Repository navigation

Python: Promote XXE and XML-bomb queries - #8634

Merged

yoff merged 54 commits into

github:mainfrom

RasmusWL:promote-xxe

May 9, 2022

Merged

Python: Promote XXE and XML-bomb queries#8634
yoff merged 54 commits into
github:mainfrom
RasmusWL:promote-xxe

Commits on Mar 31, 2022
- Python: Copy Xxe/XmlBomb queries from JS
  RasmusWL
  committed
  65907c9
- Python: Adjust Xxe/XmlBomb for Python
  RasmusWL
  committed
  e45f9d6
- Python: Add simple test of Xxe/XmlBomb
  RasmusWL
  committed
  91795b8
- Python: Adjust XXE PoC for newer lxml versions
  RasmusWL
  committed
  a1d88e3
- Python: XXE: Add example of exfiltrating data through dtd-retrival
  RasmusWL
  committed
  57b9780
- Python: Add taint for `StringIO` and `BytesIO`
  RasmusWL
  committed
  769f569
- Python: Delete `XmlEntityInjection.ql`
  RasmusWL
  committed
  c365337
- Python: Adjust XXE qhelp
  RasmusWL
  committed
  b00766b
- Python: Adjust `XmlBomb.qhelp` from JS
  RasmusWL
  committed
  56b9c89
- Python: Add PortSwigger link to `Xxe.qhelp`
  RasmusWL
  committed
  9caf4be
- Python: Promote `XMLParsing` concept
  RasmusWL
  committed
  e005a5c
- Python: => `XMLParsingVulnerabilityKind`
  RasmusWL
  committed
  e45288e
- Python: Promote `XMLParsing` concept test
  RasmusWL
  committed
  35ccba2
- Python: Make `XMLParsing` a `Decoding` subclass
  RasmusWL
  committed
  1ea4bcc
- Python: Rename lxml XPath tests
  RasmusWL
  committed
  c4473c5
- Python: Handle `XMLParser().close()` for XPath
  RasmusWL
  committed
  3040adf
- Python: Promote lxml parsing modeling
  RasmusWL
  committed
  80b5cde
- Python: Promote `xmltodict` modeling
  RasmusWL
  committed
  7f5f767
- Python: Promote `xml.etree` modeling
  RasmusWL
  committed
  64aa503
- Python: Add some links in QLDocs
  RasmusWL
  committed
  a315aa8
- Python: Add note about parseid/XMLID
  RasmusWL
  committed
  6774085
- Python: Model `lxml.etree.XMLID`
  RasmusWL
  committed
  12cbdcd
- Python: Model `lxml.iterparse`
  RasmusWL
  committed
  386ff53
- Python: Model file access from XML parsing
  RasmusWL
  committed
  543454e
- Python: Add test showing misalignment of xml.etree modeling
  RasmusWL
  committed
  db43d04
- Python: Merge `xml.etree.ElementTree` models
  RasmusWL
  committed
  70b3eec
- Python: Align `xml.etree.ElementTree` modeling
  RasmusWL
  committed
  05bb0ef
- Python: Promote `xml.sax` and `xml.dom.*` modeling
  RasmusWL
  committed
  e112697
- Python: `xml.sax.parse` is not a method call
  RasmusWL
  committed
  1d7cec6
- Python: Extend FileSystemAccess for `xml.sax` and `xml.dom.*` parsing
  RasmusWL
  committed
  b4c0065
- Python: Minor cleanup of `XmlParsingTest`
  RasmusWL
  committed
  673220b
- Python: Move XML parsing PoC
  RasmusWL
  committed
  5083023
- Python: Remove last bits of experimental XML modeling
  RasmusWL
  committed
  b8d3c5e
- Python: Promote XXE and XML-bomb queries
  RasmusWL
  committed
  4abab22
- Python: Fix `SimpleXmlRpcServer.ql`
  RasmusWL
  committed
  d2b03bb
Commits on Apr 5, 2022
- Python: Rename to `XmlParsing`
  RasmusWL
  committed
  ab59d5c
- Python: Rename to `XmlParsingVulnerabilityKind`
  RasmusWL
  committed
  1f285b8
- Python: Add change-note
  RasmusWL
  committed
  a7dab53
- Python: Rewrite concepts to use `extends ... instanceof ...`
  RasmusWL
  committed
  b7f56dd
Commits on Apr 6, 2022
- Merge branch 'main' into promote-xxe
  RasmusWL
  committed
  23637fd
- Python: Rename more XML classes to follow convention
  RasmusWL
  committed
  c784f15
- Python: Use new `API::CallNode` for XML constant check
  RasmusWL
  committed
  f2f0873
Commits on Apr 7, 2022
- Python: Change XmlBomb vulnerability kind
  RasmusWL
  committed
  7728b6c
- Python: Rename sink definitions for XXE/XML bomb
  RasmusWL
  committed
  405480c
- Python: Move last XXE/XML bomb out of experimental
  RasmusWL
  committed
  8191be9
- Python: Fix `SimpleXmlRpcServer.expected`
  RasmusWL
  committed
  517444b
Commits on Apr 20, 2022
- Merge branch 'main' into promote-xxe
  RasmusWL
  committed
  bb6969a
Commits on May 2, 2022
- Merge branch 'main' into promote-xxe
  RasmusWL
  committed
  5f01fc2
- Python: Refactor `SaxParserSetFeatureCall`
  RasmusWL
  committed
  714465b
Commits on May 9, 2022
- Python: Apply suggestions from code review
  
  RasmusWL
  and
  yoff
  authored
  f5854f3
- Python: Slight refactor of `LxmlParsing`
  RasmusWL
  committed
  f22bd03
- Python: Fix casing of `XMLDomParsing`
  RasmusWL
  committed
  3634922
- Python: Fix singleton set
  RasmusWL
  committed
  de05b10
- Python: Apply suggestions from code review
  
  RasmusWL
  and
  yoff
  authored
  4a67891

Commits

Commits on Mar 31, 2022

Commits on Apr 5, 2022

Commits on Apr 6, 2022

Commits on Apr 7, 2022

Commits on Apr 20, 2022

Commits on May 2, 2022

Commits on May 9, 2022