Owen Mansel-Chan
da999ee440
Address review comments
2026-06-03 21:24:16 +01:00
Owen Mansel-Chan
6f2cc43f32
Remove imprecise model for tuple()
2026-06-02 21:59:48 +01:00
Owen Mansel-Chan
5042fdee84
Remove imprecise model for list()
2026-06-02 21:59:46 +01:00
Owen Mansel-Chan
04341c47bd
Tweak model for str.join
2026-06-02 21:59:44 +01:00
Owen Mansel-Chan
b27d08ee32
Update edges in expected test output
2026-06-02 18:29:56 +01:00
Owen Mansel-Chan
20ce679d61
Accept changed edges in test output
...
No changes to alerts
2026-06-02 16:15:08 +01:00
Owen Mansel-Chan
f62ebef9e0
Adjust expected test output
2026-06-02 16:15:06 +01:00
Owen Mansel-Chan
c3ef1ddd64
Add MaD models for lxml and xml etree.fromstringlist
2026-06-02 16:15:01 +01:00
Owen Mansel-Chan
dede5bc49b
Track flow through tuple() with list with tainted elements
2026-06-02 16:14:59 +01:00
Owen Mansel-Chan
ad97b6dd64
Use access path for str.join model
2026-06-02 16:14:56 +01:00
Owen Mansel-Chan
b38440490a
Address review comment
2026-05-31 21:47:44 +01:00
Owen Mansel-Chan
aee33a0cc9
Add missing code for TAnyTupleOrDictionaryElement
2026-05-29 10:26:24 +01:00
Owen Mansel-Chan
df15a719cb
Add a ContentSet for any tuple or dictionary element
2026-05-28 16:48:23 +01:00
Owen Mansel-Chan
812e8e6b34
Add change note
2026-05-28 11:37:54 +01:00
Owen Mansel-Chan
80c6f082d1
Fix TODO in containerStep
2026-05-28 11:34:02 +01:00
Owen Mansel-Chan
ec13e1bcd3
Add wildcard ContentSets to avoid performance problems
2026-05-27 15:28:07 +01:00
Owen Mansel-Chan
e8779295ee
Update test results
2026-05-22 11:43:18 +01:00
Rasmus Lerchedahl Petersen
fa758d6bf5
python: fix test
2026-05-21 16:59:19 +01:00
Rasmus Lerchedahl Petersen
fa9426c749
Python: extra tests for comprehension
2026-05-21 16:59:18 +01:00
Rasmus Lerchedahl Petersen
0ecca91dea
Python: typo
2026-05-21 16:59:16 +01:00
Rasmus Lerchedahl Petersen
f669a4f3bf
Python: Make sure all imprecise taint bubbles up
2026-05-21 16:59:14 +01:00
Rasmus Lerchedahl Petersen
3275c814bd
Python: reset test expectations
2026-05-21 16:59:11 +01:00
Rasmus Lerchedahl Petersen
9a180036a5
Python: conversion step for format_map
...
and adjust collection test
2026-05-21 16:59:08 +01:00
Rasmus Lerchedahl Petersen
93e7ab52b7
Python: adjust test expectations
...
We now find an alert on this line as we hope to
It is not an alert for _full_ SSRF, though, since that configuration cannot handle multiple substitutions.
2026-05-21 16:58:51 +01:00
Rasmus Lerchedahl Petersen
facb3b681d
Python: recover taint for % format strings
2026-05-21 16:57:50 +01:00
Rasmus Lerchedahl Petersen
b67694b2ab
Python: Remove imprecise container steps
...
- remove `tupleStoreStep` and `dictStoreStep` from `containerStep`
These are imprecise compared to the content being precise.
- add implicit reads to recover taint at sinks
- add implicit read steps for decoders
to supplement the `AdditionalTaintStep`
that now only covers when the full container is tainted.
2026-05-21 16:57:44 +01:00
Geoffrey White
3aa660663e
Merge pull request #21806 from geoffw0/extsensitive
...
Shared: Improvements to SensitiveDataHeuristics.qll
2026-05-19 16:22:03 +01:00
Geoffrey White
a4b2c0f6fd
Update change notes (Copilot's suggestions).
2026-05-15 09:24:29 +01:00
Geoffrey White
59dbd68a5e
Add change notes.
2026-05-14 14:46:05 +01:00
Geoffrey White
c8196e439f
Merge branch 'main' into extsensitive
2026-05-13 13:04:48 +01:00
Paolo Tranquilli
ee13ea0f6b
Harden _relative_path for Windows and mixed-form inputs
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-13 11:35:02 +02:00
Paolo Tranquilli
d28792537b
Python extractor: use relative paths in diagnostic locations
...
Diagnostic `Location.file` fields contained absolute filesystem paths,
causing the GitHub UI to generate broken file links with runner paths
like `/home/runner/work/...`. Now paths are relativized against the
source root (`LGTM_SRC` or cwd), falling back to absolute if the file
is outside the source root.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-13 10:32:05 +02:00
Owen Mansel-Chan
0b808e1170
Merge pull request #21807 from owen-mc/java/improve-qhelp-unsafe-deserialization
...
Shared: improve qhelp for unsafe deserialization queries
2026-05-12 22:22:49 +01:00
Geoffrey White
af0124f0f1
Merge branch 'main' into extsensitive
2026-05-11 09:47:29 +01:00
Owen Mansel-Chan
a5ef036465
Note that common standard library types can be vulnerable to gadget-chain attacks
2026-05-08 14:18:54 +01:00
Owen Mansel-Chan
93e05db394
Python: remove doubles spaces from qhelp
2026-05-08 14:06:48 +01:00
Owen Mansel-Chan
e2874ac252
Python: Clarify that deserialization following a schema is safe
2026-05-08 14:05:55 +01:00
Geoffrey White
1c704a0912
Python: Accept test changes (improvement).
2026-05-07 10:28:19 +01:00
github-actions[bot]
7610277199
Post-release preparation for codeql-cli-2.25.4
2026-05-05 10:10:06 +00:00
github-actions[bot]
88e1d86c27
Release preparation for version 2.25.4
2026-05-05 09:34:30 +00:00
Josef Svenningsson
68be006a29
Merge pull request #21641 from github/josefs/promptInjectionImprovements
...
Improve prompt inject for Python
2026-04-29 11:23:52 +01:00
Josef Svenningsson
25a8aa97b2
Fix openai prompt injection tests
2026-04-28 18:24:26 +01:00
Josef Svenningsson
691aeb0815
Remove the chat completion create logic.
2026-04-28 18:24:24 +01:00
Josef Svenningsson
a05e191518
Add tests for anthropic prompt injection models
2026-04-28 18:24:22 +01:00
Josef Svenningsson
e069c9c2ee
Fix tests
2026-04-28 18:24:19 +01:00
Josef Svenningsson
bb18bb084c
Improve prompt inject for Python
2026-04-28 18:24:16 +01:00
Owen Mansel-Chan
6efb21314a
Merge pull request #21523 from owen-mc/docs/mad/barriers
...
Document models-as-data barriers and barrier guards and add change notes
2026-04-21 13:49:19 +01:00
Michael B. Gale
58e9bad0a0
Merge pull request #21737 from github/post-release-prep/codeql-cli-2.25.3
...
Post-release preparation for codeql-cli-2.25.3
2026-04-21 11:48:30 +02:00
Taus
b108e173a5
Merge pull request #21695 from github/tausbn/python-add-support-for-pep-798
...
Python: Add support for PEP-798
2026-04-20 15:01:01 +02:00
github-actions[bot]
a0bab539bb
Post-release preparation for codeql-cli-2.25.3
2026-04-20 12:40:34 +00:00
