Azure python sdk url summary upstream

[bdrodes]

• Added MaD sinks for URLs in the azure SDK, labeled as 'ssrf'
• Updated HTTP request clients to use 'ssrf' MaD

[Copilot]

Pull Request Overview

This PR adds Server-Side Request Forgery (SSRF) modeling for the Azure Python SDK by introducing MaD (Models as Data) sinks and updating HTTP request clients to recognize SSRF vulnerabilities. This enables CodeQL to detect when user input can control URLs passed to Azure SDK methods.

• Added SSRF sink modeling framework for MaD-based HTTP requests
• Created comprehensive Azure SDK models for KeyVault and Storage services
• Added test coverage for Azure client SSRF scenarios

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
python/ql/lib/semmle/python/frameworks/SSRFSink.qll	New framework for handling SSRF sinks through MaD models
python/ql/lib/semmle/python/frameworks/Azure.Storage.model.yml	MaD definitions for Azure Storage SDK SSRF sinks
python/ql/lib/semmle/python/frameworks/Azure.Keyvault.model.yml	MaD definitions for Azure KeyVault SDK SSRF sinks
python/ql/lib/semmle/python/Frameworks.qll	Import statement for new SSRFSink framework
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_azure_client.py	Test cases for Azure SDK SSRF detection
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/PartialServerSideRequestForgery.expected	Expected results for partial SSRF tests
python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/FullServerSideRequestForgery.expected	Expected results for full SSRF tests
python/ql/lib/change-notes/released/2025-09-30-azure_ssrf_models	Release notes for the changes

[owen-mc]

I'm not familiar with the python library in general, but I can review the use of models-as-data.

[owen-mc]

• Some tests are failing because we do validation on sink kinds and "ssrf" isn't on the list. Please use "request-forgery", which is what all the other languages use. (New sink kinds can of course be added, but if there is an existing one then that should be used first, to keep the different language libraries consistent.)
• In Python: MaD barriers #21004 we switched to using a slightly different syntax (which matches the static languages). You'll have to rebase on main for this to work.

Suggested change

	urlArg = ModelOutput::getASinkNode("ssrf").asSink()
	ModelOutput::sinkNode(urlArg, "request-forgery")

[bdrodes]

Done.

[owen-mc]

Looking at the other test failures (which aren't related to validation of sink kinds):

• python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/FullServerSideRequestForgery.qlref and python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/PartialServerSideRequestForgery.qlref are failing because of some line number changes - you should check if the new results make sense, and if so accept them.
• another test is failing for unrelated reasons. I've made a PR to fix it, which should be merged soon.

[bdrodes]

Looking at the other test failures (which aren't related to validation of sink kinds):

• python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/FullServerSideRequestForgery.qlref and python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/PartialServerSideRequestForgery.qlref are failing because of some line number changes - you should check if the new results make sense, and if so accept them.
• another test is failing for unrelated reasons. I've made a PR to fix it, which should be merged soon.

Fixed.