113 Commits

Author	SHA1	Message	Date
Esben Sparre Andreasen	89305865d0	JS: make sanitization a "common" technique rather than "important"	2020-08-26 15:41:54 +02:00
Taus Brock-Nannestad	f07a7bf8cf	Python: Autoformat everything using qlformat. ... Will need subsequent PRs fixing up test failures (due to deprecated methods moving around), but other than that everything should be straight-forward.	2020-07-07 15:43:52 +02:00
Rasmus Wriedt Larsen	67be45f045	Merge branch 'master' into python-fix-django-taint-sinks	2020-07-02 11:55:42 +02:00
Taus Brock-Nannestad	01fb1e3786	Python: Get rid of deprecated terms in code and .qhelp.	2020-06-19 16:51:09 +02:00
Rasmus Wriedt Larsen	6cba2fe4f8	Python: Model Django response sinks that are not vuln to XSS ... Since HttpResponse is not *only* used for XSS, it is still valuable to know the content is send as part of the response. The *proper* solution to this problem of not all HttpResponses being vulnerable to XSS is probably to define a new abstract class in Http.qll called HttpResponseXSSVulnerableSink (or similar). I would like to model a few more libraries/frameworks before fully comitting to an approach though.	2020-05-26 16:45:46 +02:00
Rasmus Wriedt Larsen	9c75a39b81	Python: Extend command-injection to handle fabric.api.execute	2020-05-26 10:22:27 +02:00
Rasmus Wriedt Larsen	f602f3e1c7	Python: Use proper import for semmle.python.dataflow.TaintTracking ... It was moved in 637677d515, but imports were not updated.	2020-05-25 13:45:49 +02:00
Taus Brock-Nannestad	ab4cef53c2	Python: Autoformat one final straggler.	2020-03-30 12:36:43 +02:00
Taus Brock-Nannestad	87a9f51c78	Python: Autoformat all .ql files.	2020-03-30 11:59:10 +02:00
semmle-qlci	ac7c74dcee	Merge pull request #3111 from RasmusWL/python-fabric-command-injection ... Approved by BekaValentine	2020-03-25 10:07:33 +00:00
Rasmus Wriedt Larsen	d475bb998e	Python: Add abstract class CommandSink ... I'm going to add more in a sec, and listing *all* of them in CommandInjection.ql started to be silly	2020-03-23 17:04:08 +01:00
Rasmus Wriedt Larsen	1029f04e76	Python: TarSlip sanitizer: handle not	2020-02-20 16:27:54 +01:00
Rasmus Wriedt Larsen	3c317ed0e6	Python: TarSlip sanitizer: only clear taint on false edge ... maybe it was on purpose, will have to investigate FPs when query is good	2020-02-20 16:11:24 +01:00
Rasmus Wriedt Larsen	f3ab52b1fe	Python: Use StringValue instead of Value::forString	2020-02-17 14:41:32 +01:00
Rasmus Wriedt Larsen	6d5a8e4995	Python: Fix typos	2020-02-17 14:34:22 +01:00
Rasmus Wriedt Larsen	6b5b28aded	Python: Add Value.getABooleanValue and Value.getDefiniteBooleanValue ... Replacing `Value.booleanValue`. We wanted to match `Object.booleanValue` that only gives a result if it is either `true` or `false`, but also wanted to keep the flexibility to see if the Value _could_ be `true`/`false`. We don't have a motivating usecase, so let's see if we ever need it :P + fix modernisation regression on py/jinja2/autoescape-false	2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen	bd1f21fb7a	Python: Fix modernisation regression on py/weak-crypto-key ... also fixes test code to use the right argument name	2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen	e5abfd0196	Python: Modernise Security/ queries	2020-02-04 11:42:11 +01:00
Rasmus Wriedt Larsen	27a7d09c94	Python: Fix minor problems in security examples	2020-02-03 14:35:09 +01:00
Rasmus Wriedt Larsen	5bc592514a	Python: Consistenly use "a user-provided value" ... ReflectedXss was the only query that used it with the "a"	2020-02-03 14:35:09 +01:00
Rasmus Wriedt Larsen	2648e34f1a	Python: Autoformat security	2020-01-31 14:49:18 +01:00
Taus	618a35bb7c	Merge pull request #2664 from RasmusWL/python-fix-redirect-example ... Python: Remove unused variable in example for py/url-redirection	2020-01-23 13:42:00 +01:00
Rasmus Wriedt Larsen	7d9f1f08ee	Python: Autoformat	2020-01-22 13:45:14 +01:00
Rasmus Wriedt Larsen	12bb05522a	Python: Make py/weak-cryptographic-algorithm a path-problem ... and stop using deprecated hasFlow	2020-01-22 13:45:14 +01:00
Rasmus Wriedt Larsen	c5091f1ce7	Python: Make py/hardcoded-credentials a path-problem ... and stop using deprecated hasFlow	2020-01-22 13:45:14 +01:00
Rasmus Wriedt Larsen	422658bbdb	Python: Remove unused variable in example for py/url-redirection	2020-01-21 15:45:05 +01:00
Taus Brock-Nannestad	118275e948	Python: Use import python consistently in all queries.	2019-11-26 17:37:09 +01:00
Rasmus Wriedt Larsen	a9d43a2c49	Python: Modernise flask library	2019-11-11 17:18:26 +01:00
Sauyon Lee	0040c9fb4c	Update links to OWASP cheat sheet	2019-11-06 20:21:47 -08:00
Rasmus Wriedt Larsen	471318369b	Python: Don't quote %s in django example ... This is vulnerable to SQL injection because of the quotes around %s -- added some code that highlights this in test.py Since our examples did this in the safe query, I ended up rewriting them completely, causing a lot of trouble for myself :D	2019-10-29 13:58:07 +01:00
AlexTereshenkov	3e6f8fb6be	Add bind-socket-all-network-interfaces Python query (#2048) ... Add bind-socket-all-network-interfaces Python query	2019-10-03 11:23:11 +01:00
Mark Shannon	3f740d6efe	Python: Update CWE-312 queries to use new taint-tracking configuration.	2019-08-30 11:21:04 +01:00
Mark Shannon	811815aa4e	Merge branch 'master' into python-cwe-312	2019-08-30 10:39:04 +01:00
Mark Shannon	91aefab7aa	Python: Reorganise code a bit to minimize diff for PR.	2019-08-29 10:31:50 +01:00
Mark Shannon	d31e55f88e	Python taint-tracking: Avoid ambiguous flows through calls. Fix up tests.	2019-08-29 10:31:50 +01:00
Mark Shannon	78ce19678a	Python taint-tracking: Fix up SQL injection query.	2019-08-29 10:31:50 +01:00
Mark Shannon	2d9d292ee4	Python: Fix up pi-node handling in taint-tracking.	2019-08-29 10:31:50 +01:00
Mark Shannon	8909c3d6ab	Python: Fix tags and message for CWE-312 queries.	2019-08-23 15:20:19 +01:00
Mark Shannon	81c65cd37c	Add missing html tag	2019-08-22 15:27:48 +01:00
Mark Shannon	15bb8b5f70	Python add new queries for clear-text logging and storage.	2019-08-22 15:27:48 +01:00
Mark Shannon	3e5fddd776	Python: Update all remaining taint-tracking queries to use configurations.	2019-07-26 16:39:10 +01:00
Mark Shannon	39b7a69abd	Python: Tarslip query: Fix up sanitizers.	2019-06-19 15:00:02 +01:00
Mark Shannon	a15a89206e	Python: Fix typos in qhelp file.	2019-06-19 11:48:31 +01:00
Mark Shannon	6f15c84bdc	Python: Tarslip query; Add sink for members and sanitizers for tarinfo objects.	2019-06-19 11:48:31 +01:00
Mark Shannon	e14f7ef466	Python: Tarslip query; track info objects and handle sanitization.	2019-06-19 11:48:31 +01:00
Mark Shannon	ea4e263060	Python: Initial version and help of tar-slip (CWE-022) query.	2019-06-19 11:48:31 +01:00
Mark Shannon	8d4a8a6c6b	Python: Reduce the number of strings and ints identified and possible hard-coded credentials.	2019-06-03 12:22:15 +01:00
Mark Shannon	28799441af	Python: Fix false positive in 'Incomplete URL substring sanitization' query.	2019-04-25 18:11:01 +01:00
Taus	adf8cdcde5	Merge pull request #1203 from markshannon/python-taint-tracking-configuration-2 ... Python: Use taint tracking configuration for queries.	2019-04-09 10:01:35 +02:00
Mark Shannon	52b3f77f4f	Fix typo.	2019-04-08 15:47:49 +01:00