Asger F
6d25fb6988
Python: add change note
2022-06-28 11:28:30 +02:00
Asger F
4c73ab2679
Apply suggestions from code review
...
Co-authored-by: Taus <tausbn@github.com >
2022-06-28 09:48:53 +02:00
Asger F
a033338d20
Python: Explicitly mention lack of transitive flow in asSource/asSink
2022-06-28 09:46:26 +02:00
Asger F
9b27a7cbcd
Python: Dont claim that external libraries are excluded from the database
2022-06-28 09:28:26 +02:00
yoff
67b6f215dc
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-06-28 08:05:53 +02:00
yoff
1788507571
python: add qldoc
2022-06-27 21:00:12 +00:00
Rasmus Lerchedahl Petersen
a1fe8a5b2b
python: handle not in BarrierGuard
...
in the program
```python
if not is_safe(path):
return
```
the last node in the `ConditionBlock` is `not is_safe(path)`,
so it would never match "a call to is_safe".
Thus, guards inside `not` would not be part of `GuardNode`
(nor `BarrierGuard`). Now they can.
2022-06-27 20:10:47 +00:00
Rasmus Lerchedahl Petersen
882000afb3
python: not is confusing our logic
...
- added `is_unsafe`
- added "negated version" of two tests.
These versions do not use `not` and the analysis gets the taint right.
2022-06-27 20:10:47 +00:00
Taus
dc0f50d49a
Python: Clean up variable names
...
Makes it more consistent with the names used in
`legalMergeCandidateNonEmpty`.
2022-06-27 19:54:09 +00:00
Taus
8fc9ce9699
Python: Fix bad join in MRO
...
Fixes a bad join in `list_of_linearization_of_bases_plus_bases`.
Previvously, we joined together `ConsList` and `getBase` before filtering
these out using the recursive call. Now we do the recursion first.
Co-authored-by: yoff <yoff@github.com >
2022-06-27 19:54:09 +00:00
Asger F
cc57cb8af5
Merge branch 'main' into post-release-prep/codeql-cli-2.10.0
2022-06-27 20:37:25 +02:00
Rasmus Wriedt Larsen
9e154ff4bd
Merge branch 'main' into python/port-tarslip
2022-06-27 14:36:15 +02:00
github-actions[bot]
d506f448ef
Post-release preparation for codeql-cli-2.10.0
2022-06-24 07:36:33 +00:00
Anders Schack-Mulligen
dc517a758e
Autoformat
2022-06-23 14:44:40 +02:00
Anders Schack-Mulligen
4a317a25d3
Dataflow: Sync.
2022-06-23 14:34:52 +02:00
Asger F
d94010c244
Grammar: report -> reports
2022-06-23 14:17:52 +02:00
github-actions[bot]
a74051c658
Release preparation for version 2.10.0
2022-06-23 11:17:46 +00:00
Rasmus Wriedt Larsen
3248f7b423
Merge pull request #9649 from RasmusWL/certificate-modeling
...
Python/JS/Ruby: Ignore common words (like certain) as sensitive data source
2022-06-23 12:04:58 +02:00
Rasmus Wriedt Larsen
876ba71d9b
Python/JS/Ruby: Add change-note
2022-06-22 11:14:05 +02:00
Rasmus Wriedt Larsen
4be375521f
Python: Handle _ in sensitive-data-sources
2022-06-22 11:05:14 +02:00
Rasmus Wriedt Larsen
4a844312f4
Python: _ in var name not handled by sensitive-data-sources
2022-06-22 11:05:14 +02:00
Rasmus Wriedt Larsen
5dc2bb717a
Python: ignore common words (certain/concert) as sensitive source
2022-06-22 11:05:05 +02:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
Rasmus Wriedt Larsen
abdcfd55c3
Python: uncertainty is treated as a certificate :O
2022-06-22 10:16:28 +02:00
Anders Schack-Mulligen
f8f9b7d3b4
Apply suggestions from code review
2022-06-21 14:11:36 +02:00
Asger F
092a6a01ac
Python: Update member documentation
2022-06-21 12:44:06 +02:00
Asger F
fecbfa6ca3
Python: add deprecation
2022-06-21 12:44:06 +02:00
Asger F
3a669a8d21
Python: getAValueReachingRhs -> getAValueReachingSink
2022-06-21 12:44:06 +02:00
Asger F
b096f9ec72
Python: Rename getAUse -> getAValueReachableFromSource
2022-06-21 12:44:06 +02:00
Asger F
181a53bd03
Python: Rename getAnImmediateUse -> asSource
2022-06-21 12:44:06 +02:00
Asger F
60fde3c031
Python: Rename getARhs -> asSink
2022-06-21 12:44:06 +02:00
Asger F
8f259d4bb6
Python: port API graph doc comment
2022-06-21 12:44:06 +02:00
Edoardo Pirovano
70dbd92e25
Bump minor version of all regularly released packs
2022-06-21 11:22:58 +01:00
Edoardo Pirovano
ad02b85efa
Merge branch main into rc/3.6
2022-06-21 11:15:25 +01:00
Anders Schack-Mulligen
a4796e1542
Add change notes.
2022-06-21 11:17:47 +02:00
Anders Schack-Mulligen
a6c0a9e480
Python: one more fix
2022-06-21 09:19:45 +02:00
Anders Schack-Mulligen
a7c268f804
Python: adjust test.
2022-06-20 15:46:38 +02:00
Anders Schack-Mulligen
f473a0a961
Python: Deprecate and replace BarrierGuard class.
2022-06-20 15:46:38 +02:00
yoff
94145e9e74
Update python/ql/lib/semmle/python/security/dataflow/TarSlipCustomizations.qll
2022-06-20 10:14:52 +02:00
Rasmus Wriedt Larsen
ae44a941f9
Merge pull request #9421 from RasmusWL/inline-brackets
...
Inline Expectation Tests: Allow `tag[foo bar]`
2022-06-20 10:01:19 +02:00
Taus
3a328f6a3f
Merge pull request #6570 from yoff/python/broaden-noqa-regex
...
Python: Broaden noqa regex to allow comments
2022-06-17 23:56:39 +02:00
Rasmus Wriedt Larsen
5fb41e4894
Inline Expectation Tests: Disallow tag[[[foo bar]
2022-06-17 17:36:04 +02:00
Rasmus Wriedt Larsen
f1b0a814e0
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-06-17 15:04:57 +02:00
Anders Schack-Mulligen
6518a01ded
Dataflow: Sync.
2022-06-16 11:25:28 +02:00
Taus
9bf2eb55ca
Python: Allow whitespace before colon
...
As suggested by @DimitriPapadopolous.
Also fixes the test output to account for the `noqa` annotation (with
added comment) that we're now detecting.
2022-06-16 11:16:58 +02:00
Rasmus Lerchedahl Petersen
98301332bd
Python: Broaden noqa regex
2022-06-16 11:16:58 +02:00
Rasmus Wriedt Larsen
d6e68258a4
Python: API-graphs: allow class decorators in .getASubclass()
2022-06-15 17:30:34 +02:00
Rasmus Wriedt Larsen
5f32f898d5
Python: API-graphs: test class decorators and subclass
...
A class decorator could change the class definition in any way.
In this specific case, it would be better if we allowed the subclass to
be found with API graphs still.
inspired by
c2250cfb80/tests/auth_tests/test_views.py (L40-L46)
2022-06-15 16:16:34 +02:00
Rasmus Wriedt Larsen
b2c8e0fe8d
Python: Add comment to test
2022-06-15 15:59:54 +02:00
Rasmus Wriedt Larsen
24c9aff2fc
Python: Fix a type-tracking test
2022-06-15 15:58:17 +02:00
