mirror of
https://github.com/github/codeql.git
synced 2026-05-01 19:55:15 +02:00
Python: Model more file access from os module
This commit is contained in:
Rasmus Wriedt Larsen
@@ -276,19 +276,589 @@ private module StdlibPrivate {
|
||||
}
|
||||
|
||||
/**
|
||||
* The `os` module has multiple methods for getting the status of a file, like
|
||||
* a stat() system call.
|
||||
*
|
||||
* See:
|
||||
* - https://docs.python.org/3.10/library/os.html#os.stat
|
||||
* - https://docs.python.org/3.10/library/os.html#os.lstat
|
||||
* - https://docs.python.org/3.10/library/os.html#os.statvfs
|
||||
* Modeling of path related functions in the `os` module.
|
||||
* Wrapped in QL module to make it easy to fold/unfold.
|
||||
*/
|
||||
private class OsProbingCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsProbingCall() { this = os().getMember(["stat", "lstat", "statvfs"]).getACall() }
|
||||
private module OsFileSystemAccessModeling {
|
||||
/**
|
||||
* A call to the `os.fsencode` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.fsencode
|
||||
*/
|
||||
private class OsFsencodeCall extends Encoding::Range, DataFlow::CallCfgNode {
|
||||
OsFsencodeCall() { this = os().getMember("fsencode").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
override DataFlow::Node getAnInput() {
|
||||
result in [this.getArg(0), this.getArgByName("filename")]
|
||||
}
|
||||
|
||||
override DataFlow::Node getOutput() { result = this }
|
||||
|
||||
override string getFormat() { result = "filesystem" }
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.fsdecode` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.fsdecode
|
||||
*/
|
||||
private class OsFsdecodeCall extends Decoding::Range, DataFlow::CallCfgNode {
|
||||
OsFsdecodeCall() { this = os().getMember("fsdecode").getACall() }
|
||||
|
||||
override DataFlow::Node getAnInput() {
|
||||
result in [this.getArg(0), this.getArgByName("filename")]
|
||||
}
|
||||
|
||||
override DataFlow::Node getOutput() { result = this }
|
||||
|
||||
override string getFormat() { result = "filesystem" }
|
||||
|
||||
override predicate mayExecuteInput() { none() }
|
||||
}
|
||||
|
||||
/**
|
||||
* Additional taint step from a call to the `os.fspath` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.fspath
|
||||
*/
|
||||
private class OsFspathCallAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
|
||||
override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
||||
exists(DataFlow::CallCfgNode call |
|
||||
call = os().getMember("fspath").getACall() and
|
||||
nodeFrom in [call.getArg(0), call.getArgByName("path")] and
|
||||
nodeTo = call
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.open` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.open
|
||||
*/
|
||||
private class OsOpenCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsOpenCall() { this = os().getMember("open").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.access` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.access
|
||||
*/
|
||||
private class OsAccessCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsAccessCall() { this = os().getMember("access").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chdir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chdir
|
||||
*/
|
||||
private class OsChdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChdirCall() { this = os().getMember("chdir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chflags` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chflags
|
||||
*/
|
||||
private class OsChflagsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChflagsCall() { this = os().getMember("chflags").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chmod` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chmod
|
||||
*/
|
||||
private class OsChmodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChmodCall() { this = os().getMember("chmod").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chown` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chown
|
||||
*/
|
||||
private class OsChownCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChownCall() { this = os().getMember("chown").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chroot` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chroot
|
||||
*/
|
||||
private class OsChrootCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChrootCall() { this = os().getMember("chroot").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.lchflags` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.lchflags
|
||||
*/
|
||||
private class OsLchflagsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLchflagsCall() { this = os().getMember("lchflags").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.lchmod` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.lchmod
|
||||
*/
|
||||
private class OsLchmodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLchmodCall() { this = os().getMember("lchmod").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.lchown` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.lchown
|
||||
*/
|
||||
private class OsLchownCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLchownCall() { this = os().getMember("lchown").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.link` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.link
|
||||
*/
|
||||
private class OsLinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLinkCall() { this = os().getMember("link").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.listdir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.listdir
|
||||
*/
|
||||
private class OsListdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsListdirCall() { this = os().getMember("listdir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.lstat` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.lstat
|
||||
*/
|
||||
private class OsLstatCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLstatCall() { this = os().getMember("lstat").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.mkdir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.mkdir
|
||||
*/
|
||||
private class OsMkdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsMkdirCall() { this = os().getMember("mkdir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.makedirs` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.makedirs
|
||||
*/
|
||||
private class OsMakedirsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsMakedirsCall() { this = os().getMember("makedirs").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("name")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.mkfifo` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.mkfifo
|
||||
*/
|
||||
private class OsMkfifoCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsMkfifoCall() { this = os().getMember("mkfifo").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.mknod` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.mknod
|
||||
*/
|
||||
private class OsMknodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsMknodCall() { this = os().getMember("mknod").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.pathconf` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.pathconf
|
||||
*/
|
||||
private class OsPathconfCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsPathconfCall() { this = os().getMember("pathconf").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.readlink` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.readlink
|
||||
*/
|
||||
private class OsReadlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsReadlinkCall() { this = os().getMember("readlink").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.remove` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.remove
|
||||
*/
|
||||
private class OsRemoveCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRemoveCall() { this = os().getMember("remove").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.removedirs` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.removedirs
|
||||
*/
|
||||
private class OsRemovedirsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRemovedirsCall() { this = os().getMember("removedirs").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("name")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.rename` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.rename
|
||||
*/
|
||||
private class OsRenameCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRenameCall() { this = os().getMember("rename").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.renames` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.renames
|
||||
*/
|
||||
private class OsRenamesCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRenamesCall() { this = os().getMember("renames").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("old"), this.getArg(1), this.getArgByName("new")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.replace` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.replace
|
||||
*/
|
||||
private class OsReplaceCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsReplaceCall() { this = os().getMember("replace").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.rmdir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.rmdir
|
||||
*/
|
||||
private class OsRmdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRmdirCall() { this = os().getMember("rmdir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.scandir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.scandir
|
||||
*/
|
||||
private class OsScandirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsScandirCall() { this = os().getMember("scandir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.stat` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.stat
|
||||
*/
|
||||
private class OsStatCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsStatCall() { this = os().getMember("stat").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.statvfs` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.statvfs
|
||||
*/
|
||||
private class OsStatvfsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsStatvfsCall() { this = os().getMember("statvfs").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.symlink` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.symlink
|
||||
*/
|
||||
private class OsSymlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsSymlinkCall() { this = os().getMember("symlink").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.truncate` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.truncate
|
||||
*/
|
||||
private class OsTruncateCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsTruncateCall() { this = os().getMember("truncate").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.unlink` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.unlink
|
||||
*/
|
||||
private class OsUnlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsUnlinkCall() { this = os().getMember("unlink").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.utime` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.utime
|
||||
*/
|
||||
private class OsUtimeCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsUtimeCall() { this = os().getMember("utime").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.walk` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.walk
|
||||
*/
|
||||
private class OsWalkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsWalkCall() { this = os().getMember("walk").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("top")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.fwalk` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.fwalk
|
||||
*/
|
||||
private class OsFwalkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsFwalkCall() { this = os().getMember("fwalk").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("top")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.getxattr` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.getxattr
|
||||
*/
|
||||
private class OsGetxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsGetxattrCall() { this = os().getMember("getxattr").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.listxattr` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.listxattr
|
||||
*/
|
||||
private class OsListxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsListxattrCall() { this = os().getMember("listxattr").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.removexattr` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.removexattr
|
||||
*/
|
||||
private class OsRemovexattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRemovexattrCall() { this = os().getMember("removexattr").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.setxattr` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.setxattr
|
||||
*/
|
||||
private class OsSetxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsSetxattrCall() { this = os().getMember("setxattr").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.add_dll_directory` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.add_dll_directory
|
||||
*/
|
||||
private class OsAdd_dll_directoryCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsAdd_dll_directoryCall() { this = os().getMember("add_dll_directory").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.startfile` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.startfile
|
||||
*/
|
||||
private class OsStartfileCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsStartfileCall() { this = os().getMember("startfile").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -64,11 +64,11 @@ genericpath.exists(path="path") # $ getAPathArgument="path"
|
||||
|
||||
def test_fsencode_fsdecode():
|
||||
# notice that this does not make a file system access, but performs encoding/decoding.
|
||||
os.fsencode("filename") # $ MISSING: encodeInput="filename" encodeOutput=os.fsencode(..) encodeFormat=filesystem
|
||||
os.fsencode(filename="filename") # $ MISSING: encodeInput="filename" encodeOutput=os.fsencode(..) encodeFormat=filesystem
|
||||
os.fsencode("filename") # $ encodeInput="filename" encodeOutput=os.fsencode(..) encodeFormat=filesystem
|
||||
os.fsencode(filename="filename") # $ encodeInput="filename" encodeOutput=os.fsencode(..) encodeFormat=filesystem
|
||||
|
||||
os.fsdecode("filename") # $ MISSING: decodeInput="filename" decodeOutput=os.fsdecode(..) decodeFormat=filesystem
|
||||
os.fsdecode(filename="filename") # $ MISSING: decodeInput="filename" decodeOutput=os.fsdecode(..) decodeFormat=filesystem
|
||||
os.fsdecode("filename") # $ decodeInput="filename" decodeOutput=os.fsdecode(..) decodeFormat=filesystem
|
||||
os.fsdecode(filename="filename") # $ decodeInput="filename" decodeOutput=os.fsdecode(..) decodeFormat=filesystem
|
||||
|
||||
def test_fspath():
|
||||
# notice that this does not make a file system access, but returns the path
|
||||
@@ -76,91 +76,91 @@ def test_fspath():
|
||||
|
||||
ensure_tainted(
|
||||
TAINTED_STRING, # $ tainted
|
||||
os.fspath(TAINTED_STRING), # $ MISSING: tainted
|
||||
os.fspath(path=TAINTED_STRING), # $ MISSING: tainted
|
||||
os.fspath(TAINTED_STRING), # $ tainted
|
||||
os.fspath(path=TAINTED_STRING), # $ tainted
|
||||
)
|
||||
|
||||
os.open("path", os.O_RDONLY) # $ MISSING: getAPathArgument="path"
|
||||
os.open(path="path", flags=os.O_RDONLY) # $ MISSING: getAPathArgument="path"
|
||||
os.open("path", os.O_RDONLY) # $ getAPathArgument="path"
|
||||
os.open(path="path", flags=os.O_RDONLY) # $ getAPathArgument="path"
|
||||
|
||||
os.access("path", os.R_OK) # $ MISSING: getAPathArgument="path"
|
||||
os.access(path="path", mode=os.R_OK) # $ MISSING: getAPathArgument="path"
|
||||
os.access("path", os.R_OK) # $ getAPathArgument="path"
|
||||
os.access(path="path", mode=os.R_OK) # $ getAPathArgument="path"
|
||||
|
||||
os.chdir("path") # $ MISSING: getAPathArgument="path"
|
||||
os.chdir(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.chdir("path") # $ getAPathArgument="path"
|
||||
os.chdir(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.chflags("path", stat.UF_NODUMP) # $ MISSING: getAPathArgument="path"
|
||||
os.chflags(path="path", flags=stat.UF_NODUMP) # $ MISSING: getAPathArgument="path"
|
||||
os.chflags("path", stat.UF_NODUMP) # $ getAPathArgument="path"
|
||||
os.chflags(path="path", flags=stat.UF_NODUMP) # $ getAPathArgument="path"
|
||||
|
||||
os.chmod("path", 0o700) # $ MISSING: getAPathArgument="path"
|
||||
os.chmod(path="path", mode=0o700) # $ MISSING: getAPathArgument="path"
|
||||
os.chmod("path", 0o700) # $ getAPathArgument="path"
|
||||
os.chmod(path="path", mode=0o700) # $ getAPathArgument="path"
|
||||
|
||||
os.chown("path", -1, -1) # $ MISSING: getAPathArgument="path"
|
||||
os.chown(path="path", uid=-1, gid=-1) # $ MISSING: getAPathArgument="path"
|
||||
os.chown("path", -1, -1) # $ getAPathArgument="path"
|
||||
os.chown(path="path", uid=-1, gid=-1) # $ getAPathArgument="path"
|
||||
|
||||
# unix only
|
||||
os.chroot("path") # $ MISSING: getAPathArgument="path"
|
||||
os.chroot(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.chroot("path") # $ getAPathArgument="path"
|
||||
os.chroot(path="path") # $ getAPathArgument="path"
|
||||
|
||||
# unix only
|
||||
os.lchflags("path", stat.UF_NODUMP) # $ MISSING: getAPathArgument="path"
|
||||
os.lchflags(path="path", flags=stat.UF_NODUMP) # $ MISSING: getAPathArgument="path"
|
||||
os.lchflags("path", stat.UF_NODUMP) # $ getAPathArgument="path"
|
||||
os.lchflags(path="path", flags=stat.UF_NODUMP) # $ getAPathArgument="path"
|
||||
|
||||
# unix only
|
||||
os.lchmod("path", 0o700) # $ MISSING: getAPathArgument="path"
|
||||
os.lchmod(path="path", mode=0o700) # $ MISSING: getAPathArgument="path"
|
||||
os.lchmod("path", 0o700) # $ getAPathArgument="path"
|
||||
os.lchmod(path="path", mode=0o700) # $ getAPathArgument="path"
|
||||
|
||||
# unix only
|
||||
os.lchown("path", -1, -1) # $ MISSING: getAPathArgument="path"
|
||||
os.lchown(path="path", uid=-1, gid=-1) # $ MISSING: getAPathArgument="path"
|
||||
os.lchown("path", -1, -1) # $ getAPathArgument="path"
|
||||
os.lchown(path="path", uid=-1, gid=-1) # $ getAPathArgument="path"
|
||||
|
||||
os.link("src", "dst") # $ MISSING: getAPathArgument="src" getAPathArgument="dst"
|
||||
os.link(src="src", dst="dst") # $ MISSING: getAPathArgument="src" getAPathArgument="dst"
|
||||
os.link("src", "dst") # $ getAPathArgument="src" getAPathArgument="dst"
|
||||
os.link(src="src", dst="dst") # $ getAPathArgument="src" getAPathArgument="dst"
|
||||
|
||||
os.listdir("path") # $ MISSING: getAPathArgument="path"
|
||||
os.listdir(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.listdir("path") # $ getAPathArgument="path"
|
||||
os.listdir(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.lstat("path") # $ getAPathArgument="path"
|
||||
os.lstat(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.mkdir("path") # $ MISSING: getAPathArgument="path"
|
||||
os.mkdir(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.mkdir("path") # $ getAPathArgument="path"
|
||||
os.mkdir(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.makedirs("name") # $ MISSING: getAPathArgument="name"
|
||||
os.makedirs(name="name") # $ MISSING: getAPathArgument="name"
|
||||
os.makedirs("name") # $ getAPathArgument="name"
|
||||
os.makedirs(name="name") # $ getAPathArgument="name"
|
||||
|
||||
os.mkfifo("path") # $ MISSING: getAPathArgument="path"
|
||||
os.mkfifo(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.mkfifo("path") # $ getAPathArgument="path"
|
||||
os.mkfifo(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.mknod("path") # $ MISSING: getAPathArgument="path"
|
||||
os.mknod(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.mknod("path") # $ getAPathArgument="path"
|
||||
os.mknod(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.pathconf("path", "name") # $ MISSING: getAPathArgument="path"
|
||||
os.pathconf(path="path", name="name") # $ MISSING: getAPathArgument="path"
|
||||
os.pathconf("path", "name") # $ getAPathArgument="path"
|
||||
os.pathconf(path="path", name="name") # $ getAPathArgument="path"
|
||||
|
||||
os.readlink("path") # $ MISSING: getAPathArgument="path"
|
||||
os.readlink(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.readlink("path") # $ getAPathArgument="path"
|
||||
os.readlink(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.remove("path") # $ MISSING: getAPathArgument="path"
|
||||
os.remove(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.remove("path") # $ getAPathArgument="path"
|
||||
os.remove(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.removedirs("name") # $ MISSING: getAPathArgument="name"
|
||||
os.removedirs(name="name") # $ MISSING: getAPathArgument="name"
|
||||
os.removedirs("name") # $ getAPathArgument="name"
|
||||
os.removedirs(name="name") # $ getAPathArgument="name"
|
||||
|
||||
os.rename("src", "dst") # $ MISSING: getAPathArgument="src" getAPathArgument="dst"
|
||||
os.rename(src="src", dst="dst") # $ MISSING: getAPathArgument="src" getAPathArgument="dst"
|
||||
os.rename("src", "dst") # $ getAPathArgument="src" getAPathArgument="dst"
|
||||
os.rename(src="src", dst="dst") # $ getAPathArgument="src" getAPathArgument="dst"
|
||||
|
||||
os.renames("old", "new") # $ MISSING: getAPathArgument="old" getAPathArgument="new"
|
||||
os.renames(old="old", new="new") # $ MISSING: getAPathArgument="old" getAPathArgument="new"
|
||||
os.renames("old", "new") # $ getAPathArgument="old" getAPathArgument="new"
|
||||
os.renames(old="old", new="new") # $ getAPathArgument="old" getAPathArgument="new"
|
||||
|
||||
os.replace("src", "dst") # $ MISSING: getAPathArgument="src" getAPathArgument="dst"
|
||||
os.replace(src="src", dst="dst") # $ MISSING: getAPathArgument="src" getAPathArgument="dst"
|
||||
os.replace("src", "dst") # $ getAPathArgument="src" getAPathArgument="dst"
|
||||
os.replace(src="src", dst="dst") # $ getAPathArgument="src" getAPathArgument="dst"
|
||||
|
||||
os.rmdir("path") # $ MISSING: getAPathArgument="path"
|
||||
os.rmdir(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.rmdir("path") # $ getAPathArgument="path"
|
||||
os.rmdir(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.scandir("path") # $ MISSING: getAPathArgument="path"
|
||||
os.scandir(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.scandir("path") # $ getAPathArgument="path"
|
||||
os.scandir(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.stat("path") # $ getAPathArgument="path"
|
||||
os.stat(path="path") # $ getAPathArgument="path"
|
||||
@@ -168,47 +168,47 @@ os.stat(path="path") # $ getAPathArgument="path"
|
||||
os.statvfs("path") # $ getAPathArgument="path"
|
||||
os.statvfs(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.symlink("src", "dst") # $ MISSING: getAPathArgument="src" getAPathArgument="dst"
|
||||
os.symlink(src="src", dst="dst") # $ MISSING: getAPathArgument="src" getAPathArgument="dst"
|
||||
os.symlink("src", "dst") # $ getAPathArgument="src" getAPathArgument="dst"
|
||||
os.symlink(src="src", dst="dst") # $ getAPathArgument="src" getAPathArgument="dst"
|
||||
|
||||
os.truncate("path", 42) # $ MISSING: getAPathArgument="path"
|
||||
os.truncate(path="path", length=42) # $ MISSING: getAPathArgument="path"
|
||||
os.truncate("path", 42) # $ getAPathArgument="path"
|
||||
os.truncate(path="path", length=42) # $ getAPathArgument="path"
|
||||
|
||||
os.unlink("path") # $ MISSING: getAPathArgument="path"
|
||||
os.unlink(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.unlink("path") # $ getAPathArgument="path"
|
||||
os.unlink(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.utime("path") # $ MISSING: getAPathArgument="path"
|
||||
os.utime(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.utime("path") # $ getAPathArgument="path"
|
||||
os.utime(path="path") # $ getAPathArgument="path"
|
||||
|
||||
os.walk("top") # $ MISSING: getAPathArgument="top"
|
||||
os.walk(top="top") # $ MISSING: getAPathArgument="top"
|
||||
os.walk("top") # $ getAPathArgument="top"
|
||||
os.walk(top="top") # $ getAPathArgument="top"
|
||||
|
||||
os.fwalk("top") # $ MISSING: getAPathArgument="top"
|
||||
os.fwalk(top="top") # $ MISSING: getAPathArgument="top"
|
||||
os.fwalk("top") # $ getAPathArgument="top"
|
||||
os.fwalk(top="top") # $ getAPathArgument="top"
|
||||
|
||||
# Linux only
|
||||
os.getxattr("path", "attribute") # $ MISSING: getAPathArgument="path"
|
||||
os.getxattr(path="path", attribute="attribute") # $ MISSING: getAPathArgument="path"
|
||||
os.getxattr("path", "attribute") # $ getAPathArgument="path"
|
||||
os.getxattr(path="path", attribute="attribute") # $ getAPathArgument="path"
|
||||
|
||||
# Linux only
|
||||
os.listxattr("path") # $ MISSING: getAPathArgument="path"
|
||||
os.listxattr(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.listxattr("path") # $ getAPathArgument="path"
|
||||
os.listxattr(path="path") # $ getAPathArgument="path"
|
||||
|
||||
# Linux only
|
||||
os.removexattr("path", "attribute") # $ MISSING: getAPathArgument="path"
|
||||
os.removexattr(path="path", attribute="attribute") # $ MISSING: getAPathArgument="path"
|
||||
os.removexattr("path", "attribute") # $ getAPathArgument="path"
|
||||
os.removexattr(path="path", attribute="attribute") # $ getAPathArgument="path"
|
||||
|
||||
# Linux only
|
||||
os.setxattr("path", "attribute", "value") # $ MISSING: getAPathArgument="path"
|
||||
os.setxattr(path="path", attribute="attribute", value="value") # $ MISSING: getAPathArgument="path"
|
||||
os.setxattr("path", "attribute", "value") # $ getAPathArgument="path"
|
||||
os.setxattr(path="path", attribute="attribute", value="value") # $ getAPathArgument="path"
|
||||
|
||||
# Windows only
|
||||
os.add_dll_directory("path") # $ MISSING: getAPathArgument="path"
|
||||
os.add_dll_directory(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.add_dll_directory("path") # $ getAPathArgument="path"
|
||||
os.add_dll_directory(path="path") # $ getAPathArgument="path"
|
||||
|
||||
# for `os.exec*`, `os.spawn*`, and `os.posix_spawn*` functions, see the
|
||||
# `SystemCommandExecution.py` file.
|
||||
|
||||
# Windows only
|
||||
os.startfile("path") # $ MISSING: getAPathArgument="path"
|
||||
os.startfile(path="path") # $ MISSING: getAPathArgument="path"
|
||||
os.startfile("path") # $ getAPathArgument="path"
|
||||
os.startfile(path="path") # $ getAPathArgument="path"
|
||||
|
||||
Reference in New Issue
Block a user