Rasmus Wriedt Larsen
10fdc4bfb9
Python: Add support for more yaml loading functions
2021-02-12 12:30:00 +01:00
Rasmus Wriedt Larsen
2021cdbe33
Python: Add tests for more yaml loading functions
2021-02-12 12:30:00 +01:00
Rasmus Wriedt Larsen
c57a4df819
Python: Model taint of self.request on django view class
2021-02-10 17:48:48 +01:00
Rasmus Wriedt Larsen
9ca738d921
Python: Add taint test for self.request on django view class
2021-02-10 17:48:41 +01:00
Rasmus Wriedt Larsen
ca0d345987
Django: Model any class used in django route setup as view class
2021-02-10 16:26:25 +01:00
Rasmus Wriedt Larsen
78a3206fce
Python: Add test with unkown view class in django
2021-02-10 15:56:33 +01:00
Rasmus Wriedt Larsen
42eceb80bd
Python: Handle view functions with decorators
2021-02-10 15:47:55 +01:00
Rasmus Wriedt Larsen
eb7e30d472
Python: Add test of django view handler with decorator
...
Which we currently don't handle :(
Also added a bit more explanatory comments
2021-02-09 13:25:12 +01:00
Rasmus Wriedt Larsen
e57e4e1916
Merge branch 'main' into port-url-redirect-query
2021-02-02 13:37:34 +01:00
Rasmus Wriedt Larsen
d046e39a82
Python: Fix tornado inline expectations in tests
...
After merge commit
2021-02-02 12:04:24 +01:00
Rasmus Wriedt Larsen
4b6a59a126
Python: Apply code-review suggestion
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-02-01 11:12:32 +01:00
Rasmus Wriedt Larsen
94e7980ca4
Merge branch 'main' into port-url-redirect-query
2021-01-29 16:22:50 +01:00
Rasmus Wriedt Larsen
9c01aa2304
Python: Add modeling for django.shortcuts.redirect
2021-01-29 15:41:00 +01:00
Rasmus Wriedt Larsen
ff2f2b5792
Python: Add django.shortcuts.redirect test
2021-01-29 15:37:20 +01:00
Rasmus Wriedt Larsen
173012578e
Python: Add missing type-tracking step for django.views
...
Easy to overlook, and will onyl be caught by tests if they use `import
parent.thing` and not `from parent import thing`
2021-01-28 12:10:42 +01:00
Rasmus Wriedt Larsen
54725ccbb9
Python: Support full-path import of Django View class
...
requestHandler still MISSING :(
2021-01-28 12:10:40 +01:00
Rasmus Wriedt Larsen
61d69f2cc8
Python: Add test for full-path import of Django View class
2021-01-28 12:10:39 +01:00
Rasmus Wriedt Larsen
7a76a5134e
Python: Add redirect modeling for Tornado
...
After making https://github.com/github/codeql/pull/4995 , I realized how easy
this would be :D
Will need to do some manual merge-conflict handling, but it should be all good
:)
2021-01-21 14:04:11 +01:00
Rasmus Wriedt Larsen
2f86937e5a
Python: Remove unused param in test code
2021-01-21 13:44:56 +01:00
Rasmus Wriedt Larsen
b55817a5b2
Python: Model HTTP responses in tornado
...
This is quite a simpel model, but ends up matching what we were able to do with
points-to.
I think this modeling excercise really shows that we need a bit of a different
way to model HTTP responses... but I'm not going to try to fix that in this PR.
2021-01-21 13:26:31 +01:00
Rasmus Wriedt Larsen
ac77a8b8a8
Python: Add proper HTTP response tests for Tornado
2021-01-21 13:22:31 +01:00
Rasmus Wriedt Larsen
ab607b8030
Python: Add redirect modeling for Django
2021-01-19 14:45:41 +01:00
Rasmus Wriedt Larsen
aea974ee0c
Python: Add redirect modeling for Flask
2021-01-19 14:44:50 +01:00
Rasmus Wriedt Larsen
501e510622
Python: Add redirect modeling tests (flask/django)
2021-01-19 14:43:25 +01:00
yoff
b5d40e4c9a
Merge pull request #4944 from RasmusWL/flask-class-based-handlers
...
Python: Add modeling of Flask class based (HTTP) request handlers
2021-01-14 15:17:36 +01:00
Rasmus Wriedt Larsen
4cb2f2ed1e
Python: Proper models of flask MethodView classes
2021-01-14 13:42:18 +01:00
Rasmus Wriedt Larsen
e327fdb317
Python: Model flask View classes
2021-01-14 13:42:18 +01:00
Rasmus Wriedt Larsen
0b1cece523
Python: Add tests for class based handlers in Flask
2021-01-14 13:42:17 +01:00
Rasmus Wriedt Larsen
812ea5dde5
Python: Tornado: Model request handlers without known route
2021-01-14 13:37:27 +01:00
Rasmus Wriedt Larsen
1849b9e771
Python: Tornado: Handle basic route setup with tuples
...
The reason this becomes valueable right now, is that we can mark routed params
as taint-sources. Longer down the line, we can (hopefully) detect that a routed
param will only accept digits, and mark it safe for some of our taint-tracking
queries.
2021-01-14 13:37:26 +01:00
Rasmus Wriedt Larsen
39d85896a1
Python: Add basic taint modeling of tornado request
2021-01-14 13:37:26 +01:00
Rasmus Wriedt Larsen
4641150d45
Python: Basic taint-modeling of tornado.web.RequestHandler classes
2021-01-14 13:37:25 +01:00
Rasmus Wriedt Larsen
9cd8a862a0
Python: Expand Tornado tests and add annotations
...
I should probably have split this up into 2 commits, so sorry that didn't happen :|
2021-01-14 13:37:24 +01:00
Rasmus Wriedt Larsen
b4f3399534
Python: Add reverse inheritance test for Tornado
2021-01-14 13:37:24 +01:00
Rasmus Wriedt Larsen
57d08a8523
Python: Rewrite old Tornado tests
...
Now you can run them, and the examples have been adjusted so they actually work!
2021-01-14 13:37:23 +01:00
Rasmus Wriedt Larsen
7db55906b9
Python: Copy old tornado tests
2021-01-14 13:37:22 +01:00
Rasmus Wriedt Larsen
71a6ef5b00
Python: Model RequestHandler from standard library explicitly
2020-12-21 18:02:31 +01:00
Rasmus Wriedt Larsen
d4d6f0ca0c
Python: Model django request handlers without known route
2020-12-21 18:02:22 +01:00
Rasmus Wriedt Larsen
004ff38e22
Python: Add separate RequestHandler concept
...
Since I really want to use our existing infrastructure to model that we can
recognize something as a request handler without it having a route, we need this
as a separate concept. All tests have been adjusted.
The early modeling was based on flask, where all request-handling is based on
handling requests from a specific route. But with the standard library handling
and handlers without routes, the naming had to change.
2020-12-21 17:31:58 +01:00
Rasmus Wriedt Larsen
a9bbe1d087
Python: Test Django un-routed class-based route handler
2020-12-21 16:01:23 +01:00
yoff
a08eb99778
Merge pull request #4779 from RasmusWL/django-class-based-handlers
...
Python: Add modeling of django class based view handlers
2020-12-18 15:58:51 +01:00
Rasmus Wriedt Larsen
272feedb69
Merge branch 'main' into stdlib-http-source-modeling
2020-12-15 11:59:23 +01:00
CodeQL CI
0420ac7aac
Merge pull request #4820 from RasmusWL/add-pymysql-modeling
...
Approved by yoff
2020-12-14 03:04:24 -08:00
Rasmus Wriedt Larsen
31d4ea77cb
Python: Add modeling of PyMySQL
2020-12-14 10:56:47 +01:00
Rasmus Wriedt Larsen
e7b6400e48
Python: Add tests for PyMySQL
2020-12-14 10:55:01 +01:00
Rasmus Wriedt Larsen
8d8e92eb09
Python: Model execute on a DB connection
2020-12-14 10:33:10 +01:00
Rasmus Wriedt Larsen
36e8ef53eb
Python: Model sqlite3 as SQL interface
2020-12-09 11:36:18 +01:00
Rasmus Wriedt Larsen
767a246edc
Python: Add sqlite3 test
2020-12-09 11:36:17 +01:00
Rasmus Wriedt Larsen
ba1ca70858
Python: Add source modeling of stdlib HTTPRequestHandlers
2020-12-08 14:04:15 +01:00
Rasmus Wriedt Larsen
34863721f0
Python: Model cgi.FieldStorage
2020-12-08 14:03:13 +01:00
