Taus
e16bb226c0
Python: Fix resolution of relative imports from namespace packages
...
The fix may look a bit obscure, so here's what's going on.
When we see `from . import helper`, we create an `ImportExpr` with level
equal to 1 (corresponding to the number of dots). To resolve such
imports, we compute the name of the enclosing package, as part of
`ImportExpr.qualifiedTopName()`. For this form of import expression, it
is equivalent to `this.getEnclosingModule().getPackageName()`. But
`qualifiedTopName` requires that `valid_module_name` holds for its
result, and this was _not_ the case for namespace packages.
To fix this, we extend `valid_module_name` to include the module names
of _any_ folder, not just regular package (which are the ones where
there's a `__init__.py` in the folder). Note that this doesn't simply
include all folders -- only the ones that result in valid module names
in Python.
2026-03-12 13:29:23 +00:00
yoff
600f585a31
Merge pull request #21296 from yoff/python/bool-comparison-guards
...
Python: Handle guards being compared to boolean literals
2026-02-26 21:13:51 +01:00
yoff
89e5a9bd72
Update python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll
...
Co-authored-by: Taus <tausbn@github.com >
2026-02-26 13:14:26 +01:00
yoff
cfbae50845
Python: convert barrier guard to MaD
2026-02-26 13:12:34 +01:00
yoff
9b9c9304c7
Python: simplify logic, suggested in review
2026-02-25 18:16:38 +01:00
yoff
c4f8748a42
Python: simplify barrier guard
2026-02-25 18:03:40 +01:00
Taus
6bfb1e1fae
Merge pull request #21344 from github/tausbn/python-remove-points-to-from-metrics-libraries
...
Python: Remove points-to from metrics library
2026-02-24 15:55:16 +01:00
Taus
f107235db2
Update change note
2026-02-24 15:08:36 +01:00
yoff
7df44f9418
python: add change note
2026-02-24 10:00:22 +01:00
yoff
7351e82c92
python: handle guards compared to boolean literals
2026-02-24 10:00:22 +01:00
Jon Janego
e14b4f1c5c
Merge branch 'main' into codeql-spark-run-22317536589
2026-02-23 11:52:17 -06:00
Jon Janego
79ac95d8a8
Fix syntax error with '=' in format specifier
2026-02-23 11:50:03 -06:00
Taus
480ae619e6
Merge pull request #21116 from github/tausbn/python-add-dataflow-overlay-annotations
...
Add `overlay[local]` annotations
2026-02-21 13:44:09 +01:00
Taus
07099f17d6
Python: Add change note
2026-02-19 12:32:27 +00:00
Taus
20fea3955e
Python: Remove points-to from Metrics.qll
...
Moves the classes/predicates that _actually_ depend on points-to to the
`LegacyPointsTo` module, leaving behind a module that contains all of
the metrics-related stuff (line counts, nesting depth, etc.) that don't
need points-to to be evaluated.
Consequently, `Metrics` is now no longer a private import in
`python.qll`.
2026-02-19 12:32:27 +00:00
Taus
6b6d8862b0
Merge pull request #21288 from microsoft/azure_python_sanitizer_upstream2
...
Azure python sanitizer upstream2
2026-02-18 14:59:59 +01:00
Taus
3d4785f29f
Python: Add change note
2026-02-18 12:51:35 +00:00
Ben Rodes
a1eaf42cbf
Update python/ql/lib/change-notes/2026-02-09-ssrf_test_case_cleanup_and_new_ssrf_barriers.md
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2026-02-17 13:05:51 -05:00
Ben Rodes
ceb3b21e0f
Update python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
...
Co-authored-by: Taus <tausbn@github.com >
2026-02-17 10:28:43 -05:00
github-actions[bot]
b5898c5a30
Post-release preparation for codeql-cli-2.24.2
2026-02-16 17:07:45 +00:00
Taus
cd62cdadff
Python: Fix bad join in returnStep
2026-02-16 16:48:08 +00:00
Taus
304cd12fff
Python: Fix bad join in missing_imported_module
...
This caused a ~30x blowup in intermediate tuples, now back to baseline.
2026-02-16 13:48:33 +00:00
Taus
987b10ab3e
Python: Fix bad join in OutgoingRequestCall
...
On `keras-team/keras`, this was producing ~200 million intermediate
tuples in order to produce a total of ... 2 tuples.
After the refactor, max intermediate tuple count is ~80k for the
charpred (and 4 for the new helper predicate).
2026-02-16 13:48:33 +00:00
Taus
72f5109ec2
Python: Add more overlay[caller] to Flow.qll
...
These were causing the repo `gufolabs/noc` to spend ~30 seconds
evaluating `ControlFlowNode.strictlyDominates`. Just in case, I added
`overlay[caller] to the other instances of `pragma[inline]` as well.
2026-02-16 13:48:33 +00:00
Taus
306d7d1b5d
Python: DataFlowDispatch.qll annotations
2026-02-16 13:48:32 +00:00
Taus
7ea96c43ec
Python: DataFlowPrivate.qll annotations
2026-02-16 13:48:32 +00:00
Taus
bd71db87be
Python: DataFlowPublic.qll annotations
2026-02-16 13:48:32 +00:00
Taus
c46c662b72
Python: LocalSources.qll annotations
2026-02-16 13:48:32 +00:00
Taus
df0f2f8ce4
Python: Simple dataflow annotations
...
None of these required any changes to the dataflow libraries, so it
seemed easiest to put them in their own commit.
2026-02-16 13:48:32 +00:00
Taus
51ebec9164
Python: Fix broken queries
2026-02-16 13:48:32 +00:00
Taus
fd7b123ee3
Python: Add overlay annotations to AST classes
...
... and everything else that it depends on.
2026-02-16 13:48:32 +00:00
github-actions[bot]
ef04f927fb
Release preparation for version 2.24.2
2026-02-16 13:29:25 +00:00
Taus
7d17454a3b
Merge pull request #21138 from github/tausbn/python-prepare-for-overlay-annotations
...
Prepare dataflow for local annotations
2026-02-12 14:23:45 +01:00
REDMOND\brodes
a91cf6b7cb
Applying copilot PR suggestions.
2026-02-10 11:37:11 -05:00
REDMOND\brodes
23bab81855
Added change log
2026-02-09 13:22:35 -05:00
REDMOND\brodes
df54459552
Restore prior PR change log (accidentally removed)
2026-02-09 13:19:02 -05:00
Ben Rodes
85ae4045c5
Merge branch 'main' into azure_python_sanitizer_upstream2
2026-02-09 13:12:38 -05:00
yoff
5ad42f8bcc
Merge pull request #20563 from microsoft/azure_python_sdk_url_summary_upstream
...
Azure python sdk url summary upstream
2026-02-09 18:34:36 +01:00
REDMOND\brodes
4f11913ee5
removing SSRFSink.qll
2026-02-06 11:23:58 -05:00
REDMOND\brodes
42f6e6a19c
Fixing inefficiently passed variable in nested existential quantification.
2026-02-06 11:20:15 -05:00
REDMOND\brodes
97ddab0724
Added support for new URIValidator in AntiSSRF library. Updated test caes to use postprocessing results. Currently results for partial ssrf still need work, it is flagging cases where the URL is fully controlled, but is sanitized. I'm not sure if this should be flagged yet.
2026-02-06 11:20:11 -05:00
REDMOND\brodes
27e19813be
Removing an upstream change log, not needed for local fork update.
2026-02-06 11:20:10 -05:00
REDMOND\brodes
88adb05d4b
Adjusting acryonym for SSRF for casing standards.
2026-02-06 11:20:08 -05:00
REDMOND\brodes
265922d2e5
Adding docs.
2026-02-06 11:20:01 -05:00
REDMOND\brodes
7db97799c1
Moved change log to correct location.
2026-02-06 11:19:22 -05:00
REDMOND\brodes
b8ba905253
Added change logs.
2026-02-06 11:18:23 -05:00
REDMOND\brodes
8459eec239
Moving the SsrfSink concept into Concepts.qll, and renaming to HttpClientRequestFromModel as suggested in PR review.
2026-02-06 09:26:49 -05:00
Ben Rodes
ac1987f264
Update python/ql/lib/change-notes/2025-09-30-azure_ssrf_models.md
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2026-02-05 15:44:44 -05:00
Taus
8c27437628
Python: Bump extractor version and add change note
2026-02-05 13:50:54 +00:00
REDMOND\brodes
0a88425170
Python: Altering SSRF MaD to use 'request-forgery' tag. Update to test cases expected results, off by one line. Changed to using ModelOutput::sinkNode.
2026-02-04 09:04:22 -05:00
