hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Get back to ApiGraphs

Browse Source
This commit is contained in:
jorgectf
2021-03-26 10:05:50 +01:00
parent 30554a16da
commit 3d990c5950
3 changed files with 51 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
python/ql/src/experimental/semmle/python/Concepts.qll
View File

@@ -13,6 +13,7 @@ private import semmle.python.dataflow.new.DataFlow
private import semmle.python.dataflow.new.RemoteFlowSources
private import semmle.python.dataflow.new.TaintTracking
private import experimental.semmle.python.Frameworks
private import semmle.python.ApiGraphs
/** Provides classes for modeling Regular Expression-related APIs. */
module RegexExecution {
@@ -24,6 +25,7 @@ module RegexExecution {
*/
abstract class Range extends DataFlow::Node {
abstract DataFlow::Node getRegexNode();
abstract Attribute getRegexMethod();
}
}
@@ -40,5 +42,12 @@ class RegexExecution extends DataFlow::Node {
RegexExecution() { this = range }
DataFlow::Node getRegexNode() { result = range.getRegexNode() }
Attribute getRegexMethod() { result = range.getRegexMethod() }
}
class RegexEscape extends DataFlow::Node {
RegexEscape() {
this = API::moduleImport("re").getMember("escape").getACall().(DataFlow::CallCfgNode).getArg(0)
}
}

254
python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll
View File

@@ -8,221 +8,49 @@ private import semmle.python.dataflow.new.DataFlow
private import semmle.python.dataflow.new.TaintTracking
private import semmle.python.dataflow.new.RemoteFlowSources
private import experimental.semmle.python.Concepts
private import semmle.python.ApiGraphs
/** Provides models for the Python standard library. */
private module Stdlib {
// ---------------------------------------------------------------------------
// re
// ---------------------------------------------------------------------------
private module Re {
/** Gets a reference to the `re` module. */
private DataFlow::Node re(DataFlow::TypeTracker t) {
t.start() and
result = DataFlow::importNode("re")
or
exists(DataFlow::TypeTracker t2 | result = re(t2).track(t2, t))
}
/** Gets a reference to the `re` module. */
DataFlow::Node re() { result = re(DataFlow::TypeTracker::end()) }
/**
* Gets a reference to the attribute `attr_name` of the `re` module.
* WARNING: Only holds for a few predefined attributes.
*/
private DataFlow::Node re_attr(DataFlow::TypeTracker t, string attr_name) {
attr_name in [
"match", "fullmatch", "search", "split", "findall", "finditer", "sub", "subn", "compile",
"escape"
] and
(
t.start() and
result = DataFlow::importNode("re" + "." + attr_name)
or
t.startInAttr(attr_name) and
result = re()
)
or
// Due to bad performance when using normal setup with `re_attr(t2, attr_name).track(t2, t)`
// we have inlined that code and forced a join
exists(DataFlow::TypeTracker t2 |
exists(DataFlow::StepSummary summary |
re_attr_first_join(t2, attr_name, result, summary) and
t = t2.append(summary)
)
)
}
pragma[nomagic]
private predicate re_attr_first_join(
DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
) {
DataFlow::StepSummary::step(re_attr(t2, attr_name), res, summary)
}
/**
* Gets a reference to the attribute `attr_name` of the `re` module.
* WARNING: Only holds for a few predefined attributes.
*/
private DataFlow::Node re_attr(string attr_name) {
result = re_attr(DataFlow::TypeTracker::end(), attr_name)
}
/**
* Gets a reference to any `attr_name` of the `re` module that immediately executes an expression.
* WARNING: Only holds for a few predefined attributes.
*/
private DataFlow::Node re_exec_attr() {
exists(string attr_name |
attr_name in ["match", "fullmatch", "search", "split", "findall", "finditer", "sub", "subn"] and
result = re_attr(DataFlow::TypeTracker::end(), attr_name)
)
}
/**
* A call to `re.match`
* See https://docs.python.org/3/library/re.html#re.match
*/
private class ReMatchCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReMatchCall() { node.getFunction() = re_attr("match").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.fullmatch`
* See https://docs.python.org/3/library/re.html#re.fullmatch
*/
private class ReFullMatchCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReFullMatchCall() { node.getFunction() = re_attr("fullmatch").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.search`
* See https://docs.python.org/3/library/re.html#re.search
*/
private class ReSearchCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReSearchCall() { node.getFunction() = re_attr("search").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.split`
* See https://docs.python.org/3/library/re.html#re.split
*/
private class ReSplitCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReSplitCall() { node.getFunction() = re_attr("split").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.findall`
* See https://docs.python.org/3/library/re.html#re.findall
*/
private class ReFindAllCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReFindAllCall() { node.getFunction() = re_attr("findall").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.finditer`
* See https://docs.python.org/3/library/re.html#re.finditer
*/
private class ReFindIterCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReFindIterCall() { node.getFunction() = re_attr("finditer").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.sub`
* See https://docs.python.org/3/library/re.html#re.sub
*/
private class ReSubCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReSubCall() { node.getFunction() = re_attr("sub").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.subn`
* See https://docs.python.org/3/library/re.html#re.subn
*/
private class ReSubNCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReSubNCall() { node.getFunction() = re_attr("subn").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.escape`
* See https://docs.python.org/3/library/re.html#re.escape
*/
private class ReEscapeCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReEscapeCall() { node.getFunction() = re_attr("escape").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() { result = node.getNode().getFunc().(Attribute) }
}
/**
* A call to `re.compile`
* See https://docs.python.org/3/library/re.html#re.match
*/
private class ReCompileCall extends RegexExecution::Range, DataFlow::CfgNode {
override CallNode node;
ReCompileCall() { node.getFunction() = re_attr("compile").asCfgNode() }
override DataFlow::Node getRegexNode() { result.asCfgNode() = node.getArg(0) }
override Attribute getRegexMethod() {
exists(DataFlow::AttrRead reMethod |
reMethod = re_exec_attr() and
node.getFunction() = reMethod.getObject().getALocalSource().asCfgNode() and
result = reMethod.asExpr().(Attribute)
)
}
private module Re {
/** List of re methods. */
private class ReMethods extends string {
ReMethods() {
this in ["match", "fullmatch", "search", "split", "findall", "finditer", "sub", "subn"]
}
}
private class DirectRegex extends DataFlow::CallCfgNode, RegexExecution::Range {
DataFlow::Node regexNode;
Attribute regexMethod;
DirectRegex() {
this = API::moduleImport("re").getMember(any(ReMethods m)).getACall() and
regexNode = this.getArg(0) and
regexMethod = this.asExpr().(Attribute)
}
override DataFlow::Node getRegexNode() { result = regexNode }
override Attribute getRegexMethod() { result = regexMethod }
}
private class CompiledRegex extends DataFlow::CallCfgNode, RegexExecution::Range {
DataFlow::Node regexNode;
Attribute regexMethod;
CompiledRegex() {
exists(DataFlow::CallCfgNode patternCall, DirectRegex reMethod |
this = reMethod and
patternCall = API::moduleImport("re").getMember("compile").getACall() and
patternCall = reMethod.(DataFlow::AttrRead).getObject().getALocalSource() and
regexNode = patternCall.getArg(0) and
// regexMethod is *not* worked out outside class instanciation because `CompiledRegex` focuses on re.compile(pattern).ReMethod
regexMethod = reMethod.getRegexMethod()
)
}
override DataFlow::Node getRegexNode() { result = regexNode }
override Attribute getRegexMethod() { result = regexMethod }
}
}

3
python/ql/src/experimental/semmle/python/security/injection/RegexInjection.qll
View File

@@ -5,7 +5,6 @@
import python
import experimental.semmle.python.Concepts
import experimental.semmle.python.frameworks.Stdlib
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
@@ -21,5 +20,5 @@ class RegexInjectionFlowConfig extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { sink = any(RegexExecution re).getRegexNode() }
override predicate isSanitizer(DataFlow::Node sanitizer) { sanitizer instanceof ReEscapeCall }
override predicate isSanitizer(DataFlow::Node sanitizer) { sanitizer instanceof RegexEscape }
}