Jorge
f02b6d60a5
Merge branch 'github:main' into jorgectf/python/ldapinsecureauth
2021-07-22 18:49:51 +02:00
jorgectf
b03e75e3d1
Extend ldap3's start_tls and fix tests
2021-07-22 18:42:41 +02:00
jorgectf
a34d6d390e
Port to ApiGraphs and finish the query
2021-07-22 18:34:57 +02:00
Rasmus Wriedt Larsen
42a997cbcb
Python: Fix deprecation warning
2021-07-22 15:59:13 +02:00
Rasmus Wriedt Larsen
71e6db8a01
Merge branch 'main' into jorgectf/python/ldapimproperauth
2021-07-22 15:57:43 +02:00
Rasmus Wriedt Larsen
802d9bda83
Merge pull request #5680 from mrthankyou/python-use-sqlalchemy
...
Python: Add SqlAlchemy model
2021-07-22 15:31:39 +02:00
Taus
e9a4114c04
Python: Hotfix: Disable ReDoS queries
2021-07-22 10:58:49 +00:00
jorgectf
edb273ace5
Merge remote-tracking branch 'origin/jorgectf/python/ldapimproperauth' into jorgectf/python/ldapinsecureauth
2021-07-22 02:51:19 +02:00
thank_you
9e01338500
Query only vulnerable methods
2021-07-18 17:13:10 -04:00
thank_you
0be2c6b765
Add SQLEscapySanitizerCall class
2021-06-29 19:39:46 -04:00
thank_you
986f2f4302
Add SQLEscape module
2021-06-29 19:39:26 -04:00
jorgectf
2f9e6454a5
Hardcode ldap2 binding functions
2021-06-29 16:14:55 +02:00
Rasmus Wriedt Larsen
a5a7f3e38a
Python: Add taint-step for sqlalchemy.text
2021-06-29 11:06:25 +02:00
Rasmus Wriedt Larsen
684f51ae5f
Merge branch 'main' into python-use-sqlalchemy
2021-06-29 10:58:51 +02:00
jorgectf
1d4d8ab6e0
Fix tests
2021-06-28 14:16:52 +02:00
jorgectf
b9422518b3
Rephrase .qhelp
2021-06-28 14:00:00 +02:00
Rasmus Wriedt Larsen
5477b2e0d5
Python: Minor refactoring cleanup
2021-06-28 10:54:21 +02:00
Rasmus Wriedt Larsen
4a2c99a021
Python: Inline LDAPImproperAuth.qll
...
Since having it inlined makes the query a bit easier to read. We
obviously need to share it if we want to share this predicate, but for
now that does not seem to be the case.
2021-06-28 10:54:21 +02:00
Rasmus Wriedt Larsen
b33f6a315c
Python: Fix select for py/improper-ldap-auth
2021-06-28 10:54:21 +02:00
Rasmus Wriedt Larsen
dfe16aae4c
Python: Handle both positional and keyword args for LDAP bind
2021-06-28 10:46:13 +02:00
Rasmus Wriedt Larsen
a9469b73d9
Python: Port py/clear-text-storage-sensitive-data
2021-06-24 17:39:08 +02:00
Rasmus Wriedt Larsen
e05d6e71b8
Merge pull request #6064 from tausbn/python-add-get-method-call
...
Python: Add `getAMethodCall` to `LocalSourceNode`
2021-06-22 11:16:39 +02:00
Taus
768cab3642
Python: Address review comments
...
- changes `getReceiver` to `getObject`
- fixes `calls` to avoid unwanted cross-talk
- adds some more documentation to highlight the above issue
2021-06-21 14:57:19 +00:00
jorgectf
1d7ddce8db
Update .expected
2021-06-17 18:10:43 +02:00
jorgectf
9cbb7e0899
Change query objective
2021-06-17 17:53:58 +02:00
jorgectf
5704ac36db
Rework LDAP framework modeling
2021-06-17 17:44:08 +02:00
jorgectf
13cfcec968
Change qhelp explanation
2021-06-17 17:43:34 +02:00
jorgectf
d34d2ed2b1
Add .qlref
2021-06-17 17:42:38 +02:00
Taus
41ee325bc9
Python: Clean up Stdlib.qll
...
Not as many opportunities to clean stuff up here.
2021-06-15 15:04:30 +00:00
Rasmus Wriedt Larsen
156b10cb59
Merge branch 'main' into promote-clickhouse
2021-06-15 11:30:19 +02:00
jorgectf
1662c5d113
resolve merge conflict
2021-06-15 01:22:11 +02:00
Taus
3869ab76d1
Python: Promote shared type tracking library
...
This was slightly messier than anticipated, as I hadn't accounted for
the dozen uses of `startInAttr` in our codebase. To circumvent this,
I decided to put the type tracking implementation in the `internal`
directory, and wrap it with a file that ensures the old interface still
works.
2021-06-11 20:20:22 +00:00
Rasmus Wriedt Larsen
f807c2f52b
Python: autoformat
2021-05-26 11:07:48 +02:00
Rasmus Wriedt Larsen
d5f2846394
Merge branch 'main' into jorgectf/python/ldapInjection
2021-05-26 11:01:48 +02:00
Rasmus Wriedt Larsen
1b3f857a2f
Python: Promote ClickHouse SQL models
2021-05-25 16:27:23 +02:00
Rasmus Wriedt Larsen
eb1da152a0
Python: Rewrite ClickHouse SQL lib modeling
...
This did turn into a few changes, that maybe could have been split into
separate PRs 🤷
* Rename `ClickHouseDriver` => `ClickhouseDriver`, to better follow
import name in `.qll` name
* Rewrote modeling to use API graphs
* Split modeling of `aioch` into separate `.qll` file, which does re-use
the `getExecuteMethodName` predicate. I feel that sharing code between
the modeling like this was the best approach, and stuck the
`INTERNAL: Do not use.` labels on both modules.
* I also added handling of keyword arguments (see change in .py files)
2021-05-25 16:13:31 +02:00
Rasmus Wriedt Larsen
ee3477c20a
Python: Remove dummy clickhouse SQL injection query
2021-05-25 14:27:29 +02:00
Rasmus Wriedt Larsen
35793a10bb
Merge pull request #5889 from japroc/python-clickhouse-driver
...
Python: Implement module ClickHouseDriver.qll
2021-05-25 14:25:28 +02:00
jorgectf
37d6ff76a3
Update tests and .expected
2021-05-21 17:47:53 +02:00
Jorge
9e9678b3ca
Apply documentation suggestions
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2021-05-21 16:17:39 +02:00
Tom Hvitved
2a7ceb2e19
Merge pull request #5928 from hvitved/python/type-tracker-split
...
Python: Split up `(small)step` into intra/interprocedural predicates
2021-05-20 14:13:44 +02:00
Tom Hvitved
1fc95a68ca
Python: Add more type tracking QL doc
2021-05-20 13:47:23 +02:00
Tom Hvitved
f63c1d2383
Python: Split up (small)step into intra/interprocedural predicates
2021-05-19 19:59:25 +02:00
Evgenii Protsenko
af75d85b2e
ClickHouseSQLInjection.qll : add tests
2021-05-18 22:49:11 +03:00
Rasmus Wriedt Larsen
97fadd9970
Merge branch 'main' into port-weak-crypto-algorithm
2021-05-18 14:04:18 +02:00
Evgenii Protsenko
470e3eb089
[python] ClickHouseDriver.qll: add support for subclasses
2021-05-13 00:03:53 +03:00
Evgenii Protsenko
2efa0ad105
[C++] Implement module ClickHouseDriver.qll
2021-05-12 22:36:24 +03:00
yoff
0e5a2c4573
Merge pull request #5442 from jorgectf/jorgectf/python/redos
...
Python: Add Regular Expression Injection query
2021-05-11 12:11:35 +02:00
yoff
78370cf63f
Update python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll
2021-05-10 14:53:40 +02:00
jorgectf
8665747316
Update sink and sanitizer to match new naming
2021-05-08 18:08:50 +02:00
