hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Use new taint-tracking query in unsafe deserialization query.

Browse Source
This commit is contained in:
Mark Shannon
2019-03-06 15:36:55 +00:00
parent 3c1a5bb046
commit 61e6ae7c4a
6 changed files with 32 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
python/ql/src/Security/CWE-502/UnsafeDeserialization.ql
View File

@@ -24,7 +24,16 @@ import semmle.python.security.injection.Pickle
import semmle.python.security.injection.Marshal
import semmle.python.security.injection.Yaml
class UnsafeDeserializationConfiguration extends TaintTracking::Configuration {
from TaintedPathSource src, TaintedPathSink sink
where src.flowsTo(sink)
UnsafeDeserializationConfiguration() { this = "Unsafe deserialization configuration" }
override predicate isSource(TaintTracking::Source source) { source.isSourceOf(any(UntrustedStringKind u)) }
override predicate isSink(TaintTracking::Sink sink) { sink instanceof DeserializationSink }
}
from UnsafeDeserializationConfiguration config, TaintedPathSource src, TaintedPathSink sink
where config.hasFlowPath(src, sink)
select sink.getSink(), src, sink, "Deserializing of $@.", src.getSource(), "untrusted input"

14
python/ql/src/semmle/python/security/injection/Deserialization.qll Normal file
View File

@@ -0,0 +1,14 @@
import python
import semmle.python.security.TaintTracking
/** `pickle.loads(untrusted)` vulnerability. */
abstract class DeserializationSink extends TaintSink {
bindingset[this]
DeserializationSink() {
this = this
}
}

3
python/ql/src/semmle/python/security/injection/Marshal.qll
View File

@@ -9,6 +9,7 @@ import python
import semmle.python.security.TaintTracking
import semmle.python.security.strings.Untrusted
import semmle.python.security.injection.Deserialization
private FunctionObject marshalLoads() {
@@ -18,7 +19,7 @@ private FunctionObject marshalLoads() {
/** A taint sink that is potentially vulnerable to malicious marshaled objects.
* The `vuln` in `marshal.loads(vuln)`. */
class UnmarshalingNode extends TaintSink {
class UnmarshalingNode extends DeserializationSink {
override string toString() { result = "unmarshaling vulnerability" }

1
python/ql/src/semmle/python/security/injection/Pickle.qll
View File

@@ -9,6 +9,7 @@ import python
import semmle.python.security.TaintTracking
import semmle.python.security.strings.Untrusted
import semmle.python.security.injection.Deserialization
private ModuleObject pickleModule() {

3
python/ql/src/semmle/python/security/injection/Xml.qll
View File

@@ -8,6 +8,7 @@ import python
import semmle.python.security.TaintTracking
import semmle.python.security.strings.Untrusted
import semmle.python.security.injection.Deserialization
private ModuleObject xmlElementTreeModule() {
@@ -73,7 +74,7 @@ class ExternalXmlString extends ExternalStringKind {
/** A call to an XML library function that is potentially vulnerable to a
* specially crafted XML string.
*/
class XmlLoadNode extends TaintSink {
class XmlLoadNode extends DeserializationSink {
override string toString() { result = "xml.load vulnerability" }

3
python/ql/src/semmle/python/security/injection/Yaml.qll
View File

@@ -10,6 +10,7 @@ import python
import semmle.python.security.TaintTracking
import semmle.python.security.strings.Untrusted
import semmle.python.security.injection.Deserialization
private FunctionObject yamlLoad() {
@@ -17,7 +18,7 @@ private FunctionObject yamlLoad() {
}
/** `yaml.load(untrusted)` vulnerability. */
class YamlLoadNode extends TaintSink {
class YamlLoadNode extends DeserializationSink {
override string toString() { result = "yaml.load vulnerability" }