CodeQL CI
b66e5c5aee
Merge pull request #10634 from yoff/python/rewrite-typetrackers
...
Approved by tausbn
2022-09-30 03:55:35 -07:00
Rasmus Lerchedahl Petersen
84ab860600
python: rewrite type tracker for ldap operations
...
There are several other clean ups I would like to do in this file,
but this can wait until we promote the query.
2022-09-29 20:32:19 +02:00
Rasmus Lerchedahl Petersen
63ee51a4e2
Python: inline mongoCollectionMethod
2022-09-28 11:40:06 +02:00
Rasmus Lerchedahl Petersen
441fc1bb28
Python: type trackers to API graph
...
base on new subscript in the API graph
There are a few more uses of type tracking
through `SubscriptNode`s, but these start
from an instance given by a data flow node.
2022-09-26 15:05:50 +02:00
Rasmus Lerchedahl Petersen
9b1ec03d70
Python: type tracking to API graph
...
using the new subscript node
2022-09-26 13:39:59 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
erik-krogh
cc7a9ef97a
rename more acronyms
2022-08-25 20:52:27 +02:00
erik-krogh
28083ebe09
run the implicit-this patch
2022-08-22 21:23:31 +02:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
erik-krogh
8066e39d07
delete some redundant imports
2022-08-17 13:50:04 +02:00
Raul Garcia
6b17890e4f
Fixing warning on usage of a deprecated feature.
2022-07-16 08:30:06 -07:00
Raul Garcia
f7c47b6c75
Update python/ql/src/experimental/Security/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.py
...
Co-authored-by: Taus <tausbn@github.com >
2022-07-13 08:34:48 -07:00
Raul Garcia
0dbb03f732
Adding CVE information.
2022-07-12 21:49:19 -07:00
Raul Garcia
d929b1338b
Addressing API::Node feedback for all predicates
2022-07-12 11:55:06 -07:00
Raul Garcia
d5791e2d56
Addressing feedback from the PR
2022-07-11 15:45:15 -07:00
Raul Garcia
ac05577966
Making various changes based on the feedback. Pending: 2 non-trivial fixes for Java & Python.
2022-07-11 13:25:35 -07:00
Raul Garcia
e5702d0e15
Update python/ql/src/experimental/Security/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: Taus <tausbn@github.com >
2022-07-11 13:07:37 -07:00
Raul Garcia
7fc9ae6c49
Update python/ql/src/experimental/Security/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: Taus <tausbn@github.com >
2022-07-11 13:07:20 -07:00
Raul Garcia
dd1a9a22e3
Update UnsafeUsageOfClientSideEncryptionVersion.qhelp
2022-07-05 13:58:38 -07:00
Raul Garcia
e43e5810cf
New queries to detect unsafe client side encryption in Azure Storage
2022-07-01 17:08:35 -07:00
Asger F
a522562f93
Merge pull request #9369 from asgerf/python/api-graph-api
...
Python: API graph renaming and documentation
2022-06-28 14:48:12 +02:00
Asger F
b096f9ec72
Python: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:06 +02:00
Anders Schack-Mulligen
f473a0a961
Python: Deprecate and replace BarrierGuard class.
2022-06-20 15:46:38 +02:00
yoff
699761889d
Merge pull request #7127 from jty-team/jty/python/emailInjection
...
Python: CWE-079 - Add Email injection query
2022-06-14 10:54:16 +02:00
jorgectf
171239b78f
Format FlaskMail.qll and Sendgrid.qll
2022-06-03 18:27:45 +02:00
Jorge
897d5c9471
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-06-01 12:44:08 +02:00
${sleep,7}
76c27c685f
Merge branch 'main' into jty/python/emailInjection
2022-05-26 16:27:57 -04:00
yoff
aadfa8eacd
Merge branch 'main' into py/CsvInjection
2022-05-25 10:43:08 +02:00
Taus
3745526d69
Merge pull request #9108 from RasmusWL/promote-pam
...
Python: Promote `py/pam-auth-bypass`
2022-05-23 15:27:12 +02:00
Erik Krogh Kristensen
215a6a72cc
Merge branch 'main' into useStringComp
2022-05-18 10:55:31 +02:00
Rasmus Wriedt Larsen
6611e5b4b8
Merge branch 'main' into promote-pam
2022-05-18 10:35:39 +02:00
Erik Krogh Kristensen
7245591468
Merge pull request #7763 from erik-krogh/unused-field
...
QL: add unused-field query
2022-05-18 09:15:16 +02:00
Erik Krogh Kristensen
86e97c32d6
fix all ql/use-string-compare
2022-05-17 14:11:05 +02:00
Rasmus Wriedt Larsen
795adf0566
Python: Fix API::moduleImport("foo.bar")
2022-05-12 13:33:00 +02:00
Rasmus Wriedt Larsen
cff950f5f7
Python: Fix select of py/insecure-cookie
2022-05-11 14:06:30 +02:00
Rasmus Wriedt Larsen
0956d506de
Python: Actually promote py/pam-auth-bypass
...
🤦
2022-05-11 13:44:47 +02:00
Rasmus Wriedt Larsen
fc8633cc01
Python: Fix select for py/cookie-injection
2022-05-11 13:18:14 +02:00
Rasmus Wriedt Larsen
27b99c51e9
Python: Add placeholder precision for py/insecure-cookie
2022-05-11 11:36:06 +02:00
Rasmus Wriedt Larsen
a902d3d8f0
Python: Add security-severity for py/insecure-cookie
...
Matching the Java query
7d4767a4f5/java/ql/src/Security/CWE/CWE-614/InsecureCookie.ql (L7)
2022-05-11 11:34:16 +02:00
Rasmus Wriedt Larsen
84ad45c665
Python: Fix Django import
2022-05-11 11:33:35 +02:00
Rasmus Wriedt Larsen
d127d2164a
Merge branch 'main' into jorgectf/python/insecure-cookie
2022-05-11 11:13:47 +02:00
Rasmus Wriedt Larsen
7e87e18b32
Python: Adjust name/description/select of PamAuthorization.ql
...
Thought that calling out the actual vulnerability would make things
easier for our end users :)
2022-05-10 18:02:17 +02:00
Rasmus Wriedt Larsen
c84f693151
Python: Adjust PamAuthorization examples
...
They did not have proper formatting (only 2 spaces), and I restructured
them a bit more so they look like code in the wild
2022-05-10 18:00:20 +02:00
Rasmus Wriedt Larsen
0c534444ad
Python: Format .qhelp file
...
99% of our .qhelp files have manually wrapped lines, so just wanted to
keep things consistent
2022-05-10 17:59:21 +02:00
Rasmus Wriedt Larsen
cb17e2a649
Merge pull request #8595 from porcupineyhairs/pypam
...
Python : Add query to detect PAM authorization bypass
2022-05-10 13:35:12 +02:00
Rasmus Wriedt Larsen
2421076d2f
Merge pull request #8696 from RasmusWL/new-nosql-examples
...
Python: Improve experimental modeling for `pymongo`
2022-05-10 11:03:05 +02:00
Rasmus Wriedt Larsen
c218162104
Merge branch 'main' into pypam
2022-05-09 14:20:05 +02:00
Rasmus Wriedt Larsen
ab1252d196
Python: Add @precision high for py/pam-auth-bypass
2022-05-09 14:19:40 +02:00
Rasmus Wriedt Larsen
5f01fc24e4
Merge branch 'main' into promote-xxe
2022-05-02 11:25:55 +02:00
Rasmus Wriedt Larsen
3c1a37e7e1
Merge branch 'main' into new-nosql-examples
2022-05-02 11:21:36 +02:00
