copilot-swe-agent[bot] 3a512ae777 Add os.path.basename as a sanitizer for py/path-injection ...

- Add test cases in path_injection.py demonstrating that os.path.basename
  prevents path traversal attacks (false positive scenarios)
- Add OsPathBasenameCall sanitizer class in PathInjectionCustomizations.qll
  that recognizes calls to os.path.basename (and posixpath/ntpath/genericpath
  variants) as barriers for the path-injection taint flow

os.path.basename strips all directory components from a path, returning only
the final filename. This makes it impossible for an attacker to inject path
traversal sequences like ../etc/passwd - the basename of such input would
just be 'passwd'.

Agent-Logs-Url: https://github.com/github/codeql/sessions/6603215b-21cd-4e05-8905-550434c7b9ff

Co-authored-by: hvitved <3667920+hvitved@users.noreply.github.com>

2026-04-16 08:19:48 +00:00

..

consistency-queries

Python: Fix consistency test failures

2026-01-30 12:50:25 +00:00

examples

Python: Fix example snippets

2025-11-26 12:30:30 +00:00

integration-tests/query-suite

python: Add query for prompt injection

2026-01-29 23:47:52 +01:00

lib

Add os.path.basename as a sanitizer for py/path-injection

2026-04-16 08:19:48 +00:00

src

Merge branch 'main' into post-release-prep/codeql-cli-2.25.2

2026-04-14 13:56:52 +01:00

test

Add os.path.basename as a sanitizer for py/path-injection

2026-04-16 08:19:48 +00:00