Rasmus Wriedt Larsen
a168af349e
Python: Expand modeling of paramiko
2023-04-18 11:57:20 +02:00
erik-krogh
6fdfd40880
changes to address reviews
2022-10-07 22:31:00 +02:00
erik-krogh
944ca4a0da
fix some more style-guide violations in the alert-messages
2022-10-07 11:23:34 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
Rasmus Wriedt Larsen
a9e1e72196
Merge branch 'main' into shared-http-client-request
2022-09-06 10:52:27 +02:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
Rasmus Wriedt Larsen
47c9c5bddd
Ruby: Update RequestWithoutValidation.ql to match Python version
...
No library modeling currently has support for the new disablesCertificateValidation/2, so only the alert text has changed
(removed an import from Python so the queries would ACTUALLY match)
2022-08-18 14:32:41 +02:00
Sid Shankar
68d1c2d3e8
Fix link to python requests documentation
...
docs.python-requests.org seems to be a suspended domain. The replacement link is to the same Python requests library on readthedocs.io, and points to the ssl-cert-verification section.
2022-08-15 14:43:28 -04:00
Asger F
b096f9ec72
Python: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:06 +02:00
Rasmus Wriedt Larsen
c21e05aa44
Python: Use HTTP::Client::Request request for py/request-without-cert-validation
...
This is very much like the Ruby query, except we also have the origin
that does the disabling.
976daddd36/ruby/ql/src/queries/security/cwe-295/RequestWithoutValidation.ql (L18-L20)
2022-06-08 15:42:32 +02:00
Erik Krogh Kristensen
5e23da813f
rename named-parameters to keyword-parameters
2022-02-03 23:10:39 +01:00
Erik Krogh Kristensen
e434f075fa
introduce, and use, API::APICallNode
2022-02-03 23:10:39 +01:00
Rasmus Wriedt Larsen
1f90dcadf1
Python: Use backtracker for verify arg
2021-11-10 12:54:23 +01:00
Rasmus Wriedt Larsen
985cd1ebdb
Python: Port py/request-without-cert-validation to use API graphs
2021-11-09 16:37:50 +01:00
Sam Havron
733e5b45bf
Fix qhelp typo in RequestWithoutValidation
2021-07-19 16:01:06 -04:00
Calum Grant
771e686946
Update security-severity scores
2021-06-15 13:25:17 +01:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Rasmus Wriedt Larsen
5bb4a1a45a
Python: Use explicit argument specification instead of getAnArg
...
I've seen quite a few places where `getAnArg` leads to wrong behavior, and I
generally just don't like it.
2021-02-24 10:19:34 +01:00
Taus Brock-Nannestad
f241dbabab
Python: Clean up query a bit
2021-02-23 22:33:18 +01:00
Taus Brock-Nannestad
002d0fe565
Python: Port missing host key query
2021-02-23 22:26:03 +01:00
Rasmus Wriedt Larsen
7afe3972d8
Revert "Merge pull request #5171 from RasmusWL/restructure-queries"
...
This reverts commit 8caafb3710ec79094957
2021-02-17 16:32:53 +01:00
Rasmus Wriedt Larsen
3a18881660
Python: Restructure query file location
...
Since I can never remember the CWE numbers
2021-02-16 11:36:10 +01:00
Taus Brock-Nannestad
f07a7bf8cf
Python: Autoformat everything using qlformat.
...
Will need subsequent PRs fixing up test failures (due to deprecated
methods moving around), but other than that everything should be
straight-forward.
2020-07-07 15:43:52 +02:00
Taus Brock-Nannestad
87a9f51c78
Python: Autoformat all .ql files.
2020-03-30 11:59:10 +02:00
Rasmus Wriedt Larsen
6b5b28aded
Python: Add Value.getABooleanValue and Value.getDefiniteBooleanValue
...
Replacing `Value.booleanValue`. We wanted to match `Object.booleanValue` that
only gives a result if it is either `true` or `false`, but also wanted to keep
the flexibility to see if the Value _could_ be `true`/`false`. We don't have a
motivating usecase, so let's see if we ever need it :P
+ fix modernisation regression on py/jinja2/autoescape-false
2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
e5abfd0196
Python: Modernise Security/ queries
2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
2648e34f1a
Python: Autoformat security
2020-01-31 14:49:18 +01:00
Mark Shannon
2ba122373a
Merge pull request #1128 from taus-semmle/python-paramiko-unsafe-host-key-validation
...
Python: Add query for insecure SSH host key policies in Paramiko.
2019-04-04 16:57:13 +01:00
Taus Brock-Nannestad
f14f7b50ed
Python: Use ModuleObject::named more consistently.
2019-03-20 17:41:23 +01:00
Taus Brock-Nannestad
c7c6c83627
Address review comments.
2019-03-19 15:44:11 +01:00
Taus Brock-Nannestad
52278b25d9
Python: Add query for insecure SSH host key policies in Paramiko.
2019-03-18 16:45:54 +01:00
Mark Shannon
98be27a73e
Python: Add 'attr' predicate as a synomnym for 'getAttribute' to help readability.
2019-02-20 11:08:44 +00:00
Mark Shannon
698957e2cf
Python: Correct case of query name and improve help.
2018-11-27 11:32:40 +00:00
Mark Shannon
6588606739
Python: Account for other 'falsey' values in query.
2018-11-23 14:42:45 +00:00
Mark Shannon
06e5bc8359
Python: Add qhelp for new query.
2018-11-23 14:42:45 +00:00
Mark Shannon
45e864a395
Python: New query to test for requests without validation.
2018-11-23 14:42:45 +00:00
