Rasmus Wriedt Larsen
5ba8e102eb
Python: Adopt tests to new DataflowQueryTest
...
Since we want to know the _sinks_ and not just the flow, we need to
expose the config as well :|
2023-08-28 15:31:08 +02:00
Rasmus Wriedt Larsen
6961ca5234
Python: Rename to EmailXss
2023-08-28 15:31:08 +02:00
Rasmus Wriedt Larsen
ed0e441567
Python: Accept missing DataflowQueryTest implementation for now
2023-08-28 15:31:08 +02:00
Rasmus Wriedt Larsen
bfcc194b85
Python: Move experimental paramiko to new dataflow API
2023-08-28 15:31:08 +02:00
Rasmus Wriedt Larsen
1a4e8d9464
Python: Move experimental PossibleTimingAttackAgainstSensitiveInfo to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
67cc3a3935
Python: Move experimental ReflectedXSS to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
a0d26741d0
Python: Move experimental TarSlipImprov to new dataflow API
2023-08-28 15:31:07 +02:00
Rasmus Wriedt Larsen
3cdd875e9f
Python: Move experimental UnsafeUnpack to new dataflow API
2023-08-28 15:31:07 +02:00
yoff
826b8e6aa5
Merge pull request #14067 from RasmusWL/modern-dataflowquerytests
...
Python: Adopt tests to new `DataflowQueryTest`
2023-08-28 13:54:34 +02:00
Rasmus Wriedt Larsen
889cb7a95b
Python: Adopt tests to new DataflowQueryTest
...
Co-authored-by: Rasmus Lerchedahl Petersen <yoff@github.com >
2023-08-28 11:44:01 +02:00
Rasmus Wriedt Larsen
7cba6cd1d8
Python: Update .expected files
...
Due to change in path-graph, and including LHS of assignments
2023-08-28 11:33:44 +02:00
Rasmus Wriedt Larsen
0f242475f2
Merge branch 'main' into experimental-cleanup
2023-08-28 11:01:22 +02:00
Rasmus Wriedt Larsen
f33359bd5c
Python: Fix tests
2023-08-23 15:37:55 +02:00
yoff
00c0ebe9e4
Merge pull request #13738 from RasmusWL/path-steps
...
Python: Include all assignments in data flow paths
2023-08-22 11:58:11 +02:00
Rasmus Wriedt Larsen
b579ab0694
Python: Accept .expected change
2023-08-18 11:12:55 +02:00
Rasmus Wriedt Larsen
38577e6a5c
Python: Remove duplicated SSTI tests
...
Besides the Cheetah tests, which were missing from the query tests.
2023-08-18 10:20:16 +02:00
Rasmus Wriedt Larsen
33f8998c2e
Python: Minor fix in test
2023-08-18 10:19:44 +02:00
Rasmus Wriedt Larsen
cf54d3f4ca
Python: Move paramiko tests to own folder
2023-08-17 15:45:28 +02:00
Rasmus Wriedt Larsen
4c693b4fc3
Python: Port py/xslt-injection to new data-flow
2023-08-17 15:45:07 +02:00
Rasmus Wriedt Larsen
ef139f2ee9
Python: Delete XsltSinks.ql test
2023-08-17 15:45:07 +02:00
Rasmus Wriedt Larsen
779fe6498c
Python: Rename to XsltInjection.ql
2023-08-17 15:45:07 +02:00
Rasmus Wriedt Larsen
0336c76871
Python: Rename template injection tests
2023-08-17 15:45:04 +02:00
Rasmus Wriedt Larsen
91edde72c4
Python: Port py/template-injection to new data-flow
...
I kept all the modeling in _one_ file, since that makes it easy to work
with such an external contribution... and I would certainly propose this
file setup for the future 👍
2023-08-17 15:44:26 +02:00
Rasmus Wriedt Larsen
1c3cc1fa29
Python: Remove flow through stdlib
...
This means tests can pass on any machine now 👍
2023-08-14 11:55:22 +02:00
Rasmus Wriedt Larsen
0fba38c6d8
Merge branch 'main' into amammad-python-WebAppsConstatntSecretKeys
2023-08-14 11:29:56 +02:00
Rasmus Wriedt Larsen
ca93f4d223
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
Anders Schack-Mulligen
ae24d68b5d
C/C++/C#/Java/Python/Ruby/Swift: Adjust expected output.
2023-07-19 11:41:15 +02:00
Rasmus Wriedt Larsen
aa8ed91993
Python: Accept .expected changes
...
but it's kinda bad, since it has paths to stdlib in there :(
2023-07-14 14:47:27 +02:00
Rasmus Wriedt Larsen
9e0f985e23
Python: Fix qlref
2023-07-14 14:33:17 +02:00
amammad
816799c4ba
upgrade query to detect redash CVE too
2023-06-30 22:14:50 +10:00
amammad
7a17b99c17
V2
2023-06-29 20:55:51 +10:00
amammad
e3e0307db7
V1
2023-06-25 20:36:28 +10:00
Jeroen Ketema
dba4460526
Python: Update more inline expectation tests to use the paramterized module
2023-06-20 10:16:15 +02:00
Rasmus Lerchedahl Petersen
4b4b9bf9da
python: add missing summaries
...
For append/add:
The new results in the experimental tar slip query
show that we do not recognize the sanitisers.
2023-06-13 20:22:21 +02:00
Rasmus Lerchedahl Petersen
b72c93ff4f
python: remove remaining explicit taint steps
2023-06-13 20:22:20 +02:00
Rasmus Lerchedahl Petersen
9cb83fcdc9
python: add summaries for
...
copy, pop, get, getitem, setdefault
Also add read steps to taint tracking.
Reading from a tainted collection can be done in two situations:
1. There is an acces path
In this case a read step (possibly from a flow summary)
gives rise to a taint step.
2. There is no access path
In this case an explicit taint step (possibly via a flow
summary) should exist.
2023-05-26 14:04:15 +02:00
Rasmus Lerchedahl Petersen
144df9a39e
python: remove explicit dataflow steps
2023-05-26 13:24:22 +02:00
Rasmus Wriedt Larsen
a057365b7e
Python: Accept .expected changes
2023-05-22 11:54:50 +02:00
Rasmus Wriedt Larsen
44d806507d
Merge branch 'main' into python-UBV
2023-05-22 11:53:56 +02:00
yoff
a905917123
Merge pull request #12937 from RasmusWL/fix-module-variable-node
...
Python: Hide `ModuleVariableNode` in data-flow paths
2023-05-03 17:58:26 +02:00
Sim4n6
1fa1a4e268
Add Unicode Bypass Validation query tests and help
2023-05-02 15:09:16 +01:00
yoff
0bc6f10a71
Merge pull request #12220 from amammad/amammad-python-paramiko
...
add some python sinks for paramiko ssh clients
2023-05-01 11:38:50 +02:00
Rasmus Wriedt Larsen
d73289ac4e
Python: Accept .expected changes
2023-04-27 11:54:39 +02:00
amammad
1bf159e9a9
Merge branch 'github:main' into amammad-python-paramiko
2023-04-26 23:28:29 -07:00
Rasmus Wriedt Larsen
7fa84a3613
Python: Only test UnsafeUnpacking with Python 3
...
Apparently the fixup of .expected in the latest commit was only required
when extracting as Python 3, but not as Python 2... I honestly don't
understand why.
2023-04-24 12:29:58 +02:00
Rasmus Wriedt Larsen
b60cab254a
Python: Accept .expected change
2023-04-21 15:25:47 +02:00
Rasmus Wriedt Larsen
f3937a4a12
Python: Update .expected from PostUpdateNode commit
2023-03-30 10:17:33 +02:00
Raul Garcia
cf8a683d7d
Merge branch 'main' into main
2023-03-29 20:27:03 -07:00
Rasmus Wriedt Larsen
86333e3ba5
Python: Remove duplicate results from azure blob query
2023-03-29 11:47:29 +02:00
Rasmus Wriedt Larsen
32d52c023e
Python: Allow any order for azure blob query
...
By only allowing the sink in the state where encryption v1 is used, we
can handle the new case where the order of attribute assignment is
flipped.
However, we get a few too many paths because we can have multiple
sources reaching the same sink... let's fix in next commit.
2023-03-29 11:42:01 +02:00
