Repository navigation

Python: Unsafe unpacking using `shutil.unpack_archive()` query and tests - #11570

Merged

yoff merged 54 commits into

github:mainfrom

Sim4n6:UnsafeUnpack

Feb 17, 2023

Merged

Python: Unsafe unpacking using `shutil.unpack_archive()` query and tests#11570
yoff merged 54 commits into
github:mainfrom
Sim4n6:UnsafeUnpack

Commits on Dec 5, 2022
- UnpackUnsafe query and tests
  Sim4n6
  committed
  68fd75c
Commits on Dec 6, 2022
- Update UnsafeUnpack.ql
  Sim4n6
  committed
  054c06b
- Improved the additional taint step using InstanceSource
  Sim4n6
  committed
  a5849eb
- Update python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.qhelp
  
  Sim4n6
  and
  intrigus-lgtm
  authored
  c22c0b5
- Update python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.qhelp
  
  Sim4n6
  and
  intrigus-lgtm
  authored
  9a60202
- Update python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.ql
  
  Sim4n6
  and
  intrigus-lgtm
  authored
  58570b4
- Use of more generic terms
  Sim4n6
  committed
  4896e62
- A fix of the tag name
  Sim4n6
  committed
  2801b84
Commits on Dec 8, 2022
- Considering the use of contextlib.closing() method
  Sim4n6
  committed
  9336f4f
Commits on Dec 9, 2022
- tarball path provided using CLI argument (source)
  Sim4n6
  committed
  545aab0
Commits on Dec 10, 2022
- Copying the response data to the archive
  Sim4n6
  committed
  eff1325
- read by chunks as additional step
  Sim4n6
  committed
  b194524
Commits on Dec 12, 2022
- A simple download_file() call from maybe boto3
  Sim4n6
  committed
  2f68b54
Commits on Dec 13, 2022
- Add source wget.download
  Sim4n6
  committed
  54109b8
Commits on Dec 15, 2022
- An uploded file is considered a source
  Sim4n6
  committed
  4376870
Commits on Jan 25, 2023
- Merge pull request #1 from github/main
  Sim4n6
  authored
  b5a6f6e
- Use of inline tests for dataflow queries
  Sim4n6
  committed
  10d6ebf
- Update python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.ql
  
  Sim4n6
  and
  yoff
  authored
  0ed4808
- Add a missing "and"
  Sim4n6
  committed
  2d38993
- Restrict download_file() to boto3 lib
  Sim4n6
  committed
  22af6f5
- Handle the download of a tarball using wget pkg.
  Sim4n6
  committed
  9b5b0c6
- Commit the expected results
  Sim4n6
  committed
  f867c90
Commits on Jan 26, 2023
- Optimize the Argparse filename as a source.
  Sim4n6
  committed
  2e4cb63
- Add expected results for argparse source
  Sim4n6
  committed
  9464940
- Seperate the dataflow config from the query
  Sim4n6
  committed
  aaa0040
- Opt for any source from RemoteFlowSource.
  Sim4n6
  committed
  54cc4d6
- Add a Django Upload examples
  Sim4n6
  committed
  51b11de
- Restrain the source and add two steps.
  Sim4n6
  committed
  1a21148
- Some reformatting
  Sim4n6
  committed
  998f1bf
Commits on Jan 27, 2023
- Move the config query to the parent directory
  Sim4n6
  committed
  bca053f
- Update the dataflow test query and the expected results
  Sim4n6
  committed
  5f0bf10
- Update the import relative to the dataflow config
  Sim4n6
  committed
  e410424
- Updated the expected results accordingly
  Sim4n6
  committed
  18d8bbc
- Constrain the object & the call
  Sim4n6
  committed
  207ed3d
- Update python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
  
  Sim4n6
  and
  yoff
  authored
  8ef2aa0
- Merge branch 'github:main' into UnsafeUnpack
  Sim4n6
  authored
  7a126a2
- Update python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
  
  Sim4n6
  and
  yoff
  authored
  0b27b13
- Add builtin open as an additional step
  Sim4n6
  committed
  ee21312
- Organize steps to correspond to the sample code
  Sim4n6
  committed
  0e2f378
Commits on Jan 28, 2023
- Remove a write step & update the builtin open step
  Sim4n6
  committed
  a4aaf0e
- Constrain the save/path step
  Sim4n6
  committed
  0707064
Commits on Jan 29, 2023
- Add an S3 source with Session or download_fileobj
  Sim4n6
  committed
  7079def
Commits on Feb 2, 2023
- Incorporate Sink & Source as steps from TarSlipQry
  Sim4n6
  committed
  1a8c9ab
- Updated the expected test file
  Sim4n6
  committed
  a015084
Commits on Feb 5, 2023
- Add another frequently used step
  Sim4n6
  committed
  ec82d61
Commits on Feb 8, 2023
- Comment modif + remove redundant cast
  Sim4n6
  committed
  9e28502
- use if-then-else rather than nested exists
  Sim4n6
  committed
  4196230
Commits on Feb 9, 2023
- Update python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
  
  Sim4n6
  and
  yoff
  authored
  16ef504
- add a blank line at the end of the file
  Sim4n6
  committed
  b04d568
- Fix the exists cast warning
  Sim4n6
  committed
  09df055
Commits on Feb 10, 2023
- Fix autoformatting issues
  Sim4n6
  committed
  eed19a3
Commits on Feb 12, 2023
- Organisation TarSlip/UnsafeUnpack into two folders
  Sim4n6
  committed
  80d4fb5
- Put back the annotation result=BAD
  Sim4n6
  committed
  518684b
- Fail tests when missing annotation on sink orfail
  Sim4n6
  committed
  d7af801

Commits

Commits on Dec 5, 2022

Commits on Dec 6, 2022

Commits on Dec 8, 2022

Commits on Dec 9, 2022

Commits on Dec 10, 2022

Commits on Dec 12, 2022

Commits on Dec 13, 2022

Commits on Dec 15, 2022

Commits on Jan 25, 2023

Commits on Jan 26, 2023

Commits on Jan 27, 2023

Commits on Jan 28, 2023

Commits on Jan 29, 2023

Commits on Feb 2, 2023

Commits on Feb 5, 2023

Commits on Feb 8, 2023

Commits on Feb 9, 2023

Commits on Feb 10, 2023

Commits on Feb 12, 2023