hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix QLDoc issues

Browse Source
This commit is contained in:
amammad
2024-02-14 23:31:22 +04:00
parent eb401a205d
commit 09d8a75844
3 changed files with 6 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
python/ql/src/experimental/Security/CWE-409/DecompressionBombs.ql
View File

@@ -12,11 +12,6 @@
*/
import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.ApiGraphs
import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.dataflow.new.internal.DataFlowPublic
import experimental.semmle.python.security.DecompressionBomb
import BombsFlow::PathGraph

7
python/ql/src/experimental/semmle/python/security/DecompressionBomb.qll
View File

@@ -1,5 +1,4 @@
import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.ApiGraphs
import semmle.python.dataflow.new.RemoteFlowSources
@@ -26,7 +25,7 @@ module DecompressionBomb {
module ZipFile {
/**
* A `zipfile` Instance
* Gets `zipfile` Instance
*
* ```python
* zipfile.ZipFile()
@@ -129,7 +128,7 @@ module TarFile {
}
/**
* A tarfile instance for extracting compressed data
* Gets tarfile instance for extracting compressed data
*/
API::Node tarfileExtractMember() {
result =
@@ -374,7 +373,7 @@ module BombsConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof RemoteFlowSource
or
source instanceof FastAPI
source instanceof FastApi
}
predicate isSink(DataFlow::Node sink) { sink instanceof DecompressionBomb::Sink }

7
python/ql/src/experimental/semmle/python/security/FileAndFormRemoteFlowSource.qll
View File

@@ -1,5 +1,4 @@
import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.ApiGraphs
@@ -8,10 +7,10 @@ import semmle.python.ApiGraphs
*/
module FileAndFormRemoteFlowSource {
/**
* A
* A FastAPI Remote Flow Source for requests with multipart data in the body or requests with single file in the body
*/
class FastAPI extends DataFlow::Node {
FastAPI() {
class FastApi extends DataFlow::Node {
FastApi() {
exists(API::Node fastApiParam, Expr fastApiUploadFile |
fastApiParam =
API::moduleImport("fastapi")