René's URL Explorer Experiment


Title: Python: Port and extend XXE modeling by jorgectf · Pull Request #6112 · github/codeql · GitHub

Open Graph Title: Python: Port and extend XXE modeling by jorgectf · Pull Request #6112 · github/codeql

X Title: Python: Port and extend XXE modeling by jorgectf · Pull Request #6112 · github/codeql

Description: This PR introduces the modeling of the following XML parsing-related libraries and specific methods: XML Parsers: xml.etree.ElementTree.XMLParser() - not extends entities anymore lxml.etree.XMLParser() - no_network=True huge_tree=False resolve_entities=True lxml.etree.get_default_parser() - no options, default above options xml.sax.make_parser() - parser.setFeature(xml.sax.handler.feature_external_ges, True) XML Parsing: string: xml.etree.ElementTree.fromstring(list) xml.etree.ElementTree.XML lxml.etree.fromstring(list) lxml.etree.XML xmltodict.parse - disable_entities=True file StringIO(), BytesIO(b): xml.etree.ElementTree.parse lxml.etree.parse xml.dom.(mini|pull)dom.parse(String)

Open Graph Description: This PR introduces the modeling of the following XML parsing-related libraries and specific methods: XML Parsers: xml.etree.ElementTree.XMLParser() - not extends entities anymore lxml.etree.XML...

X Description: This PR introduces the modeling of the following XML parsing-related libraries and specific methods: XML Parsers: xml.etree.ElementTree.XMLParser() - not extends entities anymore lxml.etree.XML...

Opengraph URL: https://github.com/github/codeql/pull/6112

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:6648e42e-c721-2e31-0bf2-df418c3c9438
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idC438:1F8274:9D5865:A0E0D1:6A4DB259
html-safe-nonce7cdba5b0826348de7cfdab15271262af23ac96d4001e8b50b8d225df29ac216d
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDNDM4OjFGODI3NDo5RDU4NjU6QTBFMEQxOjZBNERCMjU5IiwidmlzaXRvcl9pZCI6IjExNTAxOTM0OTM0ODc3NTk5NjEiLCJyZWdpb25fZWRnZSI6InNlYSIsInJlZ2lvbl9yZW5kZXIiOiJzZWEifQ==
visitor-hmacaa1b101184bfa0701414cf54d6929d3fde192c58d9a5e7b95343d56355f242bd
hovercard-subject-tagpull_request:673908408
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql/pull/6112/files
twitter:imagehttps://avatars.githubusercontent.com/u/46056498?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/46056498?s=400&v=4
og:image:altThis PR introduces the modeling of the following XML parsing-related libraries and specific methods: XML Parsers: xml.etree.ElementTree.XMLParser() - not extends entities anymore lxml.etree.XML...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None06b8a6144231bf3a234f1c2e9993861e07ce98a905912b114aa386c2d7e84b33
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release32f7b614aca06e6bbd89842b1370df1328264f68
ui-targetcanary-1
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/6112/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6112%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F6112%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/6112/files
Reloadhttps://github.com/github/codeql/pull/6112/files
Reloadhttps://github.com/github/codeql/pull/6112/files
Please reload this pagehttps://github.com/github/codeql/pull/6112/files
github https://github.com/github
codeqlhttps://github.com/github/codeql
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql
Fork 2k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Star 9.8k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Code https://github.com/github/codeql
Issues 987 https://github.com/github/codeql/issues
Pull requests 426 https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality 0 https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Code https://github.com/github/codeql
Issues https://github.com/github/codeql/issues
Pull requests https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
RasmusWLhttps://github.com/RasmusWL
github:mainhttps://github.com/github/codeql/tree/main
jorgectf:jorgectf/python/deserializationhttps://github.com/jorgectf/codeql/tree/jorgectf/python/deserialization
Conversation 46 https://github.com/github/codeql/pull/6112
Findings https://github.com/github/codeql/pull/6112/findings
Commits 91 https://github.com/github/codeql/pull/6112/commits
Checks 0 https://github.com/github/codeql/pull/6112/checks
Files changed https://github.com/github/codeql/pull/6112/files
Please reload this pagehttps://github.com/github/codeql/pull/6112/files
Python: Port and extend XXE modeling https://github.com/github/codeql/pull/6112/files#top
Show all changes 91 commits https://github.com/github/codeql/pull/6112/files
0e61558 Empty commit jorgectf Jun 19, 2021 https://github.com/github/codeql/pull/6112/commits/0e615586440ca11393a9f81ae9c5c5e7dbbf6372
78deec8 Upload main structure and initial tests jorgectf Jun 22, 2021 https://github.com/github/codeql/pull/6112/commits/78deec84fc8ebd17e4aed6d108455e9aa3c58fce
b9fa57f Move tests to `test/` jorgectf Jun 29, 2021 https://github.com/github/codeql/pull/6112/commits/b9fa57f518a0eb81ec4be5a4fdb2b56d5c4017be
c3b3bde Add `XMLParser` concept jorgectf Jun 29, 2021 https://github.com/github/codeql/pull/6112/commits/c3b3bde35ded8d80caf0df5ce7c200374e4b7a13
d475d52 Add partial modeling jorgectf Jun 29, 2021 https://github.com/github/codeql/pull/6112/commits/d475d52c76aee9eaa82e0f34b470eed8e5212d76
11f4c1c Format tests jorgectf Jul 22, 2021 https://github.com/github/codeql/pull/6112/commits/11f4c1cc8e74ff9403b75a732b7153fe8d8b6457
b5e10b6 Write `(String|Bytes)IO` additional taint step jorgectf Jul 22, 2021 https://github.com/github/codeql/pull/6112/commits/b5e10b6c426e5516a304d23e7dc8fe48754080a7
068150b Finish modeling jorgectf Jul 22, 2021 https://github.com/github/codeql/pull/6112/commits/068150b1ab28d3b9dd393f2a85a2cc4985e068a0
0d2646f Polish documentation jorgectf Jul 23, 2021 https://github.com/github/codeql/pull/6112/commits/0d2646fd3dade349586b362fb610830867249322
61e873d Polish tests jorgectf Jul 24, 2021 https://github.com/github/codeql/pull/6112/commits/61e873d725e41b942d1121a64786d30d5f228ca0
b83b31c Write qldocs jorgectf Jul 24, 2021 https://github.com/github/codeql/pull/6112/commits/b83b31cc7a9aa8e299f02381437a7ab17cc9d4cf
1dd77f1 Fix undetected tests jorgectf Jul 24, 2021 https://github.com/github/codeql/pull/6112/commits/1dd77f167a9554663b16fac66b4d3c1a3bbcf2fd
93c8529 Add `.expected` jorgectf Jul 24, 2021 https://github.com/github/codeql/pull/6112/commits/93c8529fc9214125547529ca4a6fbe7dd27f7340
48bca5b Fix references' link anchor jorgectf Aug 25, 2021 https://github.com/github/codeql/pull/6112/commits/48bca5beb8a63b24e824c19fccaf5c9ddbc4d977
21da603 Update `.qlref` jorgectf Sep 7, 2021 https://github.com/github/codeql/pull/6112/commits/21da603d8188a6cd751e4a17357d572520db4c05
61a81b6 Extend `.qlref` jorgectf Sep 9, 2021 https://github.com/github/codeql/pull/6112/commits/61a81b60e8ff56e2af69271edf0bb662322627bb
67fddda Merge branch 'main' into jorgectf/python/deserialization RasmusWL Sep 28, 2021 https://github.com/github/codeql/pull/6112/commits/67fddda6d206fc214c1a4f1d9c922991e8133ff1
9c286a1 Python: fix name of `.qhelp` file RasmusWL Sep 28, 2021 https://github.com/github/codeql/pull/6112/commits/9c286a1b5024bd75304f60448416c04c2ebac720
e472814 Python: Fix XXE qhelp RasmusWL Sep 28, 2021 https://github.com/github/codeql/pull/6112/commits/e472814ddd53b2f636ab06366352b54e76237bbc
8df3dab Python: Adjust `.expected` with subpaths RasmusWL Sep 28, 2021 https://github.com/github/codeql/pull/6112/commits/8df3dab1210e11c587b7f7e28eb20f5b68c16973
15dfc6d Fix `xml_sax_parser.py` good/bad naming jorgectf Oct 16, 2021 https://github.com/github/codeql/pull/6112/commits/15dfc6d1da9d8af2ed9a6f519744fab11a68367e
5b66a15 Extend `mayBeDangerous()` QLDoc jorgectf Oct 16, 2021 https://github.com/github/codeql/pull/6112/commits/5b66a15de35fbaf17b757f20b86ad4f6acbb9cb9
320a00b Delete simple `API::Node`s jorgectf Oct 16, 2021 https://github.com/github/codeql/pull/6112/commits/320a00be31999c40203698779f46c052cb80f653
be42470 Apply suggestions from code review jorgectf Oct 16, 2021 https://github.com/github/codeql/pull/6112/commits/be424704a64f2a186b049e3b6856d9108f39b4bf
c2046f1 Improve readability for `xmlDom()` jorgectf Oct 16, 2021 https://github.com/github/codeql/pull/6112/commits/c2046f177782b7403031dbf8238617077500f93a
f1a73e3 Merge branch 'jorgectf/python/deserialization' of https://github.com/… jorgectf Oct 16, 2021 https://github.com/github/codeql/pull/6112/commits/f1a73e300929dcad526ebb72cd03c0756cc498bf
58bc110 Merge branch 'main' into jorgectf/python/deserialization RasmusWL Oct 28, 2021 https://github.com/github/codeql/pull/6112/commits/58bc1102e576a445225246bb847fc40c8ebb09b5
066b400 Add `lxml.etree.XMLParser` missing `resolve_entities` dangerous case jorgectf Oct 28, 2021 https://github.com/github/codeql/pull/6112/commits/066b40098c899b41565b4d2bec7159036c47720d
637901d Make concepts instances of their ranges jorgectf Nov 16, 2021 https://github.com/github/codeql/pull/6112/commits/637901d980968c3e244587a954e981248cd7643f
cb8e54e Delete redundant `LXMLParser` dangerous check jorgectf Nov 16, 2021 https://github.com/github/codeql/pull/6112/commits/cb8e54e38ef2cebcd0104c144c942930f0d780ac
9ab6d21 Add forward type tracking test jorgectf Jan 14, 2022 https://github.com/github/codeql/pull/6112/commits/9ab6d217578877344a2c2d516bae174318231772
a1f8acc Merge branch 'github:main' into jorgectf/python/deserialization jorgectf Jan 31, 2022 https://github.com/github/codeql/pull/6112/commits/a1f8acc9bb1657b80b5e34555bd7ca1ba59d71f8
080775c Merge branch 'jorgectf/python/deserialization' of https://github.com/… jorgectf Jan 31, 2022 https://github.com/github/codeql/pull/6112/commits/080775c873d6178db4ad901be524043df4a2bb37
d96eb01 Merge branch 'github:main' into jorgectf/python/deserialization jorgectf Feb 4, 2022 https://github.com/github/codeql/pull/6112/commits/d96eb01b9c9671ea0e6d3ac7de528d431c005b07
43fde35 Merge branch 'jorgectf/python/deserialization' of https://github.com/… jorgectf Feb 4, 2022 https://github.com/github/codeql/pull/6112/commits/43fde3561f06ba2db2c73404d3c9366553a6c771
99e14d1 Merge branch 'github:main' into jorgectf/python/deserialization jorgectf Feb 5, 2022 https://github.com/github/codeql/pull/6112/commits/99e14d16bc3550f088250dc721db7bb6dd919669
d2f07e4 Merge branch 'jorgectf/python/deserialization' of https://github.com/… jorgectf Feb 5, 2022 https://github.com/github/codeql/pull/6112/commits/d2f07e4df2e0e2d6d74b169e6a34ea5f66a48e84
8f9cd16 Update jorgectf Feb 8, 2022 https://github.com/github/codeql/pull/6112/commits/8f9cd168067a4c4d56d12d20a9e926bb05142f19
7c4a6a1 Test polish jorgectf Feb 8, 2022 https://github.com/github/codeql/pull/6112/commits/7c4a6a12b0292b16376b4d2f50c03fc9b9450f2a
01ad25f Apply `.getALocalSource()` and fix `xmltodict`'s `vulnerable` predicate jorgectf Feb 8, 2022 https://github.com/github/codeql/pull/6112/commits/01ad25f3f06776bc967bfbf0f5c9a67e19e5cc48
b00051e Update `.expected` jorgectf Feb 8, 2022 https://github.com/github/codeql/pull/6112/commits/b00051e4abfb2fd11a743e360dac4982656dd849
85b5ef3 `XmlInjection` -> `XmlEntityInjection` jorgectf Feb 9, 2022 https://github.com/github/codeql/pull/6112/commits/85b5ef36ae8dcd53868e10204151d56265622610
c5f30d9 Create an extendable `AdditionalTaintStep` class in customizations jorgectf Feb 20, 2022 https://github.com/github/codeql/pull/6112/commits/c5f30d99d5f01f5819e9653d1115a65d82d9b6f0
518e2ae Merge branch 'main' into jorgectf/python/deserialization RasmusWL Mar 1, 2022 https://github.com/github/codeql/pull/6112/commits/518e2aeebf5bfc2124208255a6d341f057dc553a
500e0ac Python: Rewrite sax XML tests RasmusWL Mar 1, 2022 https://github.com/github/codeql/pull/6112/commits/500e0aced6e9a9e2fd426966e85109ce26ab5f1d
ee23c05 Python: XML: Expose vuln kind on sink RasmusWL Mar 1, 2022 https://github.com/github/codeql/pull/6112/commits/ee23c05489deb55626fe0402760ff89535856c84
aaf55b2 Python: Add XMLVulnerabilityKind RasmusWL Mar 2, 2022 https://github.com/github/codeql/pull/6112/commits/aaf55b21c46dbd3e6a84204d0a43f39ec32d85fe
16e482b Python: Improve QLDoc for XML parsing/parsers RasmusWL Mar 2, 2022 https://github.com/github/codeql/pull/6112/commits/16e482bf6fcb07bc11a77ca1e82c65baf41c1ac8
6dd776b Python: Only produce one alert per vulnerable XML sink RasmusWL Mar 2, 2022 https://github.com/github/codeql/pull/6112/commits/6dd776b2de9e6eede27d2cc22d9781db4fe8a83d
7f7758b Python: rewrite xml sax modeling RasmusWL Mar 2, 2022 https://github.com/github/codeql/pull/6112/commits/7f7758b83dc1ae6a3e528cf6b3b7349e60fd3e56
515b824 Python: Add lxml positive test RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/515b824b3cd857dc29a3484817a1a0d170bae2f6
661d8bf Python: Better handling of `resolve_entities` arg in lxml RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/661d8bf553778aa49054347e215015877c3876a5
52891cb Python: Add PoC for XML vulns RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/52891cb4763bc3714a2e3cc95ea240145d55d910
3c321dd Python: Model `lxml.etree.get_default_parser` in own class RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/3c321dd98dcd62193844f61c03eaa81ca5d4ee43
124c03c Python: Expand lxml tests RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/124c03c15c9df8b14d143d3e38a410d3f60cb8e3
e295399 Python: Properly handle `huge_tree` in lxml RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/e295399f7096f92592ea7aa4d1286619bf39f8d0
703e3e8 Python: Handle DTD retrieval vuln in lxml RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/703e3e8a0f9f81df20a924b25412baf4b9189086
6129193 Python: Properly model `xml.etree` RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/61291936bfcb2667647f330ca0a512b33c80e82c
3affa6c Python: Annotate xmltodict tests RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/3affa6cf3abd3e88fed8722f959b0b5851936809
c4d08db Python: Expand XML PoC with minidom/pulldom/expat RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/c4d08db62aafec4a020f4836a4bcb86329cc517b
5a65248 Python: Annotate xml.dom tests RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/5a652480b1f26eba9ed9c82e338c5058330bf51a
9406a97 Python: Fix vuln detection for xml.minidom with parser arg RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/9406a972cdbf24ab8c0e5608490042ffc12b297f
7cda901 Python: Add separate query for SimpleXMLRPCServer RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/7cda901da21b814d96c326d8499d6d9b2ca3de9f
4b03f5c Python: Rename xml.sax test for consistency RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/4b03f5c72400106027dd034a95079573904c1a12
faebaee Python: Use concept tests for XML Parsing RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/faebaee141c10ace600153d84a2d8d1952beb73a
a7134ca Python: Port xml.dom tests RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/a7134cac2eb339c76f3f299c77b927742e5e0320
5fb4c4d Python: Port xml.etree tests RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/5fb4c4d1524f8a6bae5a8a3ff1c40b35b66f0998
0b12d91 Python: Port xml.sax tests RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/0b12d918171ee00b8a40f576d75c65b38193ebf0
c739ae4 Python: Port `xmltodict` tests RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/c739ae40b60ef5644d0c0e9c1a8238742f2207e2
2451123 Python: Move XML PoC to new test dir RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/2451123c6712e566fe0256f9349952e8ef738cd2
3278793 Python: Handle more functions and kw-args RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/32787939721e9478e4075b6c7d2f10a96b2a2cb1
f72f673 Python: Update `XmlEntityInjection.expected` RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/f72f673e7ee82e5fd4156d2d6a5a4e8144d371d7
33ebcdf Python: Support feed method of lxml/xml.etree Parsers RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/33ebcdf43715f10d1deafc493e9fd568f7b78bea
46238d5 Python: Add test for XMLPullParser RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/46238d5ea049e5b51f99f4b66366957852a649c8
de0e67f Python: Restructure overall XML modeling RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/de0e67f327de078af5c6574445e82f7574f52984
a033b71 Python: Align QLdocs of XML modeling RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/a033b71eaf16dce055696ca7f1485c7f079ad2ed
c0a2c25 Python: Restructure modeling of `xml.etree` parsers RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/c0a2c25f5a712967ea5d067907e7c5be7b71a144
c0a6f9f Python: Restructure lxml modeling RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/c0a6f9f3fdcd7d3b52d4da7fb5657ad839686322
df8e0fc Python: Minor fixup of qldoc RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/df8e0fce68c1ea11bacaf789caebfbd7e5391376
837daaa Python: Remove XMLParser concept RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/837daaae3b5f2fba2e405f8cf7900a9c51999769
0d69dc8 Python: Minor qldoc improvement RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/0d69dc854c47df55eddb11d500b8cbe9b04f1d75
3f6c55e Python: Rename `vulnerable` predicate => `vulnerableTo` RasmusWL Mar 3, 2022 https://github.com/github/codeql/pull/6112/commits/3f6c55e8aeb3c930d730bb719b778811ffa6dbf1
683c2fa Apply suggestions from code review jorgectf Mar 4, 2022 https://github.com/github/codeql/pull/6112/commits/683c2fa8254ebd56ec04a8e0fadb7bdb129c29e7
3cd165d Python: Apply suggestions from code review RasmusWL Mar 4, 2022 https://github.com/github/codeql/pull/6112/commits/3cd165d5b757be7651f6f9ade20bca773b27e582
d6cbfec Python: huge_tree tests were wrong RasmusWL Mar 4, 2022 https://github.com/github/codeql/pull/6112/commits/d6cbfec43435204bb5e7350d26d9c636073b6652
f0131af Python: Fix `huge_tree` modeling RasmusWL Mar 4, 2022 https://github.com/github/codeql/pull/6112/commits/f0131afc5449459f1562862c557ed537b0ab3a4c
1a9620a Python: Add conditional assignment check for sax parser RasmusWL Mar 4, 2022 https://github.com/github/codeql/pull/6112/commits/1a9620a87a4aa9ae406774681431bb2e3274cc88
ef045a6 Python: Fix typo in set_default_parser RasmusWL Mar 4, 2022 https://github.com/github/codeql/pull/6112/commits/ef045a6789cd4c7cbe04fba0e15b40461ba9ea75
5552834 Merge pull request #9 from RasmusWL/WIP jorgectf Mar 4, 2022 https://github.com/github/codeql/pull/6112/commits/5552834e0f83d54bcbed595234c30feae5b159ab
6b14c1d Merge branch 'main' into jorgectf/python/deserialization RasmusWL Mar 8, 2022 https://github.com/github/codeql/pull/6112/commits/6b14c1d6b93191063a2b4f97e02da6e62664ef4f
0e9da4a Python: Resolve name conflict over `XML` module RasmusWL Mar 8, 2022 https://github.com/github/codeql/pull/6112/commits/0e9da4aadb420f1b327403f991e7891bb962bfb6
Clear filters https://github.com/github/codeql/pull/6112/files
Please reload this pagehttps://github.com/github/codeql/pull/6112/files
Please reload this pagehttps://github.com/github/codeql/pull/6112/files
SimpleXmlRpcServer.ql https://github.com/github/codeql/pull/6112/files#diff-ff888a26d4738aea7ba5f7dcc6b313a92f293db9543fd2918d7b9d089b4f1c7c
XXE.xml https://github.com/github/codeql/pull/6112/files#diff-9f6fbdafe62529f97461ad3f64ef5c64f4e07aa0e1e77b11484f59c27ee761f8
XmlEntityInjection.py https://github.com/github/codeql/pull/6112/files#diff-9093efda0233b0d4dc42964826a1acef460fa91dbff4bdf2dfce393c445931ef
XmlEntityInjection.qhelp https://github.com/github/codeql/pull/6112/files#diff-203f9a80634c9661081844d3f1d3b9390fa0ddc3a48bd19633cc63c791730d41
XmlEntityInjection.ql https://github.com/github/codeql/pull/6112/files#diff-a4a00fae0d816af9716420c256270f32fc70788ac6936b7dc5a26e4a197a18ee
Concepts.qll https://github.com/github/codeql/pull/6112/files#diff-07631b7f3489bbd6603ecbc9149f5919406181361b1bd04a53e048f531a4986a
Frameworks.qll https://github.com/github/codeql/pull/6112/files#diff-912ff00fff24c4b7e46c7e8d7e6179e1e4df2aa3d0f5e937a13bab60568e9ec8
Xml.qll https://github.com/github/codeql/pull/6112/files#diff-9627c1fb9a1cc77fb93e6b7e31af1a4fa908f2a60362cfb34377d24debb97398
XmlEntityInjection.qll https://github.com/github/codeql/pull/6112/files#diff-9d06d6847343c89e85bcf0deaf97def534f69b1a3304f45c7101d0f4102f4744
XmlEntityInjectionCustomizations.qll https://github.com/github/codeql/pull/6112/files#diff-6415b295e6a585fecdcda66a0cc924321113ce5ca7b7df2766ac4a9b47df0015
ExperimentalXmlConceptsTests.expected https://github.com/github/codeql/pull/6112/files#diff-12a48806fa03ad55b5fe8adb85774b8a3aefe77a609d6419b2c1ecf0ff742822
ExperimentalXmlConceptsTests.ql https://github.com/github/codeql/pull/6112/files#diff-04f29e3d4e526128a9d05e04906fa357f0264484bcff1c0e86d10a64be214858
lxml_etree.py https://github.com/github/codeql/pull/6112/files#diff-deb70bfb7abaf542c5c5257bd42592fc84ebbdb5c448a4367f712f9a56c3f7d3
PoC.py https://github.com/github/codeql/pull/6112/files#diff-383bd6b7598bac7a36981da4aed3a65e2840a922f04d4592460e1d5a3a9f460d
flag https://github.com/github/codeql/pull/6112/files#diff-9167e7b0a7ab98e9cb9fffb34d6e5598f4ac43b9574677eee3fdf787c036df8e
this-dir-is-not-extracted https://github.com/github/codeql/pull/6112/files#diff-9ce4b63976addfd237a275a3d744db3b7c94a657582c9ea755c0e2d38e36dd0a
xml_dom.py https://github.com/github/codeql/pull/6112/files#diff-1789a4270656a553d783fb05d1de06b170a1a1c44d3bceb0ebc1bb05a9eed41b
xml_etree.py https://github.com/github/codeql/pull/6112/files#diff-dcf3c9022c202e061023ed630dcd71f7b90b255888f605ff112a44065c19116f
xml_sax.py https://github.com/github/codeql/pull/6112/files#diff-e5ae46d53d0315f79aa9d47fe25f76113db16c905f06865173ade31c9d4c0906
xmltodict.py https://github.com/github/codeql/pull/6112/files#diff-a20c09976439201ae524182603158ae4303303cd1b4625cf33eddabca7e7cc32
SimpleXmlRpcServer.expected https://github.com/github/codeql/pull/6112/files#diff-ba281e5c422ff3685e08095b65ae35661f7d5c156dc2c0b8025abbc4ca06ad16
SimpleXmlRpcServer.qlref https://github.com/github/codeql/pull/6112/files#diff-24db812727b2d4a148147fe9ac93abf028d7aae1a68b266407354068bed55bb4
XmlEntityInjection.expected https://github.com/github/codeql/pull/6112/files#diff-538f7d4c56bfa4b78b585825ce9d0064808d5af5b8a725240a98e57b6ebda40b
XmlEntityInjection.qlref https://github.com/github/codeql/pull/6112/files#diff-1f49269bea28bbfa553645f17aed0e1825ed6d4b8fefd959b1432df72a2acead
test.py https://github.com/github/codeql/pull/6112/files#diff-8276e671b4e75967dec089a87edf6f7e88dd85c9831f8824433745cfb040966e
xmlrpc_server.py https://github.com/github/codeql/pull/6112/files#diff-6dd0ead388571381183f4350adec8610731caf794935e46d97df1a38173fc837
https://github.com/github/codeql/blob/main/CODEOWNERS#L19
python/ql/src/experimental/Security/CWE-611/SimpleXmlRpcServer.qlhttps://github.com/github/codeql/pull/6112/files#diff-ff888a26d4738aea7ba5f7dcc6b313a92f293db9543fd2918d7b9d089b4f1c7c
View file https://github.com/jorgectf/codeql/blob/0e9da4aadb420f1b327403f991e7891bb962bfb6/python/ql/src/experimental/Security/CWE-611/SimpleXmlRpcServer.ql
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6112/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L19
python/ql/src/experimental/Security/CWE-611/XXE.xmlhttps://github.com/github/codeql/pull/6112/files#diff-9f6fbdafe62529f97461ad3f64ef5c64f4e07aa0e1e77b11484f59c27ee761f8
View file https://github.com/jorgectf/codeql/blob/0e9da4aadb420f1b327403f991e7891bb962bfb6/python/ql/src/experimental/Security/CWE-611/XXE.xml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6112/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L19
python/ql/src/experimental/Security/CWE-611/XmlEntityInjection.pyhttps://github.com/github/codeql/pull/6112/files#diff-9093efda0233b0d4dc42964826a1acef460fa91dbff4bdf2dfce393c445931ef
View file https://github.com/jorgectf/codeql/blob/0e9da4aadb420f1b327403f991e7891bb962bfb6/python/ql/src/experimental/Security/CWE-611/XmlEntityInjection.py
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6112/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L19
python/ql/src/experimental/Security/CWE-611/XmlEntityInjection.qhelphttps://github.com/github/codeql/pull/6112/files#diff-203f9a80634c9661081844d3f1d3b9390fa0ddc3a48bd19633cc63c791730d41
View file https://github.com/jorgectf/codeql/blob/0e9da4aadb420f1b327403f991e7891bb962bfb6/python/ql/src/experimental/Security/CWE-611/XmlEntityInjection.qhelp
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6112/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L19
python/ql/src/experimental/Security/CWE-611/XmlEntityInjection.qlhttps://github.com/github/codeql/pull/6112/files#diff-a4a00fae0d816af9716420c256270f32fc70788ac6936b7dc5a26e4a197a18ee
View file https://github.com/jorgectf/codeql/blob/0e9da4aadb420f1b327403f991e7891bb962bfb6/python/ql/src/experimental/Security/CWE-611/XmlEntityInjection.ql
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6112/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L19
python/ql/src/experimental/semmle/python/Concepts.qllhttps://github.com/github/codeql/pull/6112/files#diff-07631b7f3489bbd6603ecbc9149f5919406181361b1bd04a53e048f531a4986a
View file https://github.com/jorgectf/codeql/blob/0e9da4aadb420f1b327403f991e7891bb962bfb6/python/ql/src/experimental/semmle/python/Concepts.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6112/{{ revealButtonHref }}
https://github.com/github/codeql/pull/6112/files#diff-07631b7f3489bbd6603ecbc9149f5919406181361b1bd04a53e048f531a4986a
https://github.com/github/codeql/pull/6112/files#diff-07631b7f3489bbd6603ecbc9149f5919406181361b1bd04a53e048f531a4986a
https://github.com/github/codeql/blob/main/CODEOWNERS#L19
python/ql/src/experimental/semmle/python/Frameworks.qllhttps://github.com/github/codeql/pull/6112/files#diff-912ff00fff24c4b7e46c7e8d7e6179e1e4df2aa3d0f5e937a13bab60568e9ec8
View file https://github.com/jorgectf/codeql/blob/0e9da4aadb420f1b327403f991e7891bb962bfb6/python/ql/src/experimental/semmle/python/Frameworks.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/6112/{{ revealButtonHref }}
https://github.com/github/codeql/pull/6112/files#diff-912ff00fff24c4b7e46c7e8d7e6179e1e4df2aa3d0f5e937a13bab60568e9ec8
https://github.com/github/codeql/pull/6112/files#diff-912ff00fff24c4b7e46c7e8d7e6179e1e4df2aa3d0f5e937a13bab60568e9ec8
Please reload this pagehttps://github.com/github/codeql/pull/6112/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.