mirror of
https://github.com/github/codeql.git
synced 2026-04-30 19:26:02 +02:00
Python: Fix hasFlowPath default implementation of isSink/2
If hasFlowPath was used, and isSink/2 was not overridden,
hasFlowPath(src, sink) would not use isSink/1 to restrict the allowed TaintSink.
This resulted in false-positives when we had flows with unrelated TaintSinks.
FP: 1a8e7ffc2e/files/webapp/graphite/dashboard/views.py (x2d486922081db956):1
Fixes https://github.com/Semmle/ql/issues/2081
This commit is contained in:
@@ -51,6 +51,7 @@ module TaintTracking {
|
||||
*/
|
||||
predicate isSink(DataFlow::Node node, TaintKind kind) {
|
||||
exists(TaintSink sink |
|
||||
this.isSink(sink) and
|
||||
node.asCfgNode() = sink and
|
||||
sink.sinks(kind)
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user