hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

An uploded file is considered a source

Browse Source
This commit is contained in:
Sim4n6
2022-12-15 23:39:02 +01:00
parent 54109b8ea7
commit 4376870a51
1 changed files with 75 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

122
python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.ql
View File

@@ -43,6 +43,21 @@ class UnsafeUnpackingConfig extends TaintTracking::Configuration {
exists(MethodCallNode mcn |
mcn = API::moduleImport("wget").getMember("download").getACall() and source = mcn.getArg(1)
)
or
// catch the uploaded files as a source
exists(Subscript s, Attribute at |
at = s.getObject() and at.getAttr() = "FILES" and source.asExpr() = s
)
or
exists(Node obj, AttrRead ar |
ar.getAMethodCall("get").flowsTo(source) and
ar.accesses(obj, "FILES")
)
or
exists(Node obj, AttrRead ar |
ar.getAMethodCall("getlist").flowsTo(source) and
ar.accesses(obj, "FILES")
)
}
override predicate isSink(DataFlow::Node sink) {
@@ -51,53 +66,66 @@ class UnsafeUnpackingConfig extends TaintTracking::Configuration {
}
override predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
(
// Writing the response data to the archive
exists(Stdlib::FileLikeObject::InstanceSource is, Node f, MethodCallNode mc |
is.flowsTo(f) and
mc.getMethodName() = "write" and
f = mc.getObject() and
nodeFrom = mc.getArg(0) and
nodeTo = is.(CallCfgNode).getArg(0)
)
or
// Copying the response data to the archive
exists(Stdlib::FileLikeObject::InstanceSource is, Node f, MethodCallNode mc |
is.flowsTo(f) and
mc = API::moduleImport("shutil").getMember("copyfileobj").getACall() and
f = mc.getArg(1) and
nodeFrom = mc.getArg(0) and
nodeTo = is.(CallCfgNode).getArg(0)
)
or
// Reading the response
exists(MethodCallNode mc |
nodeFrom = mc.getObject() and
mc.getMethodName() = "read" and
mc.flowsTo(nodeTo)
)
or
// Accessing the name or raw content
exists(AttrRead ar | ar.accesses(nodeFrom, ["name", "raw"]) and ar.flowsTo(nodeTo))
or
//Use of join of filename
exists(API::CallNode mcn |
mcn = API::moduleImport("os").getMember("path").getMember("join").getACall() and
nodeFrom = mcn.getArg(1) and
mcn.flowsTo(nodeTo)
)
or
// Read by chunks
exists(MethodCallNode mc |
nodeFrom = mc.getObject() and mc.getMethodName() = "chunks" and mc.flowsTo(nodeTo)
)
or
// Considering the use of closing()
exists(API::CallNode closing |
closing = API::moduleImport("contextlib").getMember("closing").getACall() and
closing.flowsTo(nodeTo) and
nodeFrom = closing.getArg(0)
)
// Writing the response data to the archive
exists(Stdlib::FileLikeObject::InstanceSource is, Node f, MethodCallNode mc |
is.flowsTo(f) and
mc.getMethodName() = "write" and
f = mc.getObject() and
nodeFrom = mc.getArg(0) and
nodeTo = is.(CallCfgNode).getArg(0)
)
or
// Copying the response data to the archive
exists(Stdlib::FileLikeObject::InstanceSource is, Node f, MethodCallNode mc |
is.flowsTo(f) and
mc = API::moduleImport("shutil").getMember("copyfileobj").getACall() and
f = mc.getArg(1) and
nodeFrom = mc.getArg(0) and
nodeTo = is.(CallCfgNode).getArg(0)
)
or
// Reading the response
exists(MethodCallNode mc |
nodeFrom = mc.getObject() and
mc.getMethodName() = "read" and
mc.flowsTo(nodeTo)
)
or
// Accessing the name or raw content
exists(AttrRead ar | ar.accesses(nodeFrom, ["name", "raw"]) and ar.flowsTo(nodeTo))
or
//Use of join of filename
exists(API::CallNode mcn |
mcn = API::moduleImport("os").getMember("path").getMember("join").getACall() and
nodeFrom = mcn.getArg(1) and
mcn.flowsTo(nodeTo)
)
or
// Read by chunks
exists(MethodCallNode mc |
nodeFrom = mc.getObject() and mc.getMethodName() = "chunks" and mc.flowsTo(nodeTo)
)
or
// Considering the use of closing()
exists(API::CallNode closing |
closing = API::moduleImport("contextlib").getMember("closing").getACall() and
closing.flowsTo(nodeTo) and
nodeFrom = closing.getArg(0)
)
or
// Considering the use of "fs"
exists(API::CallNode fs, MethodCallNode mcn |
fs =
API::moduleImport("django")
.getMember("core")
.getMember("files")
.getMember("storage")
.getMember("FileSystemStorage")
.getACall() and
fs.flowsTo(mcn.getObject()) and
mcn.getMethodName() = ["save", "path"] and
nodeFrom = mcn.getArg(0) and
nodeTo = mcn
)
}
}