Skip to content

Python: Add Server-side Request Forgery sinks #8275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
Mar 8, 2022
Merged

Python: Add Server-side Request Forgery sinks #8275

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
b23e28a
add Server-side Request Forgery sinks
haby0 Feb 28, 2022
be40b54
add test
haby0 Feb 28, 2022
40feb1f
Python: SPURIOUS results for httpx
RasmusWL Mar 4, 2022
56901ea
Python: Make new SSRF sink modules private
RasmusWL Mar 4, 2022
7d6d8be
Python: Fix httpx modeling
RasmusWL Mar 4, 2022
c65839b
Python: improve urllib3 modeling
RasmusWL Mar 4, 2022
02a97b0
Python: Move `urllib` and `urllib2` to be part of stdlib modeling
RasmusWL Mar 4, 2022
866e615
Python: Add PyPI links in qldocs
RasmusWL Mar 4, 2022
75bc532
Python: Avoid `toString` usage :O
RasmusWL Mar 4, 2022
d86284b
Python: Update frameworks.rst
RasmusWL Mar 4, 2022
e47f726
Python: Add change-note
RasmusWL Mar 4, 2022
f620e25
Merge branch 'main' into py/add-ssrf-sinks
RasmusWL Mar 4, 2022
7e6666b
Merge branch 'main' into py/add-ssrf-sinks
haby0 Mar 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Python: Make new SSRF sink modules private
  • Loading branch information
@RasmusWL
RasmusWL committed Mar 4, 2022
commit 56901ea84113353c84ba89bda34014cddc46e67c
2 changes: 1 addition & 1 deletion python/ql/lib/semmle/python/frameworks/Httpx.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ private import semmle.python.ApiGraphs
* Provides models for the `httpx` PyPI package.
* see https://www.python-httpx.org/
*/
module HttpxModel {
private module HttpxModel {
private class RequestCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
string methodName;

Expand Down
2 changes: 1 addition & 1 deletion python/ql/lib/semmle/python/frameworks/Libtaxii.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ private import semmle.python.ApiGraphs
* Provides models for the `libtaxii` PyPI package.
* see https://github.com/TAXIIProject/libtaxii
*/
module Libtaxii {
private module Libtaxii {
/**
* A call to `libtaxii.common.parse`.
* When the `allow_url` parameter value is set to `True`, there is an SSRF vulnerability..
Expand Down
2 changes: 1 addition & 1 deletion python/ql/lib/semmle/python/frameworks/Pycurl.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ private import semmle.python.ApiGraphs
* Provides models for the `pycurl` PyPI package.
* see https://pycurl.io/docs/latest/
*/
module Pycurl {
private module Pycurl {
/**
* Provides models for the `pycurl.Curl` class
*
Expand Down
2 changes: 1 addition & 1 deletion python/ql/lib/semmle/python/frameworks/Urllib.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ private import semmle.python.ApiGraphs
* Provides models for the `Urllib` PyPI package.
* see https://docs.python.org/3.9/library/urllib.html
*/
module Urllib {
private module Urllib {
/**
* Provides models for the `urllib.request` extension library
*
Expand Down
2 changes: 1 addition & 1 deletion python/ql/lib/semmle/python/frameworks/Urllib2.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ private import semmle.python.ApiGraphs
* Provides models for the `urllib2` PyPI package.
* see https://docs.python.org/2/library/urllib2.html
*/
module Urllib2 {
private module Urllib2 {
/**
* See
* - https://docs.python.org/2/library/urllib2.html#urllib2.Request
Expand Down
2 changes: 1 addition & 1 deletion python/ql/lib/semmle/python/frameworks/Urllib3.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ private import semmle.python.ApiGraphs
* Provides models for the `Urllib3` PyPI package.
* see https://urllib3.readthedocs.io/en/stable/reference/
*/
module Urllib3 {
private module Urllib3 {
/**
* Provides models for the `urllib3.PoolManager` class
*
Expand Down