erik-krogh
6fdfd40880
changes to address reviews
2022-10-07 22:31:00 +02:00
erik-krogh
944ca4a0da
fix some more style-guide violations in the alert-messages
2022-10-07 11:23:34 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
Rasmus Wriedt Larsen
47c9c5bddd
Ruby: Update RequestWithoutValidation.ql to match Python version
...
No library modeling currently has support for the new disablesCertificateValidation/2, so only the alert text has changed
(removed an import from Python so the queries would ACTUALLY match)
2022-08-18 14:32:41 +02:00
Rasmus Wriedt Larsen
c21e05aa44
Python: Use HTTP::Client::Request request for py/request-without-cert-validation
...
This is very much like the Ruby query, except we also have the origin
that does the disabling.
976daddd36/ruby/ql/src/queries/security/cwe-295/RequestWithoutValidation.ql (L18-L20)
2022-06-08 15:42:32 +02:00
Erik Krogh Kristensen
5e23da813f
rename named-parameters to keyword-parameters
2022-02-03 23:10:39 +01:00
Erik Krogh Kristensen
e434f075fa
introduce, and use, API::APICallNode
2022-02-03 23:10:39 +01:00
Rasmus Wriedt Larsen
1f90dcadf1
Python: Use backtracker for verify arg
2021-11-10 12:54:23 +01:00
Rasmus Wriedt Larsen
985cd1ebdb
Python: Port py/request-without-cert-validation to use API graphs
2021-11-09 16:37:50 +01:00
Calum Grant
771e686946
Update security-severity scores
2021-06-15 13:25:17 +01:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Rasmus Wriedt Larsen
7afe3972d8
Revert "Merge pull request #5171 from RasmusWL/restructure-queries"
...
This reverts commit 8caafb3710ec79094957
2021-02-17 16:32:53 +01:00
Rasmus Wriedt Larsen
3a18881660
Python: Restructure query file location
...
Since I can never remember the CWE numbers
2021-02-16 11:36:10 +01:00
Taus Brock-Nannestad
f07a7bf8cf
Python: Autoformat everything using qlformat.
...
Will need subsequent PRs fixing up test failures (due to deprecated
methods moving around), but other than that everything should be
straight-forward.
2020-07-07 15:43:52 +02:00
Rasmus Wriedt Larsen
6b5b28aded
Python: Add Value.getABooleanValue and Value.getDefiniteBooleanValue
...
Replacing `Value.booleanValue`. We wanted to match `Object.booleanValue` that
only gives a result if it is either `true` or `false`, but also wanted to keep
the flexibility to see if the Value _could_ be `true`/`false`. We don't have a
motivating usecase, so let's see if we ever need it :P
+ fix modernisation regression on py/jinja2/autoescape-false
2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
e5abfd0196
Python: Modernise Security/ queries
2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen
2648e34f1a
Python: Autoformat security
2020-01-31 14:49:18 +01:00
Taus Brock-Nannestad
f14f7b50ed
Python: Use ModuleObject::named more consistently.
2019-03-20 17:41:23 +01:00
Mark Shannon
98be27a73e
Python: Add 'attr' predicate as a synomnym for 'getAttribute' to help readability.
2019-02-20 11:08:44 +00:00
Mark Shannon
698957e2cf
Python: Correct case of query name and improve help.
2018-11-27 11:32:40 +00:00
Mark Shannon
6588606739
Python: Account for other 'falsey' values in query.
2018-11-23 14:42:45 +00:00
Mark Shannon
45e864a395
Python: New query to test for requests without validation.
2018-11-23 14:42:45 +00:00
