Rasmus Lerchedahl Petersen
d1200d0cd5
python: fix change-note formatting
2022-02-14 12:22:29 +01:00
Rasmus Lerchedahl Petersen
84447e4710
python: more detailed alert message
2022-02-14 11:55:07 +01:00
Rasmus Lerchedahl Petersen
bd14adefa0
python: add apologetic comment
2022-02-14 11:37:46 +01:00
root
5ed5e0b105
Add query to detect ZipSlip
2022-02-13 16:44:27 -05:00
Chuan-kai Lin
9b4dbb9dd8
Merge pull request #7895 from github/cklin/upgrades-initial-dbscheme
...
Upgrade scripts testing: set initial dbschemes
2022-02-11 11:06:12 -08:00
Taus
d7f30de5b0
Merge pull request #7874 from RasmusWL/set-store-step
...
Python: Fix setStoreStep to use `SetElementContent`
2022-02-11 12:50:02 +01:00
github-actions[bot]
21bf29353f
Post-release preparation for codeql-cli-2.8.1
2022-02-11 11:07:31 +00:00
github-actions[bot]
f25fc70b7c
Release preparation for version 2.8.1
2022-02-10 22:08:24 +00:00
Taus Brock-Nannestad
be323bafaf
Merge remote-tracking branch 'upstream/main' into python-normalise-prefixes
2022-02-10 12:55:49 +01:00
Tom Hvitved
58d90c7f8d
Python: More points-to performance improvements
2022-02-10 10:29:30 +01:00
Tom Hvitved
7fd8d6dd30
Address review comments
2022-02-10 10:29:30 +01:00
Tom Hvitved
2de892bfd8
Python: Points-to performance improvements
2022-02-10 10:29:30 +01:00
Rasmus Wriedt Larsen
94f9656e8e
Python: Solve deprecation warnings for old experimental queries
2022-02-10 00:09:43 +01:00
Tamás Vajk
6483a92587
Merge pull request #7865 from github/post-release-prep/codeql-cli-2.8.0
...
Post-release preparation for codeql-cli-2.8.0
2022-02-09 16:42:38 +01:00
Rasmus Lerchedahl Petersen
aa010e420b
python: update qhelp
2022-02-09 15:27:39 +01:00
Rasmus Lerchedahl Petersen
75a2f92ce4
pthon: add change note
2022-02-09 15:23:36 +01:00
Rasmus Lerchedahl Petersen
313f9f056c
python: switch to using concepts
2022-02-09 14:36:48 +01:00
Rasmus Lerchedahl Petersen
17aa2898f9
python: model (xpathEval from) libxml2
2022-02-09 14:25:43 +01:00
Rasmus Lerchedahl Petersen
e8649d8947
python: model (etree from) lxml
2022-02-09 14:15:17 +01:00
Rasmus Wriedt Larsen
9d5e8d5bd8
Merge pull request #7842 from RasmusWL/consistency-queires
...
Misc: Streamline `consistency-queries/qlpack.yml`
2022-02-09 13:42:18 +01:00
jorgectf
85b5ef36ae
XmlInjection -> XmlEntityInjection
2022-02-09 13:28:56 +01:00
Tom Hvitved
9440a45015
Merge branch 'main' into post-release-prep/codeql-cli-2.8.0
2022-02-09 09:40:33 +01:00
yoff
f21ac04285
Update python/ql/lib/semmle/python/frameworks/Stdlib.qll
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-02-09 09:22:31 +01:00
jorgectf
3ccac4ed8a
Update .expected
2022-02-08 23:59:36 +01:00
jorgectf
c6d8b97871
Make verifyCall() a private predicate
2022-02-08 23:37:17 +01:00
jorgectf
7b51b91d13
Improve test
2022-02-08 23:33:43 +01:00
jorgectf
ed60d16367
Refactor the way to check the verifying call
2022-02-08 23:33:30 +01:00
Jorge
f1fab98ea2
Merge branch 'github:main' into python_jwt
2022-02-08 23:12:58 +01:00
Taus Brock-Nannestad
54ae744b2c
Python: Also update Python 2 file
2022-02-08 22:08:53 +01:00
Chuan-kai Lin
a7f1ee574c
Upgrade scripts testing: set initial dbschemes
...
This commit sets initial dbschemes for cpp, csharp, java, javascript, and
python so that automated testing for upgrade scripts would also cover legacy
upgrades.
2022-02-08 11:11:41 -08:00
jorgectf
b00051e4ab
Update .expected
2022-02-08 17:52:37 +01:00
jorgectf
01ad25f3f0
Apply .getALocalSource() and fix xmltodict's vulnerable predicate
2022-02-08 17:51:09 +01:00
jorgectf
7c4a6a12b0
Test polish
2022-02-08 17:50:39 +01:00
jorgectf
8f9cd16806
Update
2022-02-08 17:23:18 +01:00
Taus Brock-Nannestad
6ea8986daa
Python: Normalise string prefixes
2022-02-08 16:48:17 +01:00
Rasmus Lerchedahl Petersen
3f36ccba92
python: add name to concept
2022-02-08 12:40:13 +01:00
Rasmus Lerchedahl Petersen
8665fe4817
python: add concept for XPath construction
...
also small fixup in `SqlConstruction`
2022-02-08 12:31:37 +01:00
Rasmus Wriedt Larsen
3e01816f0c
Python: Add change-note
2022-02-08 12:03:40 +01:00
Rasmus Lerchedahl Petersen
7d287f1698
python: add concept for xpath execution
2022-02-08 11:46:28 +01:00
Rasmus Lerchedahl Petersen
103b5761f3
python: remove superfluous configuration
...
this also removes duplicated nodes and edges
in the path results
2022-02-08 11:34:11 +01:00
Rasmus Lerchedahl Petersen
a9cfc60ea1
python: move supporting libraries
...
and update reference in query
2022-02-08 11:27:45 +01:00
Rasmus Lerchedahl Petersen
88efcff818
python: move query
...
and update reference in query test
2022-02-08 11:24:09 +01:00
Rasmus Lerchedahl Petersen
e51ba6f421
python: rename test directory
2022-02-08 11:20:10 +01:00
Rasmus Lerchedahl Petersen
e52dca0a35
python: move tests
2022-02-08 11:19:28 +01:00
Rasmus Wriedt Larsen
a8edd44a3c
Python: Update .expected
2022-02-08 11:12:34 +01:00
Rasmus Wriedt Larsen
eb109828c0
Merge pull request #7252 from museljh/feature/cwe-338
...
Python: CWE-338 insecureRandomness
2022-02-07 19:30:06 +01:00
Rasmus Wriedt Larsen
62702d0ca9
Python: Fix setStoreStep to use SetElementContent
2022-02-07 13:18:36 +01:00
Rasmus Wriedt Larsen
b276b2d48c
Python: Clean up taint steps for attributes
2022-02-07 13:12:31 +01:00
Rasmus Wriedt Larsen
59160eeb24
Python: Add test showing taint for attr store
...
In `x.arg = TAINTED_STRING` there is a store step to the attribute `arg`
of `x`. In our taint modeling, we allow _any_ store step with the code
below. This means that we also say there is a taint-step directly from
`TAINTED_STRING` to `x` :|
```codeql
// construction by literal
// TODO: Not limiting the content argument here feels like a BIG hack, but we currently get nothing for free :|
DataFlowPrivate::storeStep(nodeFrom, _, nodeTo)
```
2022-02-07 13:12:28 +01:00
Rasmus Wriedt Larsen
32cd7d6fa7
Add groups to all consistency-queries/qlpack.yml
...
as discussed in PR review
2022-02-07 11:15:48 +01:00
