yoff
85f1d92a0d
Apply suggestions from code review
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-03-25 11:42:32 +01:00
Rasmus Wriedt Larsen
d51aaf2f91
Python: Import framework-modeling in regex.qll
2022-03-24 14:28:44 +01:00
Rasmus Lerchedahl Petersen
ce017394e6
python: fix change note (hepofully)
2022-03-24 12:01:46 +01:00
Rasmus Lerchedahl Petersen
aecf4e48f8
python: add change note
2022-03-24 11:43:07 +01:00
Arthur Baars
1a9aaf4543
Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-24 11:37:03 +01:00
Arthur Baars
74aea81fe3
Ruby: refactor regex libraries
2022-03-24 11:37:02 +01:00
Ahmed Farid
eab6568cda
Update zipslip_good.py
2022-03-24 00:35:24 +01:00
Ahmed Farid
8dea7248ea
Update zipslip_bad.py
2022-03-24 00:34:52 +01:00
Ahmed Farid
b5f1e9de08
Update zipslip_bad.py
2022-03-24 00:33:28 +01:00
Ahmed Farid
a05318f10c
Update zipslip_good.py
2022-03-24 00:32:11 +01:00
Ahmed Farid
1836723ecb
Merge branch 'main' into ZipSlip
2022-03-23 19:27:12 -04:00
Taus
af888f7604
Python: Add call graph meta-query
2022-03-23 16:36:28 +00:00
Rasmus Lerchedahl Petersen
93336bcb16
python: allow alternative middleware
...
(observed [on LGTM](9d6a7ee180/files/mozillians/settings.py (L96)
2022-03-23 12:27:51 +01:00
yoff
647d37492d
Merge pull request #8289 from tausbn/python-remove-with-test-syntax-error
...
Python: Fix syntax error in `with` test output
2022-03-23 12:25:11 +01:00
Rasmus Lerchedahl Petersen
6c2449564a
python: add concept tests
2022-03-23 12:05:09 +01:00
Rasmus Lerchedahl Petersen
441e206cfa
python: CSRF -> Csrf
2022-03-23 11:29:27 +01:00
Rasmus Wriedt Larsen
bbf60b875e
Merge pull request #8476 from RasmusWL/shared-concepts-scaffolding
...
Python/JS/Ruby: Shared concepts scaffolding
2022-03-23 10:22:42 +01:00
Taus
f9120167b4
Python: Fix syntax error in with test output
...
Depends on an internal PR. The two lines in question were caused by
the insertion of an extra node due to the failure to parse a trailing
comma corrcetly.
2022-03-22 16:22:03 +00:00
yoff
47e062cfb9
Merge pull request #8486 from aibaars/incomplete-hostname-python
...
Python: switch to shared implementation of IncompleteHostnameRegExp.ql
2022-03-22 15:06:14 +01:00
Rasmus Lerchedahl Petersen
53de8287f5
python: rule out test code for CSRF
2022-03-22 14:57:05 +01:00
Rasmus Lerchedahl Petersen
0f2c21c8bd
python: require local protection to be absent
...
for CSRF to be likely
2022-03-22 13:42:52 +01:00
Rasmus Wriedt Larsen
6bd9d82610
Merge pull request #8061 from RasmusWL/orm
...
Python: Add data-flow through Django ORM models
2022-03-22 11:14:08 +01:00
Rasmus Wriedt Larsen
311cbb4e13
Merge branch 'main' into shared-concepts-scaffolding
2022-03-22 10:36:33 +01:00
Rasmus Wriedt Larsen
414764ccee
Concepts: Minor rewrite in qldoc
...
As suggested by @hmac
2022-03-22 10:33:58 +01:00
Rasmus Lerchedahl Petersen
f5b53083ae
python: require authentication middleware
...
for CSRF to be relevant
2022-03-22 08:44:19 +01:00
github-actions[bot]
a3e74efc21
Post-release preparation for codeql-cli-2.8.4
2022-03-21 19:36:47 +00:00
Rasmus Wriedt Larsen
88184ba9f5
Python: Update path-injection .expected
...
AHA! This change happened because we are no longer importing all the old
deprecated implementation.
2022-03-21 20:24:12 +01:00
Rasmus Wriedt Larsen
758a81cc0f
Python: Remove import of Concepts in DataFlowPrivate
...
As discussed in PR review
2022-03-21 16:22:15 +01:00
Rasmus Wriedt Larsen
978ef05571
Python: Add change-note
2022-03-21 16:18:40 +01:00
Rasmus Wriedt Larsen
b8dee25cce
Python: ReflectedXSS -> ReflectedXss for new Query file
...
So we stick to the naming conventions.
This rename is OK, since the new file was only just introduced in this
PR.
2022-03-21 16:12:38 +01:00
Arthur Baars
79cd7bf8ed
Python: create semmle/python/dataflow/new/Regex.qll
2022-03-21 15:57:19 +01:00
Rasmus Wriedt Larsen
695553ba9f
Python: Deprecate old non-Query.qll dataflow defs
2022-03-21 15:03:22 +01:00
Rasmus Wriedt Larsen
db86a18791
Python: Autoformat
2022-03-21 14:53:53 +01:00
Rasmus Wriedt Larsen
0125aea91b
Python: Re-introduce old dataflow configs .qll files
...
and move all the old deprecated aliases to that file. We now have a
situation where all queries should work as they did before, and we just
have these new Query.qll files that contain the implementation.
(deprecation comes later)
2022-03-21 14:53:53 +01:00
Rasmus Wriedt Larsen
1bf8fa6a3b
Python: Adopt Query.qll suffix for dataflow config defs
...
This commit in itself makes everything break, but should make it easy to
follow the overall changes being made.
2022-03-21 14:53:53 +01:00
github-actions[bot]
dedc8c2254
Release preparation for version 2.8.4
2022-03-21 13:25:49 +00:00
Alex Ford
c891c53835
Merge pull request #8395 from alexrford/ruby/clear-text-storage
...
Ruby: add `rb/clear-text-storage-sensitive-data` query
2022-03-21 10:05:39 +00:00
Arthur Baars
9412b331db
Revert "Revert "Python: switch to shared implementation of IncompleteHostnameRegExp.ql""
...
This reverts commit 6d24591416
2022-03-18 16:31:22 +01:00
Arthur Baars
431b60506e
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-18 13:05:34 +01:00
Arthur Baars
6d24591416
Revert "Python: switch to shared implementation of IncompleteHostnameRegExp.ql"
...
This reverts commit ce50f35dda
2022-03-18 13:02:55 +01:00
Mathias Vorreiter Pedersen
abe30457ee
Python: Accept test changes.
2022-03-17 14:03:58 +01:00
Tom Hvitved
79ea2a3a9c
Data flow: Sync files
2022-03-17 14:03:58 +01:00
Rasmus Wriedt Larsen
2b9408b0c3
Concepts: Add some architecture documentation
2022-03-17 13:49:10 +01:00
Harry Maclean
36c421346b
Introduce ConceptsShared.qll
2022-03-17 13:49:10 +01:00
Erik Krogh Kristensen
f3ca6bbc2e
PY: update expected output after fixing bug in flask model
2022-03-17 09:42:30 +01:00
Erik Krogh Kristensen
879680057e
fix all ql/unused-field warnings
2022-03-17 09:41:42 +01:00
Jeroen Ketema
7a9a9d833a
Merge pull request #8435 from jketema/all-the-barriers
...
Add flow state versions of isBarrierIn, isBarrierOut, and isBarrierGuard
2022-03-16 15:50:19 +01:00
Arthur Baars
ab93b3784b
Merge remote-tracking branch 'upstream/main' into incomplete-hostname
2022-03-16 12:31:12 +01:00
Rasmus Wriedt Larsen
ae1ba11d57
Merge branch 'main' into orm
2022-03-16 11:23:14 +01:00
Rasmus Wriedt Larsen
f1e6271d20
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-16 10:53:19 +01:00
