hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-11 09:49:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python : Add Flask sinks for path injection query

Browse Source
This commit is contained in:
Porcuiney Hairs
2021-07-20 02:03:48 +05:30
committed by Porcupiney Hairs
parent 0d161bec7a
commit 4fd3f212f8
2 changed files with 42 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
python/ql/lib/semmle/python/frameworks/Flask.qll
View File

@@ -519,4 +519,34 @@ module Flask {
override DataFlow::Node getValueArg() { none() }
}
/**
* A `send_from_directory` call considered a sink for file system access vulnerabilities.
*
* See https://flask.palletsprojects.com/en/1.1.x/api/#flask.send_from_directory
*/
class FlaskSendFromDirectory extends FileSystemAccess::Range, DataFlow::CallCfgNode {
FlaskSendFromDirectory() {
this = API::moduleImport("flask").getMember("send_from_directory").getACall()
}
override DataFlow::Node getAPathArgument() {
result in [this.getArg(_), this.getArgByName(["directory", "filename"])]
}
}
/**
* A `send_file` call considered a sink for file system access vulnerabilities.
*
* See https://flask.palletsprojects.com/en/1.1.x/api/#flask.send_file
*/
class FlaskSendFile extends FileSystemAccess::Range, DataFlow::CallCfgNode {
FlaskSendFile() {
this = API::moduleImport("flask").getMember("send_file").getACall()
}
override DataFlow::Node getAPathArgument() {
result in [this.getArg(0), this.getArgByName("filename_or_fp")]
}
}
}