Python: Fix hasFlowPath default implementation of isSink/2

If hasFlowPath was used, and isSink/2 was not overridden,
hasFlowPath(src, sink) would not use isSink/1 to restrict the allowed TaintSink.
This resulted in false-positives when we had flows with unrelated TaintSinks.

FP: 1a8e7ffc2e/files/webapp/graphite/dashboard/views.py (x2d486922081db956):1

Fixes https://github.com/Semmle/ql/issues/2081
This commit is contained in:
Rasmus Wriedt Larsen
2019-10-08 17:06:31 +02:00
parent 8896fa5bc9
commit 36bb5f54ce

View File

@@ -51,6 +51,7 @@ module TaintTracking {
*/
predicate isSink(DataFlow::Node node, TaintKind kind) {
exists(TaintSink sink |
this.isSink(sink) and
node.asCfgNode() = sink and
sink.sinks(kind)
)