Sotiris Dragonas
db493ef30a
Python: port prompt injection queries (system + user) from JS PR #21953
...
Replace the experimental py/prompt-injection query with two queries mirroring
the JavaScript split:
- py/system-prompt-injection (system prompt / tool description / developer prompt)
- py/user-prompt-injection (user-role prompt)
Supports OpenAI (+Agents), Anthropic, Google GenAI, LangChain and OpenRouter
via MaD models plus role-filtered framework sinks that MaD cannot express.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-06-18 13:52:51 +03:00
Owen Mansel-Chan
c7c1eca415
Merge branch 'main' into copilot/investigate-missing-alerts
2026-06-17 22:54:22 +01:00
Sotiris Dragonas
57f20064ba
Merge branch 'main' into bazookamusic/cwe-1427
2026-06-17 17:12:20 +03:00
Owen Mansel-Chan
1f9899d7db
Extend added type tracking step to related types
2026-06-17 15:04:53 +01:00
Owen Mansel-Chan
dd61dd2d74
Fix FP for py/modification-of-locals
2026-06-17 14:24:18 +01:00
Owen Mansel-Chan
47c2c9e763
Add test for FP for py/modification-of-locals
2026-06-17 14:22:42 +01:00
Owen Mansel-Chan
ea7510bf72
Refactor ReExposedInstance logic into one place
2026-06-17 13:10:47 +01:00
Owen Mansel-Chan
415857cacb
Fix FP for py/should-use-with
2026-06-17 13:01:36 +01:00
Owen Mansel-Chan
d72144646a
Add test for FP for py/should-use-with
2026-06-17 12:55:17 +01:00
Owen Mansel-Chan
199fd864ad
Fix FP for py/file-not-closed
2026-06-17 12:36:04 +01:00
Owen Mansel-Chan
890969433f
Add test for FP for py/file-not-closed
2026-06-17 12:19:03 +01:00
Sotiris Dragonas
274f014d31
Merge branch 'main' into bazookamusic/cwe-1427
2026-06-17 12:53:03 +03:00
Mathias Vorreiter Pedersen
c12cf88c52
Merge branch 'main' into add-yaml-comments
2026-06-17 10:17:06 +01:00
Owen Mansel-Chan
9c65082189
Fix MISSING alert
2026-06-15 00:14:52 +01:00
Owen Mansel-Chan
434a99447e
Add thorough tests, including one MISSING alert
2026-06-12 13:45:02 +01:00
Owen Mansel-Chan
d389ea4039
Convert sql-injection test to inline expectations
2026-06-12 13:44:56 +01:00
copilot-swe-agent[bot]
838d06c53f
Fix changelog copy errors in change-notes and CHANGELOG.md files (codeql-cli-2.25.6)
2026-06-11 22:45:33 +02:00
Owen Mansel-Chan
913dcb1190
Add change note
2026-06-11 22:20:52 +02:00
Owen Mansel-Chan
befb557bfd
Accept fixed MISSING tests
2026-06-11 15:44:20 +02:00
copilot-swe-agent[bot]
73bc2d70ae
Model instance-attribute type flow
...
Use a field level step like JS and Ruby.
2026-06-11 14:48:55 +02:00
Sotiris Dragonas
17dbf03c6d
Merge branch 'main' into bazookamusic/cwe-1427
2026-06-11 12:05:57 +02:00
copilot-swe-agent[bot]
a4585d8d94
Add test documenting missing PEP249 alerts for connection stored in self attribute
2026-06-11 05:48:40 +00:00
Tom Hvitved
f5919875b7
Merge pull request #21941 from hvitved/python/content-approx
...
Python: Implement `ContentApprox`
2026-06-09 15:46:04 +02:00
yoff
0cea01c22f
Merge pull request #21926 from github/yoff/python-simplify-decorator-predicates
...
Python: simplify decorator-detection predicates to pure AST match
2026-06-08 22:04:33 +02:00
BazookaMusic
2cb0851900
1. Rename AgentSDK -> AgentSdk
...
2. Remove redundant constant comparison barriers. This is already happening by default by the taint tracking library.
2026-06-08 12:55:52 +02:00
Tom Hvitved
cc1ea25856
Python: Implement ContentApprox
2026-06-08 08:41:28 +02:00
Owen Mansel-Chan
1f91f915c7
Merge pull request #21888 from owen-mc/py/remove-imprecise-container-steps
...
Python: Remove imprecise container steps #2
2026-06-04 22:16:24 +01:00
Mathias Vorreiter Pedersen
b877943b42
Python: Add upgrade and downgrade scripts.
2026-06-04 17:54:53 +01:00
Mathias Vorreiter Pedersen
0aa1abe432
Python: Add support for YAML comments.
2026-06-04 17:54:48 +01:00
Owen Mansel-Chan
da999ee440
Address review comments
2026-06-03 21:24:16 +01:00
Owen Mansel-Chan
6f2cc43f32
Remove imprecise model for tuple()
2026-06-02 21:59:48 +01:00
Owen Mansel-Chan
5042fdee84
Remove imprecise model for list()
2026-06-02 21:59:46 +01:00
Owen Mansel-Chan
04341c47bd
Tweak model for str.join
2026-06-02 21:59:44 +01:00
Owen Mansel-Chan
b27d08ee32
Update edges in expected test output
2026-06-02 18:29:56 +01:00
Owen Mansel-Chan
20ce679d61
Accept changed edges in test output
...
No changes to alerts
2026-06-02 16:15:08 +01:00
Owen Mansel-Chan
f62ebef9e0
Adjust expected test output
2026-06-02 16:15:06 +01:00
Owen Mansel-Chan
c3ef1ddd64
Add MaD models for lxml and xml etree.fromstringlist
2026-06-02 16:15:01 +01:00
Owen Mansel-Chan
dede5bc49b
Track flow through tuple() with list with tainted elements
2026-06-02 16:14:59 +01:00
Owen Mansel-Chan
ad97b6dd64
Use access path for str.join model
2026-06-02 16:14:56 +01:00
yoff
5fb75ac987
Python: simplify decorator-detection predicates to pure AST match
...
The internal predicates that identify `@staticmethod`, `@classmethod` and
`@property` decorators previously required the decorator's `NameNode` to
satisfy `isGlobal()` (i.e. no SSA def reaches the decorator's name use).
That filter was correct but unnecessarily indirect: these three names
are builtins, and even when a class body redefines one, the class body
has not started executing at the decorator position, so Python uses the
builtin.
Match the decorator's AST `Name` directly instead, dropping the CFG/SSA
detour. The slight semantic change — `isGlobal()` would have rejected
module-level shadowing of these builtins — is negligible in practice
and explicitly documented in the change note.
`hasContextmanagerDecorator` and `hasOverloadDecorator` keep the
`NameNode.isGlobal()` check because their target names (`contextmanager`,
`overload`) are imported, not builtin, and local shadowing is a real
concern.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-06-01 14:04:43 +00:00
Owen Mansel-Chan
b38440490a
Address review comment
2026-05-31 21:47:44 +01:00
Henry Mercer
a16f1c555c
Merge pull request #21912 from github/post-release-prep/codeql-cli-2.25.6
...
Post-release preparation for codeql-cli-2.25.6
2026-05-29 14:43:56 +01:00
github-actions[bot]
cfb18c2477
Post-release preparation for codeql-cli-2.25.6
2026-05-29 12:04:35 +00:00
github-actions[bot]
8b6f969cdb
Release preparation for version 2.25.6
2026-05-29 11:27:54 +00:00
Henry Mercer
9bc0c1b1ab
Revert "Release preparation for version 2.25.6"
2026-05-29 12:13:50 +01:00
Owen Mansel-Chan
aee33a0cc9
Add missing code for TAnyTupleOrDictionaryElement
2026-05-29 10:26:24 +01:00
Taus
6165623cbf
Merge pull request #21724 from github/tausbn/python-add-self-validating-cfg-tests
2026-05-28 22:07:55 +02:00
Owen Mansel-Chan
df15a719cb
Add a ContentSet for any tuple or dictionary element
2026-05-28 16:48:23 +01:00
Owen Mansel-Chan
812e8e6b34
Add change note
2026-05-28 11:37:54 +01:00
Owen Mansel-Chan
80c6f082d1
Fix TODO in containerStep
2026-05-28 11:34:02 +01:00
