hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Handle taint of f-strings

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2020-08-24 17:20:16 +02:00
parent 2f090df6d3
commit 13148b42d3
3 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
python/ql/src/semmle/python/security/strings/Basic.qll
View File

@@ -27,7 +27,8 @@ abstract class StringKind extends TaintKind {
os_path_join(fromnode, tonode) or
str_format(fromnode, tonode) or
encode_decode(fromnode, tonode) or
to_str(fromnode, tonode)
to_str(fromnode, tonode) or
f_string(fromnode, tonode)
)
or
result = this and copy_call(fromnode, tonode)
@@ -107,6 +108,11 @@ private predicate os_path_join(ControlFlowNode fromnode, CallNode tonode) {
tonode.getAnArg() = fromnode
}
/** tonode = f"... {fromnode} ..." */
private predicate f_string(ControlFlowNode fromnode, ControlFlowNode tonode) {
tonode.getNode().(Fstring).getAValue() = fromnode.getNode()
}
/**
* A kind of "taint", representing a dictionary mapping str->"taint"
*