hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: remove NonLibraryDataFlowCallable

Browse Source 
this required managing parameters and their pre-update nodes a bit
This commit is contained in:
Rasmus Lerchedahl Petersen
2022-09-12 15:17:29 +02:00
parent fa2da2f3ec
commit 0f95992b2f
5 changed files with 50 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
View File

@@ -50,7 +50,7 @@ deprecated class SafeExternalAPI = SafeExternalApi;
/** The default set of "safe" external APIs. */
private class DefaultSafeExternalApi extends SafeExternalApi {
override DataFlowPrivate::NonLibraryDataFlowCallable getSafeCallable() {
override DataFlowPrivate::DataFlowCallable getSafeCallable() {
exists(CallableValue cv | cv = result.getCallableValue() |
cv = Value::named(["len", "isinstance", "getattr", "hasattr"])
or
@@ -65,7 +65,7 @@ private class DefaultSafeExternalApi extends SafeExternalApi {
/** A node representing data being passed to an external API through a call. */
class ExternalApiDataNode extends DataFlow::Node {
DataFlowPrivate::NonLibraryDataFlowCallable callable;
DataFlowPrivate::DataFlowCallable callable;
int i;
ExternalApiDataNode() {
@@ -156,7 +156,7 @@ class ExternalApiUsedWithUntrustedData extends TExternalApi {
/** Gets a textual representation of this element. */
string toString() {
exists(
DataFlowPrivate::NonLibraryDataFlowCallable callable, int index, string callableString,
DataFlowPrivate::DataFlowCallable callable, int index, string callableString,
string indexString
|
this = TExternalApiParameter(callable, index) and