yoff
1788507571
python: add qldoc
2022-06-27 21:00:12 +00:00
Rasmus Lerchedahl Petersen
a1fe8a5b2b
python: handle not in BarrierGuard
...
in the program
```python
if not is_safe(path):
return
```
the last node in the `ConditionBlock` is `not is_safe(path)`,
so it would never match "a call to is_safe".
Thus, guards inside `not` would not be part of `GuardNode`
(nor `BarrierGuard`). Now they can.
2022-06-27 20:10:47 +00:00
Taus
dc0f50d49a
Python: Clean up variable names
...
Makes it more consistent with the names used in
`legalMergeCandidateNonEmpty`.
2022-06-27 19:54:09 +00:00
Taus
8fc9ce9699
Python: Fix bad join in MRO
...
Fixes a bad join in `list_of_linearization_of_bases_plus_bases`.
Previvously, we joined together `ConsList` and `getBase` before filtering
these out using the recursive call. Now we do the recursion first.
Co-authored-by: yoff <yoff@github.com >
2022-06-27 19:54:09 +00:00
Asger F
cc57cb8af5
Merge branch 'main' into post-release-prep/codeql-cli-2.10.0
2022-06-27 20:37:25 +02:00
Rasmus Wriedt Larsen
9e154ff4bd
Merge branch 'main' into python/port-tarslip
2022-06-27 14:36:15 +02:00
Erik Krogh Kristensen
9bc12ed8fd
sync review changes to other languages
2022-06-24 13:12:15 +02:00
Erik Krogh Kristensen
28ac47689f
changes based on reviews
2022-06-24 13:11:46 +02:00
github-actions[bot]
d506f448ef
Post-release preparation for codeql-cli-2.10.0
2022-06-24 07:36:33 +00:00
Anders Schack-Mulligen
dc517a758e
Autoformat
2022-06-23 14:44:40 +02:00
Erik Krogh Kristensen
724721c5c8
fix typo
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
22871138c6
simplify the recursion between TTrace and isReachableFromStartTuple
...
similar to the fix made by Shack in `ExponentialBackTracking.qll`
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
be37763125
improve performance of process() by pruning accept states early
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
bf20b7dfc5
add change note for the ReDoS renamings
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
3bea7df45d
add deprecated aliases in the old locations, and use the Query.qll pattern for js/polynomial-redos
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
13482fc97b
rename ReDoSUtil to NfaUtils, and rename the "performance" folder to "regexp"
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
6b0df9bdfb
refactor the concretize algorithm
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
dbeae9aefb
make a parameterized module out of the RegexpMatching implementation
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
7fb3d81d2f
add further normalization of char classses
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
3be4a86acd
make ReDoSPruning into a parameterized module
2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen
dc06e9df02
move predicates that depend on isReDoSCandidate into a ReDoSPruning module
2022-06-23 14:36:24 +02:00
Anders Schack-Mulligen
4a317a25d3
Dataflow: Sync.
2022-06-23 14:34:52 +02:00
github-actions[bot]
a74051c658
Release preparation for version 2.10.0
2022-06-23 11:17:46 +00:00
Rasmus Wriedt Larsen
3248f7b423
Merge pull request #9649 from RasmusWL/certificate-modeling
...
Python/JS/Ruby: Ignore common words (like certain) as sensitive data source
2022-06-23 12:04:58 +02:00
Rasmus Wriedt Larsen
876ba71d9b
Python/JS/Ruby: Add change-note
2022-06-22 11:14:05 +02:00
Rasmus Wriedt Larsen
4be375521f
Python: Handle _ in sensitive-data-sources
2022-06-22 11:05:14 +02:00
Rasmus Wriedt Larsen
5dc2bb717a
Python: ignore common words (certain/concert) as sensitive source
2022-06-22 11:05:05 +02:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
Anders Schack-Mulligen
f8f9b7d3b4
Apply suggestions from code review
2022-06-21 14:11:36 +02:00
Asger F
092a6a01ac
Python: Update member documentation
2022-06-21 12:44:06 +02:00
Asger F
fecbfa6ca3
Python: add deprecation
2022-06-21 12:44:06 +02:00
Asger F
3a669a8d21
Python: getAValueReachingRhs -> getAValueReachingSink
2022-06-21 12:44:06 +02:00
Asger F
b096f9ec72
Python: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:06 +02:00
Asger F
181a53bd03
Python: Rename getAnImmediateUse -> asSource
2022-06-21 12:44:06 +02:00
Asger F
60fde3c031
Python: Rename getARhs -> asSink
2022-06-21 12:44:06 +02:00
Asger F
8f259d4bb6
Python: port API graph doc comment
2022-06-21 12:44:06 +02:00
Edoardo Pirovano
70dbd92e25
Bump minor version of all regularly released packs
2022-06-21 11:22:58 +01:00
Edoardo Pirovano
ad02b85efa
Merge branch main into rc/3.6
2022-06-21 11:15:25 +01:00
Anders Schack-Mulligen
a4796e1542
Add change notes.
2022-06-21 11:17:47 +02:00
Anders Schack-Mulligen
a6c0a9e480
Python: one more fix
2022-06-21 09:19:45 +02:00
Anders Schack-Mulligen
f473a0a961
Python: Deprecate and replace BarrierGuard class.
2022-06-20 15:46:38 +02:00
yoff
94145e9e74
Update python/ql/lib/semmle/python/security/dataflow/TarSlipCustomizations.qll
2022-06-20 10:14:52 +02:00
Rasmus Wriedt Larsen
f1b0a814e0
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-06-17 15:04:57 +02:00
Anders Schack-Mulligen
6518a01ded
Dataflow: Sync.
2022-06-16 11:25:28 +02:00
Rasmus Wriedt Larsen
d6e68258a4
Python: API-graphs: allow class decorators in .getASubclass()
2022-06-15 17:30:34 +02:00
github-actions[bot]
1ed70d51d7
Post-release preparation for codeql-cli-2.9.4
2022-06-15 13:25:20 +00:00
Rasmus Lerchedahl Petersen
0608d4d2f9
python: fix alerts
...
Also, remove the `toLowerCase` again,
as I do not know what effect it will have.
2022-06-15 14:18:29 +02:00
Rasmus Lerchedahl Petersen
40b61fa85f
python: fix qldocs and clean-up dead code
2022-06-15 14:07:35 +02:00
yoff
9dbb451f41
Merge pull request #9463 from RasmusWL/req-wo-cert-validation
...
Python: Rewrite `py/request-without-cert-validation`
2022-06-15 13:00:57 +02:00
github-actions[bot]
104ac05f49
Release preparation for version 2.9.4
2022-06-15 08:22:38 +00:00
