hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 12:46:34 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
083be305e13e65ac6ef8a61eb27dd2a828dce243
codeql/python/ql/test/query-tests/Security
History
Rasmus Wriedt Larsen 2d947a4f53 Merge pull request #13781 from maikypedia/maikypedia/python-unsafe-deserialization 
Python: Add unsafe deserialization sinks (CWE-502)
2023-10-10 13:30:38 +02:00
..
CVE-2018-1281
Python: Port bind-to-all-interfaces to type-tracking
2021-02-23 16:01:24 +01:00
CWE-020-ExternalAPIs
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-020-IncompleteHostnameRegExp
Update expected test output.
2023-09-22 11:28:50 +01:00
CWE-020-IncompleteUrlSubstringSanitization
changes to address reviews
2022-10-07 22:31:00 +02:00
CWE-020-SuspiciousRegexpRange
escape unicode chars in overly-large-range
2023-09-28 20:16:09 +02:00
CWE-022-PathInjection
Python: Adopt tests to new DataflowQueryTest
2023-08-28 15:31:08 +02:00
CWE-022-TarSlip
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-078-CommandInjection
Python: Adopt tests to new DataflowQueryTest
2023-08-28 15:31:08 +02:00
CWE-078-CommandInjection-py2
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-078-UnsafeShellCommandConstruction
Merge pull request #14068 from RasmusWL/dataflow-config-refactor
2023-09-04 21:04:10 +02:00
CWE-079-Jinja2WithoutEscaping
Python: Remove last -p ../lib/ in options files
2022-09-29 18:05:51 +02:00
CWE-079-ReflectedXss
Python: Fix Flask jsonify XSS regression
2023-08-29 11:11:32 +02:00
CWE-089-SqlInjection
fix some more style-guide violations in the alert-messages
2022-10-07 11:23:34 +02:00
CWE-090-LdapInjection
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-094-CodeInjection
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-116-BadTagFilter
PythonÆ fix test expectations
2023-08-24 21:21:49 +02:00
CWE-117-LogInjection
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-209-StackTraceExposure
Python: Move StackTraceExposure to new dataflow API
2023-08-28 15:27:50 +02:00
CWE-215-FlaskDebug
Python: Expand test for py/flask-debug
2022-10-04 20:39:08 +02:00
CWE-285-PamAuthorization
Python: Move PamAuthorization to new dataflow API
2023-08-28 15:27:50 +02:00
CWE-295-MissingHostKeyValidation
Python: Expand modeling of paramiko
2023-04-18 11:57:20 +02:00
CWE-295-RequestWithoutValidation
changes to address reviews
2022-10-07 22:31:00 +02:00
CWE-312-CleartextLogging
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-312-CleartextStorage
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-312-CleartextStorage-py3
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-326-WeakCryptoKey
update python test cases
2022-12-01 11:56:44 -05:00
CWE-327-BrokenCryptoAlgorithm
python: update py/weak-cryptographic-algorithm to flag use of ECB block mode
2022-05-13 16:32:36 +01:00
CWE-327-InsecureDefaultProtocol
Python: Fix test folder for InsecureDefaultProtocol
2021-07-19 16:56:07 +02:00
CWE-327-InsecureProtocol
Merge branch 'main' into python/rewrite-InsecureContextConfiguration
2023-03-27 10:20:53 +02:00
CWE-327-WeakSensitiveDataHashing
Python: Move WeakSensitiveDataHashing to new dataflow API
2023-08-28 15:27:50 +02:00
CWE-377-InsecureTemporaryFile
Python: Restructure security tests to contain query name
2021-07-19 16:54:34 +02:00
CWE-502-UnsafeDeserialization
Python: Accept .expected
2023-09-28 10:41:16 +02:00
CWE-601-UrlRedirect
add sanitizer guard for url_has_allowed_host_and_scheme
2023-08-31 13:48:42 +02:00
CWE-611-Xxe
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-643-XPathInjection
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-730-PolynomialReDoS
Update expected test output.
2023-09-22 11:28:50 +01:00
CWE-730-ReDoS
Python: accept improved test output
2023-09-26 20:58:51 +02:00
CWE-730-RegexInjection
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-732-WeakFilePermissions
Python: Accept change to WeakFilePermissions.expected
2023-02-16 13:27:16 +01:00
CWE-776-XmlBomb
Python: Accept .expected changes
2023-08-11 10:36:05 +02:00
CWE-798-HardcodedCredentials
do a quick-and-dirty conversion of py/hardcoded-credentials to the new dataflow library
2023-06-14 08:31:56 +02:00
CWE-918-ServerSideRequestForgery
Python: Move FullServerSideRequestForgery and PartialServerSideRequestForgery to new dataflow API
2023-08-28 15:27:50 +02:00
CWE-943-NoSqlInjection
Python: Add keyword argument support
2023-09-29 13:54:21 +02:00
lib
Python : Add query to detect Server Side Template Injection
2020-07-21 18:01:27 +05:30