hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add tentative support for speculative taint flow.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2024-10-03 15:35:01 +02:00
parent 8eb0cb4c66
commit 7497d9530d
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll
View File

@@ -219,3 +219,27 @@ predicate asyncWithStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
contextManager.strictlyDominates(var)
)
}
import SpeculativeTaintFlow
private module SpeculativeTaintFlow {
private import semmle.python.dataflow.new.internal.DataFlowDispatch as DataFlowDispatch
private import semmle.python.dataflow.new.internal.DataFlowPublic as DataFlowPublic
predicate speculativeTaintStep(DataFlow::Node src, DataFlow::Node sink) {
exists(DataFlowDispatch::DataFlowCall call, DataFlowDispatch::ArgumentPosition argpos |
// TODO: exclude neutrals and anything that has QL modeling.
not exists(DataFlowDispatch::viableCallable(call)) and
call instanceof DataFlowDispatch::PotentialLibraryCall and
src.(DataFlowPublic::ArgumentNode).argumentOf(call, argpos)
|
not argpos.isSelf() and
sink.(DataFlowPublic::PostUpdateNode)
.getPreUpdateNode()
.(DataFlowPublic::ArgumentNode)
.argumentOf(call, any(DataFlowDispatch::ArgumentPosition qualpos | qualpos.isSelf()))
or
sink.(DataFlowDispatch::OutNode).getCall(_) = call
)
}
}