hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 15:25:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: update doc to use operations module

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2024-06-24 10:56:34 +02:00
parent 00fbada41d
commit 4626e134fa
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/codeql/codeql-language-guides/customizing-library-models-for-python.rst
View File

@@ -36,7 +36,7 @@ In this example, we'll show how to add the following argument, passed to **sudo*
.. code-block:: python
from fabric.api import sudo
from fabric.operations import sudo
sudo(cmd) # <-- add 'cmd' as a taint sink
Note that this sink is already recognized by the CodeQL Python analysis, but for this example, you could use the following data extension:
@@ -48,7 +48,7 @@ Note that this sink is already recognized by the CodeQL Python analysis, but for
pack: codeql/python-all
extensible: sinkModel
data:
- ["fabric", "Member[api].Member[sudo].Argument[0]", "command-injection"]
- ["fabric", "Member[operations].Member[sudo].Argument[0]", "command-injection"]
- Since we're adding a new sink, we add a tuple to the **sinkModel** extensible predicate.
@@ -56,8 +56,8 @@ Note that this sink is already recognized by the CodeQL Python analysis, but for
The string **"fabric"** means we start at the places where the codebase imports the package **fabric**.
- The second column is an access path that is evaluated from left to right, starting at the values that were identified by the first column.
- **Member[api]** selects accesses to the **api** package.
- **Member[sudo]** selects accesses to the **sudo** function in the **api** package.
- **Member[operations]** selects accesses to the **operations** module.
- **Member[sudo]** selects accesses to the **sudo** function in the **operations** module.
- **Argument[0]** selects the first argument to calls to that function.
- **command-injection** indicates that this is considered a sink for the command injection query.