hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Check os.open as well as os.chmod for weak file permissions.

Browse Source
This commit is contained in:
Mark Shannon
2019-01-28 14:26:16 +00:00
parent a3b5769c2c
commit 6d553ae2be
4 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
python/ql/src/Security/CWE-732/WeakFilePermissions.ql
View File

@@ -34,9 +34,20 @@ string permissive_permission(int p) {
world_permission(p) = 0 and result = "group " + access(group_permission(p))
}
from FunctionObject chmod, CallNode call, NumericObject num, string permission
where
predicate chmod_call(CallNode call, FunctionObject chmod, NumericObject num) {
any(ModuleObject os | os.getName() = "os").getAttribute("chmod") = chmod and
chmod.getACall() = call and call.getArg(1).refersTo(num) and
chmod.getACall() = call and call.getArg(1).refersTo(num)
}
predicate open_call(CallNode call, FunctionObject open, NumericObject num) {
any(ModuleObject os | os.getName() = "os").getAttribute("open") = open and
open.getACall() = call and call.getArg(2).refersTo(num)
}
from CallNode call, FunctionObject func, NumericObject num, string permission
where
(chmod_call(call, func, num) or open_call(call, func, num))
and
permission = permissive_permission(num.intValue())
select call, "Overly permissive mask in chmod sets file to " + permission + "."
select call, "Overly permissive mask in " + func.getName() + " sets file to " + permission + "."