hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 02:44:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Port StackTraceExposure query

Browse Source 
using empty concept implementation
This commit is contained in:
Rasmus Lerchedahl Petersen
2021-02-03 08:39:41 +01:00
parent 77ae91c47d
commit 6a45f6e7e0
2 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
python/ql/src/Security/CWE-209/StackTraceExposure.ql
View File

@@ -13,19 +13,10 @@
*/
import python
import semmle.python.security.Paths
import semmle.python.security.Exceptions
import semmle.python.web.HttpResponse
import semmle.python.security.dataflow.StackTraceExposure
import DataFlow::PathGraph
class StackTraceExposureConfiguration extends TaintTracking::Configuration {
StackTraceExposureConfiguration() { this = "Stack trace exposure configuration" }
override predicate isSource(TaintTracking::Source source) { source instanceof ErrorInfoSource }
override predicate isSink(TaintTracking::Sink sink) { sink instanceof HttpResponseTaintSink }
}
from StackTraceExposureConfiguration config, TaintedPathSource src, TaintedPathSink sink
where config.hasFlowPath(src, sink)
select sink.getSink(), src, sink, "$@ may be exposed to an external user", src.getSource(),
from StackTraceExposureConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "$@ may be exposed to an external user", source.getNode(),
"Error information"

22
python/ql/src/semmle/python/security/dataflow/StackTraceExposure.qll Normal file
View File

@@ -0,0 +1,22 @@
/**
* Provides a taint-tracking configuration for detecting SQL injection
* vulnerabilities.
*/
import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.Concepts
/**
* A taint-tracking configuration for detecting SQL injection vulnerabilities.
*/
class StackTraceExposureConfiguration extends TaintTracking::Configuration {
StackTraceExposureConfiguration() { this = "StackTraceExposureConfiguration" }
override predicate isSource(DataFlow::Node source) { source instanceof ErrorInfoSource }
override predicate isSink(DataFlow::Node sink) {
sink = any(HTTP::Server::HttpResponse response).getBody()
}
}