hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

add minimal test for Array join as a sink, and learn that the order is flipped compared to JS. Thanks Copilot!

Browse Source
This commit is contained in:
erik-krogh
2023-02-01 23:08:57 +01:00
parent 5bddfc0d79
commit 33c506d7fe
3 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/lib/semmle/python/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
View File

@@ -101,7 +101,6 @@ module UnsafeShellCommandConstruction {
* A string constructed using a `.join(" ")` call, where the resulting string ends up being executed as a shell command.
*/
class ArrayJoin extends Sink {
// TODO: Add test.
Concepts::SystemCommandExecution s;
DataFlow::MethodCallNode call;
@@ -110,10 +109,10 @@ module UnsafeShellCommandConstruction {
unique( | | call.getArg(_)).asExpr().(Str).getText() = " " and
isUsedAsShellCommand(call, s) and
(
this = call.getObject() and
not call.getObject().asExpr() instanceof List
this = call.getArg(0) and
not call.getArg(0).asExpr() instanceof List
or
this.asExpr() = call.getObject().asExpr().(List).getASubExpression()
this.asExpr() = call.getArg(0).asExpr().(List).getASubExpression()
)
}