[Draft] Python: Split Insecure Cookie query into multiple queries #20494
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR splits the existing py/insecure-cookie query into three separate, more focused queries to better align with JavaScript's cookie security query structure. The original query checked for multiple cookie security attributes in a single query, while the new approach separates concerns into distinct queries.
- Refactors
py/insecure-cookieto only check for missingSecureattribute - Creates new
py/client-exposed-cookiequery for missingHttpOnlyattribute - Creates new
py/samesite-none-cookiequery forSameSite=Noneattribute issues
Reviewed Changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
python/ql/src/Security/CWE-614/InsecureCookie.ql |
Simplified to only check for missing Secure attribute |
python/ql/src/Security/CWE-1004/NonHttpOnlyCookie.ql |
New query for missing HttpOnly attribute |
python/ql/src/Security/CWE-1275/SameSiteNoneCookie.ql |
New query for SameSite=None issues |
python/ql/test/query-tests/Security/CWE-614-InsecureCookie/test.py |
Updated test with inline expectations for new query behavior |
python/ql/src/change-notes/2025-09-19-insecure-cookie.md |
Documents the query split changes |
Comments suppressed due to low confidence (2)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| from Http::Server::CookieWrite cookie | ||
| where cookie.hasHttpOnlyFlag(false) | ||
| select cookie, "Cookie is added without the HttpOnly attribute properly set." |
Check warning
Code scanning / CodeQL
Consistent alert message Warning
| from Http::Server::CookieWrite cookie | ||
| where cookie.hasSameSiteAttribute(any(Http::Server::CookieWrite::SameSiteNone v)) | ||
| select cookie, "Cookie is added with the SameSite attribute set to None." |
Check warning
Code scanning / CodeQL
Consistent alert message Warning
| from Http::Server::CookieWrite cookie | ||
| where cookie.hasSecureFlag(false) | ||
| select cookie, "Cookie is added without the Secure attribute properly set." |
Check warning
Code scanning / CodeQL
Consistent alert message Warning
joefarebrother
changed the title
Splits the
py/insecure-cookiequery intopy/insecure-cookie,py/client-exposed-cookie, andpy/samesite-none-cookie.This is closer to how these queries are handled in JS with
js/clear-text-cookie,js/client-exposed-cookie, andjs/samesite-none-cookiequeries.