hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Optimize the Argparse filename as a source.

Browse Source
This commit is contained in:
Sim4n6
2023-01-26 01:00:01 +01:00
parent f867c9008f
commit 2e4cb63049
2 changed files with 25 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
python/ql/test/experimental/query-tests/Security/CWE-022/UnsafeUnpack.py
View File

@@ -87,3 +87,17 @@ shutil.unpack_archive(compressed_file, base_dir) # $result=BAD
# download(url) returns filename
compressed_file = wget.download(url)
shutil.unpack_archive(compressed_file, base_dir) # $result=BAD
# A source coming from a CLI argparse module
# see argparse: https://docs.python.org/3/library/argparse.html
import argparse
parser = argparse.ArgumentParser(description='Process some integers.')
parser.add_argument('integers', metavar='N', type=int, nargs='+',
help='an integer for the accumulator')
parser.add_argument('filename', help='filename to be provided')
args = parser.parse_args()
compressed_file = args.filename
shutil.unpack_archive(compressed_file, base_dir) # $result=BAD