Azure python sanitizer upstream2 by bdrodes · Pull Request #21288 · github/codeql

bdrodes · 2026-02-06T16:21:45Z

Clean up of test cases to use postprocessing
Adding full ssrf path sanitization for the new AntiSSRF python API.

…orgery/test_azure_client.py Co-authored-by: Copilot <[email protected]>

…caes to use postprocessing results. Currently results for partial ssrf still need work, it is flagging cases where the URL is fully controlled, but is sanitized. I'm not sure if this should be flagged yet.

…tion.

Copilot

Pull request overview

This PR updates the Python SSRF (CWE-918) query tests to use inline-expectations postprocessing and adds modeling/tests for the AntiSSRF library’s URI validation as a sanitizer for full URL control.

Changes:

Migrate SSRF query-tests to utils/test/InlineExpectationsTestQuery.ql postprocessing.
Expand SSRF test coverage for requests, http.client, Azure SDK sinks, and new AntiSSRF validation APIs.
Add an AntiSSRF URIValidator barrier/sanitizer to SSRF dataflow customizations and record the change in change notes.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_requests.py	Adds more `requests` SSRF cases and AntiSSRFPolicy-based safe/unsafe session scenarios with inline expectations.
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py	New tests covering AntiSSRF `URIValidator` domain checks and how they interact with SSRF sink classification.
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_http_client.py	Updates `http.client` SSRF tests to inline expectations and adds sink annotations.
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py	Converts Azure SSRF sink tests to inline expectations and simplifies call formatting.
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/full_partial_test.py	Refactors existing full/partial SSRF test cases to inline expectations and adds explicit alert annotations.
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/PartialServerSideRequestForgery.qlref	Switches to `query:`/`postprocess:` format to enable inline expectations postprocessing.
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/PartialServerSideRequestForgery.expected	Regenerated expected output for postprocessed partial SSRF tests.
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/FullServerSideRequestForgery.qlref	Switches to `query:`/`postprocess:` format to enable inline expectations postprocessing.
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/FullServerSideRequestForgery.expected	Regenerated expected output for postprocessed full SSRF tests.
python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll	Adds AntiSSRF `URIValidator` barrier/guard modeling for full URL control sanitization.
python/ql/lib/change-notes/2026-02-09-ssrf_test_case_cleanup_and_new_ssrf_barriers.md	Documents the SSRF test cleanup and new AntiSSRF barrier behavior.

Comments suppressed due to low confidence (47)

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:21

Variable c is not used.

        c = SecretClient(vault_url=full_url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:35

Variable c is not used.

        c = KeyClient(vault_url=full_url, credential=credential)  # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:37

Variable c is not used.

        c = KeyClient(vault_url=full_url, credential=credential)  # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:51

Variable c is not used.

        c = ShareFileClient.from_file_url(full_url) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:53

Variable c is not used.

        c = ShareFileClient.from_file_url(full_url) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:130

Variable c is not used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:132

Variable c is not used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_requests.py:29

Variable response is not used.

    response = session.get(user_input)

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_requests.py:39

Variable response is not used.

    response = session.get(user_input) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_requests.py:49

Variable response is not used.

    response = session.get(user_input) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py:16

This assignment to 'c' is unnecessary as it is redefined before this value is used.

    c = SecretClient(vault_url=full_url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py:17

This assignment to 'c' is unnecessary as it is redefined before this value is used.

    c = ShareFileClient.from_file_url(url) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py:18

This assignment to 'c' is unnecessary as it is redefined before this value is used.

    c = ShareFileClient.from_file_url(full_url) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py:19

This assignment to 'c' is unnecessary as it is redefined before this value is used.

    c = KeyClient(url, credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py:20

This assignment to 'c' is unnecessary as it is redefined before this value is used.

    c = KeyClient(full_url, credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py:21

This assignment to 'c' is unnecessary as it is redefined before this value is used.

    c = ContainerClient.from_container_url(container_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:16

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:30

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = KeyClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:32

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = KeyClient(vault_url=url, credential=credential)  # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:46

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = ShareFileClient.from_file_url(url) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:48

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = ShareFileClient.from_file_url(url) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:64

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:66

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:69

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:71

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:74

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:76

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:79

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:81

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:85

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:87

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:90

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:92

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:95

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:97

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:100

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:102

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:105

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:107

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:110

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:112

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:115

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:117

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:120

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:122

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:125

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/full-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py:127

This assignment to 'c' is unnecessary as it is redefined before this value is used.
This assignment to 'c' is unnecessary as it is redefined before this value is used.

        c = SecretClient(vault_url=url, credential=credential) # $ Alert[py/partial-ssrf]

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py

python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_requests.py

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_requests.py

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py

python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py

…orgery/test_path_validation.py Co-authored-by: Copilot <[email protected]>

…esults (column numbers).

owen-mc

I haven't finished looking at this yet.

owen-mc · 2026-02-11T22:15:28Z

...est/query-tests/Security/CWE-918-ServerSideRequestForgery/FullServerSideRequestForgery.qlref

@@ -1 +1,2 @@
-Security/CWE-918/FullServerSideRequestForgery.ql
+query: Security/CWE-918/FullServerSideRequestForgery.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql


We should also pretty-print the models. If we don't do this then someone adding an unrelated model in future will change the numbering of the models in this test and hence the expected output, which is very confusing.

Suggested change

postprocess: utils/test/InlineExpectationsTestQuery.ql

postprocess:

- utils/test/PrettyPrintModels.ql

- utils/test/InlineExpectationsTestQuery.ql

You'll have to update the test output as well.

.../query-tests/Security/CWE-918-ServerSideRequestForgery/PartialServerSideRequestForgery.qlref

owen-mc · 2026-02-12T11:52:47Z

python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll

+        // validator used in a comparison
+        exists(CompareNode cn, Cmpop op, Node n | cn = g and n.getALocalSource() = call |
+          (
+            // validator == true or validator == false or validator is True or validator is False
+            (op instanceof Eq or op instanceof Is) and
+            exists(ControlFlowNode l, boolean bool |
+              l.getNode().(BooleanLiteral).booleanValue() = bool and
+              bool in [true, false] and
+              branch = bool and
+              cn.operands(n.asCfgNode(), op, l)
+            )
+            or
+            // validator != false or validator != true or validator is not True or validator is not False
+            (op instanceof NotEq or op instanceof IsNot) and
+            exists(ControlFlowNode l, boolean bool |
+              l.getNode().(BooleanLiteral).booleanValue() = bool and
+              bool in [true, false] and
+              branch = bool.booleanNot() and
+              cn.operands(n.asCfgNode(), op, l)
+            )
+          )
+        )
+        or
+        // validator call directly (e.g., if URIValidator.in_domain(...) )
+        g = call.asCfgNode() and
+        branch = true


This seems to work, but I would hope that so much logic isn't necessary. @tausbn @yoff is there a more succinct way to do this at the moment? (When we eventually get the guards library I'm sure that will cover it.)

I agree, it's awkward. The present solution is an okay band-aid (especially after some cleanup), but it would be nice to have a generic solution that could also account for things like boolean operators, etc.

I think the closest thing I'm aware of is https://github.com/github/codeql/blob/main/python/ql/lib/semmle/python/Comparisons.qll
but this is very much aimed at a particular kind of comparison, and would not be immediately applicable here.

owen-mc · 2026-02-12T11:57:38Z

I finished reviewing. The tests cover all the new sanitizers, which is good. My only remaining issue is around whether the sanitizer guard definition needs all the logic around different kinds of comparisons.

owen-mc

Thanks for fixing that.

Changes made

tausbn

A few suggestions, otherwise this looks good to me. 👍

tausbn · 2026-02-12T16:40:09Z

python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll

+  private predicate uri_validator(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
+    exists(DataFlow::CallCfgNode call, string funcs |
+      funcs in ["in_domain", "in_azure_keyvault_domain", "in_azure_storage_domain"]
+    |
+      call = API::moduleImport("AntiSSRF").getMember("URIValidator").getMember(funcs).getACall() and
+      call.getArg(0).asCfgNode() = node and
+      (
+        // validator used in a comparison
+        exists(CompareNode cn, Cmpop op, Node n | cn = g and n.getALocalSource() = call |
+          (
+            // validator == true or validator == false or validator is True or validator is False
+            (op instanceof Eq or op instanceof Is) and
+            exists(ControlFlowNode l, boolean bool |
+              l.getNode().(BooleanLiteral).booleanValue() = bool and
+              bool in [true, false] and
+              branch = bool and
+              cn.operands(n.asCfgNode(), op, l)
+            )
+            or
+            // validator != false or validator != true or validator is not True or validator is not False
+            (op instanceof NotEq or op instanceof IsNot) and
+            exists(ControlFlowNode l, boolean bool |
+              l.getNode().(BooleanLiteral).booleanValue() = bool and
+              bool in [true, false] and
+              branch = bool.booleanNot() and
+              cn.operands(n.asCfgNode(), op, l)
+            )
+          )
+        )
+        or
+        // validator call directly (e.g., if URIValidator.in_domain(...) )
+        g = call.asCfgNode() and
+        branch = true
+      )
+    )
+  }


Suggested change

private predicate uri_validator(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {

exists(DataFlow::CallCfgNode call, string funcs |

funcs in ["in_domain", "in_azure_keyvault_domain", "in_azure_storage_domain"]

|

call = API::moduleImport("AntiSSRF").getMember("URIValidator").getMember(funcs).getACall() and

call.getArg(0).asCfgNode() = node and

(

// validator used in a comparison

exists(CompareNode cn, Cmpop op, Node n | cn = g and n.getALocalSource() = call |

(

// validator == true or validator == false or validator is True or validator is False

(op instanceof Eq or op instanceof Is) and

exists(ControlFlowNode l, boolean bool |

l.getNode().(BooleanLiteral).booleanValue() = bool and

bool in [true, false] and

branch = bool and

cn.operands(n.asCfgNode(), op, l)

)

or

// validator != false or validator != true or validator is not True or validator is not False

(op instanceof NotEq or op instanceof IsNot) and

exists(ControlFlowNode l, boolean bool |

l.getNode().(BooleanLiteral).booleanValue() = bool and

bool in [true, false] and

branch = bool.booleanNot() and

cn.operands(n.asCfgNode(), op, l)

)

)

)

or

// validator call directly (e.g., if URIValidator.in_domain(...) )

g = call.asCfgNode() and

branch = true

)

)

}

private predicate uri_validator(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {

exists(DataFlow::CallCfgNode call, string funcs |

funcs in ["in_domain", "in_azure_keyvault_domain", "in_azure_storage_domain"] and

call = API::moduleImport("AntiSSRF").getMember("URIValidator").getMember(funcs).getACall() and

call.getArg(0).asCfgNode() = node

|

// validator call directly (e.g., if URIValidator.in_domain(...) )

g = call.asCfgNode() and

branch = true

or

// validator used in a comparison

exists(Cmpop op, Node n, ControlFlowNode l |

n.getALocalSource() = call and g.(CompareNode).operands(n.asCfgNode(), op, l)

|

// validator == true or validator == false or validator is True or validator is False

(op instanceof Eq or op instanceof Is) and

branch = l.getNode().(BooleanLiteral).booleanValue()

or

// validator != false or validator != true or validator is not True or validator is not False

(op instanceof NotEq or op instanceof IsNot) and

branch = l.getNode().(BooleanLiteral).booleanValue().booleanNot()

)

)

}

I think this should be equivalent, and hopefully a bit easier to read.

tausbn · 2026-02-12T16:43:01Z

python/ql/lib/change-notes/2026-02-09-ssrf_test_case_cleanup_and_new_ssrf_barriers.md

+---
+category: minorAnalysis
+---
+* Modified SSRF tests to use postprocessing to more easily debug results. 


I'm not sure this makes sense to put in the change notes, as it isn't really a user-facing change. I don't have strong feelings about it, however.

bdrodes and others added 11 commits February 6, 2026 11:18

Adding azure sdk test cases and updated test expected file.

9912aaa

Added change logs.

b8ba905

Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestF…

46a2a24

…orgery/test_azure_client.py Co-authored-by: Copilot <[email protected]>

Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestF…

08b72d0

…orgery/test_azure_client.py Co-authored-by: Copilot <[email protected]>

Moved change log to correct location.

7db9779

Adding docs.

265922d

Adjusting acryonym for SSRF for casing standards.

88adb05

Removing an upstream change log, not needed for local fork update.

27e1981

Added support for new URIValidator in AntiSSRF library. Updated test …

97ddab0

…caes to use postprocessing results. Currently results for partial ssrf still need work, it is flagging cases where the URL is fully controlled, but is sanitized. I'm not sure if this should be flagged yet.

Updating test case expected alerts.

97f19d0

Fixing inefficiently passed variable in nested existential quantifica…

42f6e6a

…tion.

github-actions bot added the Python label Feb 6, 2026

bdrodes added 3 commits February 6, 2026 11:23

removing SSRFSink.qll

4f11913

Removing commented out test cases.

f6c302b

Merge branch 'main' into azure_python_sanitizer_upstream2

85ae404

github-actions bot added the documentation label Feb 9, 2026

Restore prior PR change log (accidentally removed)

df54459

github-actions bot removed the documentation label Feb 9, 2026

Added change log

23bab81

github-actions bot added the documentation label Feb 9, 2026

bdrodes marked this pull request as ready for review February 9, 2026 18:23

bdrodes requested a review from a team as a code owner February 9, 2026 18:23

Copilot AI review requested due to automatic review settings February 9, 2026 18:23

Copilot started reviewing on behalf of bdrodes February 9, 2026 18:24 View session

Copilot AI reviewed Feb 9, 2026

View reviewed changes

bdrodes and others added 4 commits February 10, 2026 11:09

Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestF…

9f8ed71

…orgery/test_path_validation.py Co-authored-by: Copilot <[email protected]>

Applying copilot PR suggestions.

a91cf6b

More copilot suggestions.

4bb110b

Update expected files. Copilot suggestions broke unit test expected r…

9f9c353

…esults (column numbers).

owen-mc previously requested changes Feb 11, 2026

View reviewed changes

owen-mc reviewed Feb 12, 2026

View reviewed changes

Pretty print for tests.

4d4e7a1

owen-mc reviewed Feb 12, 2026

View reviewed changes

tausbn requested changes Feb 12, 2026

View reviewed changes

Conversation

bdrodes commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

owen-mc left a comment

Choose a reason for hiding this comment

Uh oh!

owen-mc Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

owen-mc Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

tausbn Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

owen-mc commented Feb 12, 2026

Uh oh!

owen-mc left a comment

Choose a reason for hiding this comment

Uh oh!

tausbn left a comment

Choose a reason for hiding this comment

Uh oh!

tausbn Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

tausbn Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bdrodes commented Feb 6, 2026 •

edited

Loading