hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 19:55:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python taint-tracking: Fix performance of pathalogically slow predicate.

Browse Source
This commit is contained in:
Mark Shannon
2019-05-22 14:17:23 +01:00
parent b182abd119
commit 1de0dc9282
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
python/ql/src/semmle/python/security/TaintTracking.qll
View File

@@ -1209,17 +1209,22 @@ library module TaintFlowImplementation {
or
exists(string name | param = func.getParameterByName(name) and argument = func.getNamedArgumentForCall(call, name))
or
class_initializer_argument(_, _, call, func, argument, param)
class_initializer_argument(call, func, argument, param)
)
)
}
/* Helper for parameter_step */
pragma [noinline]
predicate class_initializer_argument(ClassValue cls, int n, CallNode call, CallableValue func, ControlFlowNode argument, NameNode param) {
call.getFunction().pointsTo(cls) and
cls.lookup("__init__") = func and
call.getArg(n) = argument and
param.getNode() = func.getScope().getArg(n+1)
private predicate class_initializer_argument(CallNode call, CallableValue func, ControlFlowNode argument, NameNode param) {
exists(ClassValue cls |
cls.getACall() = call and
cls.lookup("__init__") = func
) and
exists(int n |
call.getArg(n) = argument and
param.getNode() = func.getScope().getArg(n+1)
)
}
pragma [noinline]