copilot-swe-agent[bot] 3a512ae777 Add os.path.basename as a sanitizer for py/path-injection ...

- Add test cases in path_injection.py demonstrating that os.path.basename
  prevents path traversal attacks (false positive scenarios)
- Add OsPathBasenameCall sanitizer class in PathInjectionCustomizations.qll
  that recognizes calls to os.path.basename (and posixpath/ntpath/genericpath
  variants) as barriers for the path-injection taint flow

os.path.basename strips all directory components from a path, returning only
the final filename. This makes it impossible for an attacker to inject path
traversal sequences like ../etc/passwd - the basename of such input would
just be 'passwd'.

Agent-Logs-Url: https://github.com/github/codeql/sessions/6603215b-21cd-4e05-8905-550434c7b9ff

Co-authored-by: hvitved <3667920+hvitved@users.noreply.github.com>

2026-04-16 08:19:48 +00:00

..

analysis

Python: Add jump-to-def tests for unpacking assignments

2025-08-28 10:38:21 +02:00

Classes

Python: Port ShouldBeContextManager.ql

2026-03-20 13:28:45 +00:00

Diagnostics

Renames diagnostic query files and tests

2024-01-29 20:19:20 +00:00

Exceptions/general

python: Inline expectation should have space after $

2026-03-04 12:45:05 +00:00

Expressions

Python: Fix false positive for unmatchable dollar/caret

2025-09-19 15:06:46 +00:00

Functions

Python: Port DeprecatedSliceMethod.ql

2026-03-20 13:30:29 +00:00

Imports

Python: Handle @pytest.fixture decorations with arguments as well

2024-06-14 15:11:25 +00:00

Lexical

update expected output of tests

2022-08-22 21:41:47 +02:00

Metrics

Python: Fix all metrics-related compilation failures

2025-11-26 21:28:51 +00:00

Numerics

Python: Update all test util paths to point to the new location.

2024-12-12 13:54:30 +01:00

Resources/FileNotAlwaysClosed

python: Inline expectation should have space after $

2026-03-04 12:45:05 +00:00

Security

Add os.path.basename as a sanitizer for py/path-injection

2026-04-16 08:19:48 +00:00

Statements

Python: Also exclude class scope

2026-04-07 23:46:03 +02:00

Testing

QL tests for Python queries and libraries.

2018-11-19 15:15:54 +00:00

Variables

python: Inline expectation should have space after $

2026-03-04 12:45:05 +00:00

options

Python: Remove ignored automatic_locations in qltest options files

2020-02-06 14:28:10 +01:00