hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Limit RequestInputAccess to immediate uses

Browse Source 
This fixes some spurious results that occurred when we considered
_any_ use of `request.something` to be a source, even ones we had
tracked into other functions. To prevent this, using
`getAnImmediateUse` better captures the fact that we want the source
to be just the actual attribute access.
This commit is contained in:
Taus Brock-Nannestad
2021-02-15 13:51:29 +01:00
parent 4c66071f5f
commit 27c479a8ba
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/src/semmle/python/frameworks/Flask.qll
View File

@@ -312,7 +312,7 @@ private module FlaskModel {
RequestInputAccess() {
// attributes
this = flask::request().getMember(attr_name).getAUse() and
this = flask::request().getMember(attr_name).getAnImmediateUse() and
attr_name in [
// str
"path", "full_path", "base_url", "url", "access_control_request_method",