From e930b43bf3a221701258af8b1e30ea0483dee1d5 Mon Sep 17 00:00:00 2001 From: Mark Shannon Date: Mon, 19 Nov 2018 16:36:19 +0000 Subject: [PATCH] Python security queries. Choose a precision reflecting actual precision for Security queries. --- python/ql/src/Security/CWE-022/PathInjection.ql | 2 +- python/ql/src/Security/CWE-078/CommandInjection.ql | 2 +- python/ql/src/Security/CWE-079/ReflectedXss.ql | 2 +- python/ql/src/Security/CWE-089/SqlInjection.ql | 2 +- python/ql/src/Security/CWE-094/CodeInjection.ql | 2 +- python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql | 2 +- python/ql/src/Security/CWE-502/UnsafeDeserialization.ql | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/python/ql/src/Security/CWE-022/PathInjection.ql b/python/ql/src/Security/CWE-022/PathInjection.ql index 49c9ee74296d..5d5561e49c35 100644 --- a/python/ql/src/Security/CWE-022/PathInjection.ql +++ b/python/ql/src/Security/CWE-022/PathInjection.ql @@ -4,7 +4,7 @@ * @kind problem * @problem.severity error * @sub-severity high - * @precision medium + * @precision high * @id py/path-injection * @tags correctness * security diff --git a/python/ql/src/Security/CWE-078/CommandInjection.ql b/python/ql/src/Security/CWE-078/CommandInjection.ql index 22e3860dd38b..44e9d56dda36 100755 --- a/python/ql/src/Security/CWE-078/CommandInjection.ql +++ b/python/ql/src/Security/CWE-078/CommandInjection.ql @@ -5,7 +5,7 @@ * @kind problem * @problem.severity error * @sub-severity high - * @precision medium + * @precision high * @id py/command-line-injection * @tags correctness * security diff --git a/python/ql/src/Security/CWE-079/ReflectedXss.ql b/python/ql/src/Security/CWE-079/ReflectedXss.ql index aa6c5552630e..dff7657a7184 100644 --- a/python/ql/src/Security/CWE-079/ReflectedXss.ql +++ b/python/ql/src/Security/CWE-079/ReflectedXss.ql @@ -5,7 +5,7 @@ * @kind problem * @problem.severity error * @sub-severity high - * @precision medium + * @precision high * @id py/reflective-xss * @tags security * external/cwe/cwe-079 diff --git a/python/ql/src/Security/CWE-089/SqlInjection.ql b/python/ql/src/Security/CWE-089/SqlInjection.ql index 62235dfe9ce7..0513bb6ba1f3 100755 --- a/python/ql/src/Security/CWE-089/SqlInjection.ql +++ b/python/ql/src/Security/CWE-089/SqlInjection.ql @@ -4,7 +4,7 @@ * malicious SQL code by the user. * @kind problem * @problem.severity error - * @precision medium + * @precision high * @id py/sql-injection * @tags security * external/cwe/cwe-089 diff --git a/python/ql/src/Security/CWE-094/CodeInjection.ql b/python/ql/src/Security/CWE-094/CodeInjection.ql index ef548c83ee28..12b816736eb3 100644 --- a/python/ql/src/Security/CWE-094/CodeInjection.ql +++ b/python/ql/src/Security/CWE-094/CodeInjection.ql @@ -5,7 +5,7 @@ * @kind problem * @problem.severity error * @sub-severity high - * @precision medium + * @precision high * @id py/code-injection * @tags security * external/owasp/owasp-a1 diff --git a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql index 188e43ebb8ea..e4dc7855f26f 100644 --- a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql +++ b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql @@ -3,7 +3,7 @@ * @description Using broken or weak cryptographic algorithms can compromise security. * @kind problem * @problem.severity warning - * @precision medium + * @precision high * @id py/weak-cryptographic-algorithm * @tags security * external/cwe/cwe-327 diff --git a/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql b/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql index 48d4ed239837..af7a906691db 100644 --- a/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql +++ b/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql @@ -5,7 +5,7 @@ * @id py/unsafe-deserialization * @problem.severity error * @sub-severity high - * @precision medium + * @precision high * @tags external/cwe/cwe-502 * security * serialization