From 1cfac5074956b2e05c8d35da942432f50c4d2661 Mon Sep 17 00:00:00 2001 From: Rasmus Wriedt Larsen Date: Mon, 26 Feb 2024 11:23:43 +0100 Subject: [PATCH 1/2] Python: Add precision to NoSQL query Due to this, it was not part of any query suite :O --- python/ql/src/Security/CWE-943/NoSqlInjection.ql | 1 + 1 file changed, 1 insertion(+) diff --git a/python/ql/src/Security/CWE-943/NoSqlInjection.ql b/python/ql/src/Security/CWE-943/NoSqlInjection.ql index b559159055fc..cc5d57effe0e 100644 --- a/python/ql/src/Security/CWE-943/NoSqlInjection.ql +++ b/python/ql/src/Security/CWE-943/NoSqlInjection.ql @@ -3,6 +3,7 @@ * @description Building a NoSQL query from user-controlled sources is vulnerable to insertion of * malicious NoSQL code by the user. * @kind path-problem + * @precision high * @problem.severity error * @security-severity 8.8 * @id py/nosql-injection From fbf67278092d479b95d8360a9418987251cb7212 Mon Sep 17 00:00:00 2001 From: Rasmus Wriedt Larsen Date: Mon, 4 Mar 2024 11:46:38 +0100 Subject: [PATCH 2/2] Python: Add change-note --- python/ql/src/change-notes/2024-03-04-nosql-injection.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 python/ql/src/change-notes/2024-03-04-nosql-injection.md diff --git a/python/ql/src/change-notes/2024-03-04-nosql-injection.md b/python/ql/src/change-notes/2024-03-04-nosql-injection.md new file mode 100644 index 000000000000..6e98540c757c --- /dev/null +++ b/python/ql/src/change-notes/2024-03-04-nosql-injection.md @@ -0,0 +1,4 @@ +--- +category: newQuery +--- +* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.