hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

python: add missing QlDoc

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2022-02-02 09:14:21 +01:00
parent 1e2428cb6b
commit 4ad99d9299
1 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
python/ql/lib/semmle/python/security/dataflow/LdapInjection.qll
View File

@@ -1,5 +1,9 @@
/**
* Provides a taint-tracking configuration for detecting LDAP injection vulnerabilities
* Provides taint-tracking configurations for detecting LDAP injection vulnerabilities
*
* Note, for performance reasons: only import this file if
* `LdapInjection::Configuration` is needed, otherwise
* `LdapInjectionCustomizations` should be imported instead.
*/
import python
@@ -8,9 +12,20 @@ import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
/**
* Provides aint-tracking configurations for detecting LDAP injection vulnerabilities.class
*
* Two configurations are provided. One is for detecting LDAP injection
* via the distinguished name (DN). The other is for detecting LDAP injection
* via the filter. These require different escapings.
*/
module LdapInjection {
import LdapInjectionCustomizations::LdapInjection
/**
* A taint-tracking configuration for detecting LDAP injection vulnerabilities
* via the distinguished name (DN) parameter of an LDAP search.
*/
class DnConfiguration extends TaintTracking::Configuration {
DnConfiguration() { this = "LdapDnInjection" }
@@ -25,6 +40,10 @@ module LdapInjection {
}
}
/**
* A taint-tracking configuration for detecting LDAP injection vulnerabilities
* via the filter parameter of an LDAP search.
*/
class FilterConfiguration extends TaintTracking::Configuration {
FilterConfiguration() { this = "LdapFilterInjection" }
@@ -41,6 +60,7 @@ module LdapInjection {
import DataFlow::PathGraph
/** Holds if there is an LDAP injection from `source` to `sink` */
predicate ldapInjection(DataFlow::PathNode source, DataFlow::PathNode sink) {
any(DnConfiguration dnConfig).hasFlowPath(source, sink)
or