hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model C-based loaders for PyYAML

Browse Source 
Not really that important. But easy to do while I was working on this library.
This commit is contained in:
Rasmus Wriedt Larsen
2021-03-18 11:55:01 +01:00
parent 54e6f51512
commit 42b2c3ed52
3 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/change-notes/2021-03-18-yaml-handle-C-based-loaders.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* Improved modeling of the `PyYAML` PyPI package, so we now correctly treat `CSafeLoader` and `CBaseLoader` as being safe loaders that can not lead to code execution.

5
python/ql/src/semmle/python/frameworks/Yaml.qll
View File

@@ -56,7 +56,10 @@ private module Yaml {
not exists(DataFlow::Node loader_arg |
loader_arg in [this.getArg(1), this.getArgByName("Loader")]
|
loader_arg = API::moduleImport("yaml").getMember(["SafeLoader", "BaseLoader"]).getAUse()
loader_arg =
API::moduleImport("yaml")
.getMember(["SafeLoader", "BaseLoader", "CSafeLoader", "CBaseLoader"])
.getAUse()
)
}

4
python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py
View File

@@ -21,5 +21,5 @@ yaml.full_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() dec
# C-based loaders with `libyaml`
yaml.load(payload, yaml.CLoader) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
yaml.load(payload, yaml.CFullLoader) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
yaml.load(payload, yaml.CSafeLoader) # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML SPURIOUS: decodeMayExecuteInput
yaml.load(payload, yaml.CBaseLoader) # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML SPURIOUS: decodeMayExecuteInput
yaml.load(payload, yaml.CSafeLoader) # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
yaml.load(payload, yaml.CBaseLoader) # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML