hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Improve full/partial SSRF split

Browse Source 
Now full-ssrf will only alert if **all** URL parts are fully
user-controlled.
This commit is contained in:
Rasmus Wriedt Larsen
2021-12-16 22:19:41 +01:00
parent cb934e17b1
commit 4b5599fe17
5 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
python/ql/src/Security/CWE-918/PartialServerSideRequestForgery.ql
View File

@@ -15,12 +15,11 @@ import semmle.python.security.dataflow.ServerSideRequestForgery
import DataFlow::PathGraph
from
FullServerSideRequestForgery::Configuration fullConfig,
PartialServerSideRequestForgery::Configuration partialConfig, DataFlow::PathNode source,
DataFlow::PathNode sink, HTTP::Client::Request request
where
request = sink.getNode().(PartialServerSideRequestForgery::Sink).getRequest() and
partialConfig.hasFlowPath(source, sink) and
not fullConfig.hasFlow(source.getNode(), sink.getNode())
not fullyControlledRequest(request)
select request, source, sink, "Part of the URL of this request depends on $@.", source.getNode(),
"a user-provided value"