hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix false positive and add test.

Browse Source
This commit is contained in:
Taus Brock-Nannestad
2019-03-21 14:10:05 +01:00
parent 9cb35a8ca9
commit 5eb63ae048
3 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/ql/src/Security/CWE-327/InsecureDefaultProtocol.ql
View File

@@ -27,6 +27,7 @@ CallNode unsafe_call(string method_name) {
or
result = ssl_Context_class().getACall() and
not exists(result.getArgByName("protocol")) and
not exists(result.getArg(0)) and
method_name = "ssl.SSLContext"
}

1
python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.expected
View File

@@ -11,3 +11,4 @@
| InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2_METHOD specified in call to pyOpenSSL.SSL.Context. |
| InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to deprecated method ssl.wrap_socket. |
| InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to ssl.SSLContext. |
| InsecureProtocol.py:52:1:52:33 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv23_METHOD specified in call to ssl.SSLContext. |

2
python/ql/test/query-tests/Security/CWE-327/InsecureProtocol.py
View File

@@ -48,3 +48,5 @@ from ssl import PROTOCOL_SSLv2
ssl.wrap_socket(ssl_version=PROTOCOL_SSLv2)
SSLContext(protocol=PROTOCOL_SSLv2)
# FP for insecure default
ssl.SSLContext(ssl.SSLv23_METHOD)