Rasmus Wriedt Larsen
6d09334cba
Merge pull request #6330 from porcupineyhairs/pyPathTraversal
...
Python : Add Flask sinks for path injection query
2021-10-28 11:39:40 +02:00
Rasmus Wriedt Larsen
358663ffbb
Python: Fix tests
2021-10-28 11:14:41 +02:00
Porcuiney Hairs
4fd3f212f8
Python : Add Flask sinks for path injection query
2021-10-28 02:12:11 +05:30
Rasmus Wriedt Larsen
cd6d73d553
Python: Handle kwarg in PyYAML
...
Really surprised that we didn't already :|
2021-10-26 17:48:10 +02:00
Rasmus Wriedt Larsen
6c0083e584
Python: Add PoC for PyYAML code execution
2021-10-26 17:48:10 +02:00
Rasmus Wriedt Larsen
1ce09afa08
Python: Add modeling of ruamel.yaml PyPI package
2021-10-26 17:48:10 +02:00
CodeQL CI
2b0415e238
Merge pull request #6741 from yoff/python/model-os-path-file-accesses
...
Approved by RasmusWL
2021-10-13 11:11:41 -07:00
Rasmus Wriedt Larsen
5e6f042f6e
Python: Model pickle.Unpickler
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
75b06d8a25
Python: Model dill.load
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
4820be3b10
Python: Model keyword arguments to dill.loads
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
f9333fc551
Python: Expand dill tests
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
42980a1ab4
Python: Model shelve.open
2021-10-08 11:55:54 +02:00
Rasmus Wriedt Larsen
a81d359669
Python: Model marshal.load
2021-10-07 21:27:51 +02:00
Rasmus Wriedt Larsen
1b61296ea5
Python: Model pickle.load
2021-10-07 21:25:48 +02:00
Rasmus Wriedt Larsen
27c368a444
Python: Model keyword arguments to pickle.loads
2021-10-07 21:24:12 +02:00
Rasmus Wriedt Larsen
3592b09d56
Python: Expand stdlib decoding tests
...
The part about claiming there is decoding of the input to `shelve.open`
is sort of an odd one, since it's not the filename, but the contents of
the file that is decoded.
However, trying to only handle this problem through path injection is
not enough -- if a user is able to upload and access files through
`shelve.open` in a path injection safe manner, that still leads to code
execution.
So right now the best way we have of modeling this is to treat the
filename argument as being deserialized...
2021-10-07 21:11:51 +02:00
Rasmus Wriedt Larsen
ded3088529
Python/JS: Recognize SHA-3 hash functions
...
Official names are SHA3-224, SHA3-256, SHA3-384, SHA3-512 as per
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
2021-09-27 12:08:40 +02:00
Rasmus Lerchedahl Petersen
f2fbeed490
Python: Model os.path-functions
2021-09-23 15:30:00 +02:00
Rasmus Lerchedahl Petersen
81adb7dd2a
Python: Add tests for os.path-functions
2021-09-23 15:28:05 +02:00
Rasmus Wriedt Larsen
8badba26b8
Python: Minor SQLALchemy comment fixes
2021-09-22 13:58:29 +02:00
Rasmus Wriedt Larsen
c7c8e2f3e3
Merge branch 'main' into promote-sqlalchemy
2021-09-21 09:36:07 +02:00
Anders Schack-Mulligen
f30dad7705
Dataflow: Update test expected outputs.
2021-09-07 13:02:20 +02:00
Rasmus Wriedt Larsen
d55f18f8e3
Python: Add modeling of Flask-SQLAlchemy
2021-09-02 10:48:24 +02:00
Rasmus Wriedt Larsen
f1744890b1
Python: Add tests for Flask-SQLAlchemy
2021-09-02 10:48:15 +02:00
Rasmus Wriedt Larsen
c34d6d1162
Python: Add query to handle SQLAlchemy TextClause Injection
...
instead of doing this via taint-steps. See description in code/tests.
2021-09-02 10:19:57 +02:00
Rasmus Wriedt Larsen
81dbe36e99
Python: Promote SQLAlchemy modeling
...
Due to the split between `src/` and `lib/`, I was not really able to do
the next step without having moved the SQLAlchemy modeling over to be in
`lib/` as well.
2021-09-02 10:19:57 +02:00
Rasmus Wriedt Larsen
47377c7197
Merge branch 'main' into more-modeling
2021-08-26 13:40:17 +02:00
Rasmus Wriedt Larsen
b649f5f38c
Merge branch 'main' into peewee-modeling
2021-08-17 12:03:18 +02:00
Rasmus Wriedt Larsen
38875ca0c7
Python: Improve handling of async methods
2021-07-22 14:17:07 +02:00
Rasmus Wriedt Larsen
6e9d9fcbbd
Python: Improve taint steps in for & iterable unpacking
...
These were written way before the ones in DataFlowPrivate, but
apparently didn't cover quite as much :|
2021-07-22 14:16:17 +02:00
Rasmus Wriedt Larsen
6f63c03558
Python: Model http.cookies.Morsel and usage in Tornado
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
7e09a1cbfd
Python: Model tornado.httputil.HTTPHeaders
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
7020e4132b
Python: Model BaseHTTPRequestHandler.rfile as file-like object
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
d388dd547e
Python: Model HTTPMessage from Stdlib
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
dac71ded9d
Python: Add Authorization modeling in Flask
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
133632119d
Python: Model werkzeug Headers
...
Also removed a misleading comment link to method on wrong class :D
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
4d9c86a252
Python: Model Werkzeug FileStorage.save as FileSystemAccess
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
9cb4899c5c
Python: Add FileStorage modeling in Flask
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
04190ea308
Python: Add file-like modeling to werkzeug FileStorage
2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
4f4dec50f2
Python: Model ResovlerMatch in Django
...
Like before, omitted ClassInstantiation
2021-07-22 10:43:13 +02:00
Rasmus Wriedt Larsen
7dc6518350
Python: Add FileLikeObject modeling
...
Such that the result of `request.FILES["key"].file.read()` is tainted
2021-07-21 16:35:09 +02:00
Rasmus Wriedt Larsen
18c0d13efd
Python: Model most of UploadedFile in Django
2021-07-21 16:35:09 +02:00
Rasmus Wriedt Larsen
5ec5557203
Python: Model MultiValueDict in Django
2021-07-21 16:35:09 +02:00
Rasmus Wriedt Larsen
51b543c67c
Python: Model taint for django request methods
2021-07-21 16:35:09 +02:00
Taus
55d822cc56
Python: Add TypeTrackingNode
...
Splits `ModuleVariableNode` away from `LocalSourceNode`, instead
creating a class `TypeTrackingNode` that encapsulates both of these.
This means we no longer have module variable nodes as part of
`LocalSourceNode` (which is good, since they have no "local" aspect to
them), and hence we can have `LocalSourceNode` inherit directly from
`ExprNode` (which makes the API a bit nicer).
Unfortunately these are breaking changes, so we can't actually fulfil
the above two desiderata until the `track` and `backtrack` methods on
`LocalSourceNode` have been fully deprecated. For this reason, we
preserve the present implementation of `LocalSourceNode`, and instead
lay the foundation for switching over in the future, by deprecating
`track` and `backtrack` on `LocalSourceNode`.
2021-07-02 18:00:33 +00:00
yoff
6a77b890af
Merge pull request #6155 from RasmusWL/port-cleartext-queries
...
Python: Port cleartext queries
2021-06-30 15:52:34 +02:00
Rasmus Wriedt Larsen
c2708176b1
Python: Support %-style formatting for MarkupSafe
2021-06-30 14:15:41 +02:00
Rasmus Wriedt Larsen
0a4efd0e86
Python: Add %-style formatting tests for MarkupSafe
2021-06-30 14:13:59 +02:00
Rasmus Wriedt Larsen
075953860b
Merge branch 'main' into markupsafe-modeling
2021-06-30 13:55:08 +02:00
Rasmus Wriedt Larsen
97571e0b4f
Python: Add modeling of peewee
2021-06-25 17:50:59 +02:00
