hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model keyword args to json loads/dumps

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-05-10 14:33:27 +02:00
parent 784e0cdb96
commit 63f28d7d9b
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/src/semmle/python/frameworks/Stdlib.qll
View File

@@ -511,7 +511,7 @@ private module Stdlib {
override predicate mayExecuteInput() { none() }
override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("s")] }
override DataFlow::Node getOutput() { result = this }
@@ -525,7 +525,7 @@ private module Stdlib {
private class JsonDumpsCall extends Encoding::Range, DataFlow::CallCfgNode {
JsonDumpsCall() { this = json().getMember("dumps").getACall() }
override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("obj")] }
override DataFlow::Node getOutput() { result = this }

4
python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_json.py
View File

@@ -22,9 +22,9 @@ def test():
ensure_tainted(
encoded, # $ tainted
json.dumps(ts), # $ tainted
json.dumps(obj=ts), # $ MISSING: tainted
json.dumps(obj=ts), # $ tainted
json.loads(encoded), # $ tainted
json.loads(s=encoded), # $ MISSING: tainted
json.loads(s=encoded), # $ tainted
)
# load/dump with file-like