsen
94f9656e8e
Python: Solve deprecation warnings for old experimental queries
2022-02-10 00:09:43 +01:00
jorgectf
85b5ef36ae
XmlInjection -> XmlEntityInjection
2022-02-09 13:28:56 +01:00
jorgectf
3ccac4ed8a
Update .expected
2022-02-08 23:59:36 +01:00
jorgectf
7b51b91d13
Improve test
2022-02-08 23:33:43 +01:00
Jorge
f1fab98ea2
Merge branch 'github:main' into python_jwt
2022-02-08 23:12:58 +01:00
Taus Brock-Nannestad
54ae744b2c
Python: Also update Python 2 file
2022-02-08 22:08:53 +01:00
jorgectf
b00051e4ab
Update .expected
2022-02-08 17:52:37 +01:00
jorgectf
7c4a6a12b0
Test polish
2022-02-08 17:50:39 +01:00
jorgectf
8f9cd16806
Update
2022-02-08 17:23:18 +01:00
Taus Brock-Nannestad
6ea8986daa
Python: Normalise string prefixes
2022-02-08 16:48:17 +01:00
Rasmus Lerchedahl Petersen
103b5761f3
python: remove superfluous configuration
...
this also removes duplicated nodes and edges
in the path results
2022-02-08 11:34:11 +01:00
Rasmus Lerchedahl Petersen
88efcff818
python: move query
...
and update reference in query test
2022-02-08 11:24:09 +01:00
Rasmus Lerchedahl Petersen
e51ba6f421
python: rename test directory
2022-02-08 11:20:10 +01:00
Rasmus Lerchedahl Petersen
e52dca0a35
python: move tests
2022-02-08 11:19:28 +01:00
Rasmus Wriedt Larsen
a8edd44a3c
Python: Update .expected
2022-02-08 11:12:34 +01:00
Rasmus Wriedt Larsen
eb109828c0
Merge pull request #7252 from museljh/feature/cwe-338
...
Python: CWE-338 insecureRandomness
2022-02-07 19:30:06 +01:00
Rasmus Wriedt Larsen
b276b2d48c
Python: Clean up taint steps for attributes
2022-02-07 13:12:31 +01:00
Rasmus Wriedt Larsen
59160eeb24
Python: Add test showing taint for attr store
...
In `x.arg = TAINTED_STRING` there is a store step to the attribute `arg`
of `x`. In our taint modeling, we allow _any_ store step with the code
below. This means that we also say there is a taint-step directly from
`TAINTED_STRING` to `x` :|
```codeql
// construction by literal
// TODO: Not limiting the content argument here feels like a BIG hack, but we currently get nothing for free :|
DataFlowPrivate::storeStep(nodeFrom, _, nodeTo)
```
2022-02-07 13:12:28 +01:00
jorgectf
43fde3561f
Merge branch 'jorgectf/python/deserialization' of https://github.com/jorgectf/codeql into jorgectf/python/deserialization
2022-02-04 16:32:11 +01:00
Jorge
d96eb01b9c
Merge branch 'github:main' into jorgectf/python/deserialization
2022-02-04 16:32:01 +01:00
Rasmus Wriedt Larsen
2e788ea86e
Python: Accept deprecation warnings for old tests
2022-02-04 12:02:09 +01:00
