hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model sensitive data based on variable names

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-06-04 11:10:50 +02:00
parent f5fd0f8d1c
commit 350f79e1e1
3 changed files with 49 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
python/ql/test/experimental/dataflow/sensitive-data/TestSensitiveDataSources.ql
View File

@@ -1,5 +1,6 @@
import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import TestUtilities.InlineExpectationsTest
import semmle.python.dataflow.new.SensitiveDataSources
private import semmle.python.ApiGraphs
@@ -21,7 +22,7 @@ class SensitiveDataSourcesTest extends InlineExpectationsTest {
or
exists(DataFlow::Node use |
use = API::builtin("print").getACall().getArg(_) and
DataFlow::localFlow(source, use) and
TaintTracking::localTaint(source, use) and
location = use.getLocation() and
element = use.toString() and
value = source.getClassification() and

12
python/ql/test/experimental/dataflow/sensitive-data/test.py
View File

@@ -29,12 +29,20 @@ foo = ObjectFromDatabase()
foo.secret # $ SensitiveDataSource=secret
foo.username # $ SensitiveDataSource=id
# based on variable/parameter names
def my_func(password): # $ SensitiveDataSource=password
print(password) # $ SensitiveUse=password
password = some_function()
print(password) # $ MISSING: SensitiveUse=password
password = some_function() # $ SensitiveDataSource=password
print(password) # $ SensitiveUse=password
for password in some_function2(): # $ SensitiveDataSource=password
print(password) # $ SensitiveUse=password
with some_function3() as password: # $ SensitiveDataSource=password
print(password) # $ SensitiveUse=password
# Special handling of lookups of sensitive properties
request.args["password"], # $ SensitiveDataSource=password