hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove attrs feature

Browse Source
This commit is contained in:
jorgectf
2021-03-31 22:26:08 +02:00
parent 8faafb6961
commit 4328ff3981
4 changed files with 3 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
python/ql/src/experimental/Security/CWE-090/LDAPInjection.ql
View File

@@ -19,7 +19,6 @@ from
LDAPInjectionSink castedSink
where
config.hasFlowPath(source, sink) and
castedSink.getLDAPNode() = sink.getNode() //and
// if exists(castedSink.getAttrs()) then
castedSink.getLDAPNode() = sink.getNode()
select sink.getNode(), source, sink, "$@ LDAP query executes $@ as a $@.", castedSink, "This",
source.getNode(), "a user-provided value", castedSink.getLDAPNode(), castedSink.getLDAPPart() //, castedSink.getAttrs(), "probably leaking this attribute(s)"
source.getNode(), "a user-provided value", castedSink.getLDAPNode(), castedSink.getLDAPPart()

4
python/ql/src/experimental/semmle/python/Concepts.qll
View File

@@ -20,8 +20,6 @@ module LDAPQuery {
abstract DataFlow::Node getLDAPNode();
abstract string getLDAPPart();
abstract DataFlow::Node getAttrs();
}
}
@@ -33,8 +31,6 @@ class LDAPQuery extends DataFlow::Node {
DataFlow::Node getLDAPNode() { result = range.getLDAPNode() }
string getLDAPPart() { result = range.getLDAPPart() }
DataFlow::Node getAttrs() { result = range.getAttrs() }
}
module LDAPEscape {

11
python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll
View File

@@ -21,7 +21,6 @@ private module LDAP {
private class LDAP2Query extends DataFlow::CallCfgNode, LDAPQuery::Range {
DataFlow::Node ldapNode;
string ldapPart;
DataFlow::Node attrs;
LDAP2Query() {
exists(DataFlow::AttrRead searchMethod, DataFlow::CallCfgNode initCall |
@@ -45,10 +44,6 @@ private module LDAP {
override DataFlow::Node getLDAPNode() { result = ldapNode }
override string getLDAPPart() { result = ldapPart }
override DataFlow::Node getAttrs() {
result = this.getArg(3) or result = this.getArgByName("attrlist")
}
}
private class LDAP2EscapeDN extends DataFlow::CallCfgNode, LDAPEscape::Range {
@@ -77,14 +72,12 @@ private module LDAP {
private module LDAP3 {
private class LDAP3QueryMethods extends string {
// pending to dig into this although https://github.com/cannatag/ldap3/blob/21001d9087c0d24c399eec433a261c455b7bc97f/ldap3/core/connection.py#L760
LDAP3QueryMethods() { this in ["search"] }
}
private class LDAP3Query extends DataFlow::CallCfgNode, LDAPQuery::Range {
DataFlow::Node ldapNode;
string ldapPart;
DataFlow::Node attrs;
LDAP3Query() {
exists(DataFlow::AttrRead searchMethod, DataFlow::CallCfgNode connCall |
@@ -105,10 +98,6 @@ private module LDAP {
override DataFlow::Node getLDAPNode() { result = ldapNode }
override string getLDAPPart() { result = ldapPart }
override DataFlow::Node getAttrs() {
result = this.getArg(3) or result = this.getArgByName("attributes")
}
}
private class LDAP3EscapeDN extends DataFlow::CallCfgNode, LDAPEscape::Range {

5
python/ql/src/experimental/semmle/python/security/injection/LDAPInjection.qll
View File

@@ -9,7 +9,6 @@ import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
class LDAPInjectionSink extends DataFlow::Node {
// DataFlow::Node attrs;
DataFlow::Node ldapNode;
string ldapPart;
@@ -17,15 +16,13 @@ class LDAPInjectionSink extends DataFlow::Node {
exists(LDAPQuery ldapQuery |
this = ldapQuery and
ldapNode = ldapQuery.getLDAPNode() and
ldapPart = ldapQuery.getLDAPPart() // and
// if exists(ldapQuery.getAttrs()) then attrs = ldapQuery.getAttrs()
ldapPart = ldapQuery.getLDAPPart()
)
}
DataFlow::Node getLDAPNode() { result = ldapNode }
string getLDAPPart() { result = ldapPart }
// DataFlow::Node getAttrs() { result = attrs }
}
/**