Rasmus Lerchedahl Petersen c0b3245a53 Python: Enrich the NoSql concept ...

This allows us to make more precise modelling
The query tests now pass.
I do wonder, if there is a cleaner approach, similar to
`TaintedObject` in JavaScript. I want the option to
get this query in the hands of the custumors before
such an investigation, though.

2023-09-07 10:22:37 +02:00

..

CVE-2018-1281

Python: Port bind-to-all-interfaces to type-tracking

2021-02-23 16:01:24 +01:00

CWE-020-ExternalAPIs

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-020-IncompleteHostnameRegExp

Revert "Revert "Python: switch to shared implementation of IncompleteHostnameRegExp.ql""

2022-03-18 16:31:22 +01:00

CWE-020-IncompleteUrlSubstringSanitization

changes to address reviews

2022-10-07 22:31:00 +02:00

CWE-020-SuspiciousRegexpRange

rename query to overly-large-range, and rewrite the @description

2022-07-12 16:02:46 +02:00

CWE-022-PathInjection

Python: Adopt tests to new DataflowQueryTest

2023-08-28 15:31:08 +02:00

CWE-022-TarSlip

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-078-CommandInjection

Python: Adopt tests to new DataflowQueryTest

2023-08-28 15:31:08 +02:00

CWE-078-CommandInjection-py2

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-078-UnsafeShellCommandConstruction

Merge pull request #14068 from RasmusWL/dataflow-config-refactor

2023-09-04 21:04:10 +02:00

CWE-079-Jinja2WithoutEscaping

Python: Remove last -p ../lib/ in options files

2022-09-29 18:05:51 +02:00

CWE-079-ReflectedXss

Python: Fix Flask jsonify XSS regression

2023-08-29 11:11:32 +02:00

CWE-089-SqlInjection

fix some more style-guide violations in the alert-messages

2022-10-07 11:23:34 +02:00

CWE-090-LdapInjection

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-094-CodeInjection

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-116-BadTagFilter

PythonÆ fix test expectations

2023-08-24 21:21:49 +02:00

CWE-117-LogInjection

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-209-StackTraceExposure

Python: Move StackTraceExposure to new dataflow API

2023-08-28 15:27:50 +02:00

CWE-215-FlaskDebug

Python: Expand test for py/flask-debug

2022-10-04 20:39:08 +02:00

CWE-285-PamAuthorization

Python: Move PamAuthorization to new dataflow API

2023-08-28 15:27:50 +02:00

CWE-295-MissingHostKeyValidation

Python: Expand modeling of paramiko

2023-04-18 11:57:20 +02:00

CWE-295-RequestWithoutValidation

changes to address reviews

2022-10-07 22:31:00 +02:00

CWE-312-CleartextLogging

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-312-CleartextStorage

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-312-CleartextStorage-py3

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-326-WeakCryptoKey

update python test cases

2022-12-01 11:56:44 -05:00

CWE-327-BrokenCryptoAlgorithm

python: update py/weak-cryptographic-algorithm to flag use of ECB block mode

2022-05-13 16:32:36 +01:00

CWE-327-InsecureDefaultProtocol

Python: Fix test folder for InsecureDefaultProtocol

2021-07-19 16:56:07 +02:00

CWE-327-InsecureProtocol

Merge branch 'main' into python/rewrite-InsecureContextConfiguration

2023-03-27 10:20:53 +02:00

CWE-327-WeakSensitiveDataHashing

Python: Move WeakSensitiveDataHashing to new dataflow API

2023-08-28 15:27:50 +02:00

CWE-377-InsecureTemporaryFile

Python: Restructure security tests to contain query name

2021-07-19 16:54:34 +02:00

CWE-502-UnsafeDeserialization

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-601-UrlRedirect

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-611-Xxe

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-643-XPathInjection

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-730-PolynomialReDoS

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-730-ReDoS

PythonÆ fix test expectations

2023-08-24 21:21:49 +02:00

CWE-730-RegexInjection

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-732-WeakFilePermissions

Python: Accept change to WeakFilePermissions.expected

2023-02-16 13:27:16 +01:00

CWE-776-XmlBomb

Python: Accept .expected changes

2023-08-11 10:36:05 +02:00

CWE-798-HardcodedCredentials

do a quick-and-dirty conversion of py/hardcoded-credentials to the new dataflow library

2023-06-14 08:31:56 +02:00

CWE-918-ServerSideRequestForgery

Python: Move FullServerSideRequestForgery and PartialServerSideRequestForgery to new dataflow API

2023-08-28 15:27:50 +02:00

CWE-943-NoSqlInjection

Python: Enrich the NoSql concept

2023-09-07 10:22:37 +02:00

lib

Python : Add query to detect Server Side Template Injection

2020-07-21 18:01:27 +05:30