hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 10:23:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Properly model xml.etree

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2022-03-03 15:06:55 +01:00
parent 703e3e8a0f
commit 61291936bf
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/src/experimental/semmle/python/frameworks/Xml.qll
View File

@@ -24,7 +24,9 @@ private module Xml {
override DataFlow::Node getAnInput() { none() }
override predicate vulnerable(XML::XMLVulnerabilityKind kind) { none() }
override predicate vulnerable(XML::XMLVulnerabilityKind kind) {
kind.isBillionLaughs() or kind.isQuadraticBlowup()
}
}
/**
@@ -58,6 +60,9 @@ private module Xml {
override DataFlow::Node getAnInput() { result = this.getArg(0) }
override predicate vulnerable(XML::XMLVulnerabilityKind kind) {
not exists(this.getArgByName("parser")) and
(kind.isBillionLaughs() or kind.isQuadraticBlowup())
or
exists(XML::XMLParser xmlParser |
xmlParser = this.getArgByName("parser").getALocalSource() and xmlParser.vulnerable(kind)
)