Rasmus Wriedt Larsen
71a6ef5b00
Python: Model RequestHandler from standard library explicitly
2020-12-21 18:02:31 +01:00
Rasmus Wriedt Larsen
004ff38e22
Python: Add separate RequestHandler concept
...
Since I really want to use our existing infrastructure to model that we can
recognize something as a request handler without it having a route, we need this
as a separate concept. All tests have been adjusted.
The early modeling was based on flask, where all request-handling is based on
handling requests from a specific route. But with the standard library handling
and handlers without routes, the naming had to change.
2020-12-21 17:31:58 +01:00
Rasmus Wriedt Larsen
272feedb69
Merge branch 'main' into stdlib-http-source-modeling
2020-12-15 11:59:23 +01:00
Rasmus Wriedt Larsen
8d8e92eb09
Python: Model execute on a DB connection
2020-12-14 10:33:10 +01:00
Rasmus Wriedt Larsen
36e8ef53eb
Python: Model sqlite3 as SQL interface
2020-12-09 11:36:18 +01:00
Rasmus Wriedt Larsen
767a246edc
Python: Add sqlite3 test
2020-12-09 11:36:17 +01:00
Rasmus Wriedt Larsen
ba1ca70858
Python: Add source modeling of stdlib HTTPRequestHandlers
2020-12-08 14:04:15 +01:00
Rasmus Wriedt Larsen
34863721f0
Python: Model cgi.FieldStorage
2020-12-08 14:03:13 +01:00
Rasmus Wriedt Larsen
43688715f5
Python: Add test of stdlib HTTP server facilities
...
Just a port of the old tests, except for the fact that I learned
`cgi.FieldStorage()` _should_ be tainted when not specifying any arguments. (and
moved taint-test to own function)
Also clarified how imports of all the .*HTTPRequestHandler works in Python2
2020-12-08 14:01:55 +01:00
Rasmus Wriedt Larsen
d88e5bdb3a
Python: Model io.open as FileSystemAccess
2020-11-24 18:27:33 +01:00
Rasmus Wriedt Larsen
e39bb56078
Python: Model builtin open function better
2020-11-24 18:27:31 +01:00
Rasmus Wriedt Larsen
5af1fdd06f
Python: Expand tests of open
2020-11-24 18:27:30 +01:00
Jonas Jensen
5680b2df13
Merge remote-tracking branch 'upstream/main' into better-syntax-for-false-positives-and-negatives-inline-expectation
...
Required fixing up semantic conflicts in tests.
Conflicts:
python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py
2020-11-03 09:47:26 +01:00
Taus Brock-Nannestad
5dadb0f476
Python: Fix imports in tests
2020-11-02 23:02:29 +01:00
Rasmus Wriedt Larsen
66f5d0d9d5
Python: Model encoding/decoding with base64 module
2020-11-02 14:44:53 +01:00
Mathias Vorreiter Pedersen
0bc4d52d66
Python: Update more tests annotations. It looks like we need to allow single-quote strings to support the existing Python use-cases, but let's do that in the next commit.
2020-10-31 17:40:19 +01:00
Mathias Vorreiter Pedersen
ed9ad8b5e3
Merge branch 'main' into better-syntax-for-false-positives-and-negatives-inline-expectation
2020-10-31 16:52:16 +01:00
Mathias Vorreiter Pedersen
45b24a9bc8
Python: Update inline-expectation tests
2020-10-30 16:53:33 +01:00
Rasmus Lerchedahl Petersen
2baed20067
Python: Test false negative from review
2020-10-27 08:30:16 +01:00
Rasmus Lerchedahl Petersen
b6313dddb9
Python: Add concept tests
2020-10-27 08:26:00 +01:00
Rasmus Lerchedahl Petersen
ef32488596
Merge branch 'main' of github.com:github/codeql into python-port-unsafe-deserialization
2020-10-15 15:45:35 +02:00
Rasmus Lerchedahl Petersen
172e058438
Python: unsafe -> mayExecuteInput
2020-10-15 12:56:29 +02:00
Rasmus Lerchedahl Petersen
3a281a1bd6
Python: Adjust comments and tests
2020-10-14 14:40:11 +02:00
yoff
ffe79f688d
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2020-10-14 14:08:16 +02:00
Rasmus Lerchedahl Petersen
b0ebb5b6d1
Python: Adjust tag format
2020-10-14 09:51:24 +02:00
Rasmus Lerchedahl Petersen
93383747bd
Python: Use more common name for concept
2020-10-14 09:28:58 +02:00
Rasmus Lerchedahl Petersen
a76d276b48
Python: Adjust getARelevantTag
2020-10-14 08:44:04 +02:00
Rasmus Lerchedahl Petersen
b7e8b48e9e
Python: Move concept tests out
...
These tests should be fleshed out at some point, but currently
they test all that we model.
2020-10-13 13:06:47 +02:00
Rasmus Wriedt Larsen
46ec7fbf6e
Python: Make builtin compile function additional taint step
2020-10-07 21:17:39 +02:00
Rasmus Wriedt Larsen
c69a61bac5
Python: Model exec and eval calls as CodeExecution
2020-10-07 21:14:19 +02:00
Rasmus Wriedt Larsen
453c391bb0
Python: Add CodeExecution tests for stdlib
2020-10-07 21:12:31 +02:00
Rasmus Wriedt Larsen
e5b9ac8d9c
Python: Use getCommand as tag in ConceptsTest
2020-10-02 14:12:41 +02:00
Rasmus Wriedt Larsen
6cb2ca63a6
Python: tests to show modeling is very syntactical
2020-09-28 11:23:06 +02:00
Rasmus Wriedt Larsen
3af5c720cc
Python: Add test of more indirect command injection sinks
2020-09-28 11:16:52 +02:00
Rasmus Wriedt Larsen
f7f6564189
Python: Model subprocess.Popen (and helpers)
2020-09-28 11:13:04 +02:00
Rasmus Wriedt Larsen
62dc0dd263
Python: Model os.exec* os.spawn* and os.posix_spawn*
...
I also had to exclude the inline expectation tests from files outside the test
repo.
2020-09-28 11:05:33 +02:00
Rasmus Wriedt Larsen
c440fd0c09
Python: Adjust expectations for system command executions
...
I mostly did this to show my reviewers that the tests actually run and do
something ;)
2020-09-28 11:05:33 +02:00
Rasmus Wriedt Larsen
060720aae7
Python: Add tests for all SystemCommandExecution from stdlib
...
Overall idea is that `test/experimental/meta/ConceptsTest.qll` will set up
inline expectation tests for all the classes defined in `Concepts.qll`, so any
time you model a new instance of Concepts, you simply just import that
file. That makes the tests a little verbose, but allows us to share test-setup
between all the different frameworks we model.
Note that since the definitions of SystemCommandExecution subclasses are
scattered across multieple framework modeling qll files, it think it makes the
most sense to have the tests for each framework in one location.
I'm not 100% convinced about if this is the right choice or not (especially when
we want to write tests for sanitizers), but for now I'm going to try it out at
least.
2020-09-28 11:05:32 +02:00
