hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into python-mutating-descriptor

Browse Source
This commit is contained in:
Mark Shannon
2019-01-29 14:46:33 +00:00
committed by GitHub
parent 3992346add d776d9f903
commit 7fe3c3d516
94 changed files with 2500 additions and 1009 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
python/ql/src/Expressions/IsComparisons.qll
View File

@@ -107,6 +107,20 @@ predicate invalid_portable_is_comparison(Compare comp, Cmpop op, ClassObject cls
left.refersTo(obj) and right.refersTo(obj) and
exists(ImmutableLiteral il | il.getLiteralObject() = obj)
)
and
/* OK to use 'is' when comparing with a member of an enum */
not exists(Expr left, Expr right, AstNode origin |
comp.compares(left, op, right) and
enum_member(origin) |
left.refersTo(_, origin) or right.refersTo(_, origin)
)
}
private predicate enum_member(AstNode obj) {
exists(ClassObject cls, AssignStmt asgn |
cls.getASuperType().getName() = "Enum" |
cls.getPyClass() = asgn.getScope() and
asgn.getValue() = obj
)
}

26
python/ql/src/Security/CWE-732/WeakFilePermissions.qhelp Normal file
View File

@@ -0,0 +1,26 @@
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
<qhelp>
<overview>
<p>
When creating a file POSIX systems allow permissions to be specified
for owner, group and others separately. Permissions should be kept as
strict as possible, preventing access to the files contents by other users.
</p>
</overview>
<recommendation>
<p>
Restrict the file permissions of files to prevent any but the owner being able to read or write to that file
</p>
</recommendation>
<references>
<li>
Wikipedia:
<a href="https://en.wikipedia.org/wiki/File_system_permissions">File system permissions</a>.
</li>
</references>
</qhelp>

53
python/ql/src/Security/CWE-732/WeakFilePermissions.ql Normal file
View File

@@ -0,0 +1,53 @@
/**
* @name Overly permissive file permissions
* @description Allowing files to be readable or writable by users other than the owner may allow sensitive information to be accessed.
* @kind problem
* @id py/overly-permissive-file
* @problem.severity warning
* @sub-severity high
* @precision medium
* @tags external/cwe/cwe-732
* security
*/
import python
bindingset[p]
int world_permission(int p) {
result = p % 8
}
bindingset[p]
int group_permission(int p) {
result = (p/8) % 8
}
bindingset[p]
string access(int p) {
p%4 >= 2 and result = "writable" or
p%4 < 2 and p != 0 and result = "readable"
}
bindingset[p]
string permissive_permission(int p) {
result = "world " + access(world_permission(p))
or
world_permission(p) = 0 and result = "group " + access(group_permission(p))
}
predicate chmod_call(CallNode call, FunctionObject chmod, NumericObject num) {
any(ModuleObject os | os.getName() = "os").getAttribute("chmod") = chmod and
chmod.getACall() = call and call.getArg(1).refersTo(num)
}
predicate open_call(CallNode call, FunctionObject open, NumericObject num) {
any(ModuleObject os | os.getName() = "os").getAttribute("open") = open and
open.getACall() = call and call.getArg(2).refersTo(num)
}
from CallNode call, FunctionObject func, NumericObject num, string permission
where
(chmod_call(call, func, num) or open_call(call, func, num))
and
permission = permissive_permission(num.intValue())
select call, "Overly permissive mask in " + func.getName() + " sets file to " + permission + "."

7
python/ql/src/semmle/python/Variables.qll
View File

@@ -4,6 +4,13 @@ import python
/** A variable, either a global or local variable (including parameters) */
class Variable extends @py_variable {
Variable() {
exists(string name |
variable(this, _, name) and
not name = "*" and not name = "$"
)
}
/** Gets the identifier (name) of this variable */
string getId() {
variable(this, _, result)

57
python/ql/src/semmle/python/dataflow/SsaDefinitions.qll
View File

@@ -26,7 +26,11 @@ abstract class PythonSsaSourceVariable extends SsaSourceVariable {
}
override string getName() {
result = this.(Variable).getId()
variable(this, _, result)
}
Scope getScope() {
variable(this, result, _)
}
abstract ControlFlowNode getAnImplicitUse();
@@ -46,7 +50,7 @@ abstract class PythonSsaSourceVariable extends SsaSourceVariable {
/* Add a use at the end of scope for all variables to keep them live
* This is necessary for taint-tracking.
*/
result = this.(Variable).getScope().getANormalExit()
result = this.getScope().getANormalExit()
}
override predicate hasDefiningNode(ControlFlowNode def) {
@@ -107,7 +111,6 @@ class FunctionLocalVariable extends PythonSsaSourceVariable {
}
override ControlFlowNode getScopeEntryDefinition() {
not this.(LocalVariable).getId() = "*" and
exists(Scope s |
s.getEntryNode() = result |
s = this.(LocalVariable).getScope() and
@@ -146,7 +149,6 @@ class NonLocalVariable extends PythonSsaSourceVariable {
}
override CallNode redefinedAtCallSite() {
not this.(LocalVariable).getId() = "*" and
result.getScope().getScope*() = this.(LocalVariable).getScope()
}
@@ -163,7 +165,6 @@ class ClassLocalVariable extends PythonSsaSourceVariable {
}
override ControlFlowNode getScopeEntryDefinition() {
not this.(LocalVariable).getId() = "*" and
result = this.(LocalVariable).getScope().getEntryNode()
}
@@ -235,7 +236,6 @@ class ModuleVariable extends PythonSsaSourceVariable {
}
override ControlFlowNode getScopeEntryDefinition() {
not this.(GlobalVariable).getId() = "*" and
exists(Scope s |
s.getEntryNode() = result |
/* Module entry point */
@@ -253,13 +253,6 @@ class ModuleVariable extends PythonSsaSourceVariable {
this = scope.getOuterVariable(_) or
this.(Variable).getAUse().getScope() = scope
)
or
this.(GlobalVariable).getId() = "*" and
exists(Scope s |
s.getEntryNode() = result and
this.(Variable).getScope() = s and
exists(ImportStar is | is.getScope() = s)
)
}
override CallNode redefinedAtCallSite() { none() }
@@ -307,6 +300,29 @@ class EscapingGlobalVariable extends ModuleVariable {
}
class SpecialSsaSourceVariable extends PythonSsaSourceVariable {
SpecialSsaSourceVariable() {
variable(this, _, "*") or variable(this, _, "$")
}
override ControlFlowNode getAnImplicitUse() {
exists(ImportTimeScope s |
result = s.getANormalExit() and this.getScope() = s
)
}
override ControlFlowNode getScopeEntryDefinition() {
/* Module entry point */
this.getScope().getEntryNode() = result
}
override CallNode redefinedAtCallSite() {
result.(CallNode).getScope().getScope*() = this.(GlobalVariable).getScope()
}
}
private predicate variable_or_attribute_defined_out_of_scope(Variable v) {
exists(NameNode n | n.defines(v) and not n.getScope() = v.getScope())
or
@@ -330,7 +346,7 @@ cached module SsaSource {
/** Holds if `v` is used as the receiver in a method call. */
cached predicate method_call_refinement(Variable v, ControlFlowNode use, CallNode call) {
use = v.getAUse() and
use = v.getAUse() and
call.getFunction().(AttrNode).getObject() = use
}
@@ -387,16 +403,17 @@ cached module SsaSource {
/** Holds if the name of `var` refers to a submodule of a package and `f` is the entry point
* to the __init__ module of that package.
*/
cached predicate init_module_submodule_defn(Variable var, ControlFlowNode f) {
cached predicate init_module_submodule_defn(PythonSsaSourceVariable var, ControlFlowNode f) {
var instanceof GlobalVariable and
exists(Module init |
init.isPackageInit() and exists(init.getPackage().getSubModule(var.getId())) and
var instanceof GlobalVariable and init.getEntryNode() = f and
init.isPackageInit() and exists(init.getPackage().getSubModule(var.getName())) and
init.getEntryNode() = f and
var.getScope() = init
)
}
/** Holds if the `v` is in scope at a `from import ... *` and may thus be redefined by that statement */
cached predicate import_star_refinement(Variable v, ControlFlowNode use, ControlFlowNode def) {
cached predicate import_star_refinement(PythonSsaSourceVariable v, ControlFlowNode use, ControlFlowNode def) {
use = def and def instanceof ImportStarNode
and
(
@@ -443,7 +460,7 @@ cached module SsaSource {
}
private predicate refinement(Variable v, ControlFlowNode use, ControlFlowNode def) {
private predicate refinement(PythonSsaSourceVariable v, ControlFlowNode use, ControlFlowNode def) {
SsaSource::import_star_refinement(v, use, def)
or
SsaSource::attribute_assignment_refinement(v, use, def)
@@ -456,5 +473,5 @@ private predicate refinement(Variable v, ControlFlowNode use, ControlFlowNode de
or
SsaSource::method_call_refinement(v, use, def)
or
def = v.(PythonSsaSourceVariable).redefinedAtCallSite() and def = use
def = v.redefinedAtCallSite() and def = use
}

120
python/ql/src/semmle/python/pointsto/PointsTo.qll
View File

@@ -119,7 +119,7 @@ module PointsTo {
or
exists(Module init |
init = package.getInitModule().getModule() |
not exists(Variable v | v.getScope() = init | v.getId() = name or v.getId() = "*")
not exists(PythonSsaSourceVariable v | v.getScope() = init | v.getName() = name or v.getName() = "*")
or
exists(EssaVariable v, PointsToContext imp |
v.getScope() = init and v.getName() = "*" and v.getAUse() = init.getANormalExit() |
@@ -139,15 +139,15 @@ module PointsTo {
var.getSourceVariable().getName() = name and
ssa_variable_points_to(var, imp, obj, cls, orig) and
imp.isImport() and
not obj = undefinedVariable() |
obj != undefinedVariable() |
origin = origin_from_object_or_here(orig, exit)
)
or
not exists(EssaVariable var | var.getAUse() = m.getANormalExit() and var.getSourceVariable().getName() = name) and
exists(EssaVariable var, PointsToContext imp |
var.getAUse() = m.getANormalExit() and var.getSourceVariable().getName() = "*" |
var.getAUse() = m.getANormalExit() and var.getName() = "*" |
SSA::ssa_variable_named_attribute_points_to(var, imp, name, obj, cls, origin) and
imp.isImport() and not obj = undefinedVariable()
imp.isImport() and obj != undefinedVariable()
)
}
@@ -257,7 +257,7 @@ module PointsTo {
/** Holds if `f` is the instantiation of an object, `cls(...)`. */
cached predicate instantiation(CallNode f, PointsToContext context, ClassObject cls) {
points_to(f.getFunction(), context, cls, _, _) and
not cls = theTypeType() and
cls != theTypeType() and
Types::callToClassWillReturnInstance(cls)
}
@@ -312,7 +312,7 @@ module PointsTo {
)
or
exists(Object obj |
not obj = undefinedVariable() and
obj != undefinedVariable() and
py_module_attributes(mod.getModule(), name, obj, _, _)
) and result = true
or
@@ -345,7 +345,7 @@ module PointsTo {
private boolean package_exports_boolean(PackageObject pack, string name) {
explicitly_imported(pack.submodule(name)) and
(
not exists(pack.getInitModule())
pack.hasNoInitModule()
or
exists(ModuleObject init |
pack.getInitModule() = init |
@@ -381,9 +381,11 @@ module PointsTo {
exists(Object value |
points_to(guard.getLastNode(), context, value, _, _)
|
guard.controls(b, true) and not value.booleanValue() = false
guard.controls(b, _) and value.maybe()
or
guard.controls(b, false) and not value.booleanValue() = true
guard.controls(b, true) and value.booleanValue() = true
or
guard.controls(b, false) and value.booleanValue() = false
)
or
/* Assume the true edge of an assert is reachable (except for assert 0/False) */
@@ -402,9 +404,11 @@ module PointsTo {
exists(ConditionBlock guard, Object value |
points_to(guard.getLastNode(), context, value, _, _)
|
guard.controlsEdge(pred, succ, true) and not value.booleanValue() = false
guard.controlsEdge(pred, succ, _) and value.maybe()
or
guard.controlsEdge(pred, succ, false) and not value.booleanValue() = true
guard.controlsEdge(pred, succ, true) and value.booleanValue() = true
or
guard.controlsEdge(pred, succ, false) and value.booleanValue() = false
)
}
@@ -553,7 +557,7 @@ module PointsTo {
/** Gets an object pointed to by a use (of a variable). */
private predicate use_points_to(NameNode f, PointsToContext context, Object value, ClassObject cls, ControlFlowNode origin) {
exists(ObjectOrCfg origin_or_obj |
not value = undefinedVariable() and
value != undefinedVariable() and
use_points_to_maybe_origin(f, context, value, cls, origin_or_obj) |
origin = origin_from_object_or_here(origin_or_obj, f)
)
@@ -577,7 +581,7 @@ module PointsTo {
pragma [noinline]
private predicate class_or_module_attribute(Object obj, string name, Object value, ClassObject cls, ObjectOrCfg orig) {
/* Normal class attributes */
Types::class_attribute_lookup(obj, name, value, cls, orig) and not cls = theStaticMethodType() and not cls = theClassMethodType()
Types::class_attribute_lookup(obj, name, value, cls, orig) and cls != theStaticMethodType() and cls != theClassMethodType()
or
/* Static methods of the class */
exists(CallNode sm | Types::class_attribute_lookup(obj, name, sm, theStaticMethodType(), _) and sm.getArg(0) = value and cls = thePyFunctionType() and orig = value)
@@ -853,9 +857,13 @@ module PointsTo {
exists(Object operand |
points_to(f.getOperand(), context, operand, _, _)
|
not operand.booleanValue() = true and value = theTrueObject()
operand.maybe() and value = theTrueObject()
or
not operand.booleanValue() = false and value = theFalseObject()
operand.maybe() and value = theFalseObject()
or
operand.booleanValue() = false and value = theTrueObject()
or
operand.booleanValue() = true and value = theFalseObject()
)
}
@@ -1003,17 +1011,18 @@ module PointsTo {
pragma [noinline]
predicate call_points_to_builtin_function(CallNode f, PointsToContext context, Object value, ClassObject cls, ControlFlowNode origin) {
exists(BuiltinCallable b |
not b = builtin_object("isinstance") and
not b = builtin_object("issubclass") and
not b = builtin_object("callable") and
b != builtin_object("isinstance") and
b != builtin_object("issubclass") and
b != builtin_object("callable") and
f = get_a_call(b, context) and
cls = b.getAReturnType()
) and
f = origin and
if cls = theNoneType() then
value = theNoneObject()
else
value = f
(
cls = theNoneType() and value = theNoneObject()
or
cls != theNoneType() and value = f
)
}
/** Holds if call is to an object that always returns its first argument.
@@ -1160,7 +1169,7 @@ module PointsTo {
cls != theSuperType() and
exists(Object o |
/* list.__init__() is not a call to type.__init__() */
not o instanceof ClassObject |
o.notClass() |
points_to(n.(AttrNode).getObject(name), context, o, cls, _)
)
or
@@ -1203,12 +1212,14 @@ module PointsTo {
/** Holds if `func` implicitly returns the `None` object */
predicate implicitly_returns(PyFunctionObject func, Object none_, ClassObject noneType) {
noneType = theNoneType() and not func.getFunction().isGenerator() and none_ = theNoneObject() and
(
not exists(func.getAReturnedNode()) and exists(func.getFunction().getANormalExit())
or
exists(Return ret | ret.getScope() = func.getFunction() and not exists(ret.getValue()))
)
noneType = theNoneType() and none_ = theNoneObject() and
exists(Function f |
f = func.getFunction() and not f.isGenerator()
|
not exists(Return ret | ret.getScope() = f) and exists(f.getANormalExit())
or
exists(Return ret | ret.getScope() = f and not exists(ret.getValue()))
)
}
}
@@ -1244,7 +1255,10 @@ module PointsTo {
* is available to all functions. Although not strictly true, this gives less surprising
* results in practice. */
pred_context.isMain() and pred_scope instanceof Module and succ_context.fromRuntime() and
not strictcount(pred_var.getSourceVariable().(Variable).getAStore()) > 1
exists(Variable v |
v = pred_var.getSourceVariable() and
not strictcount(v.getAStore()) > 1
)
)
or
exists(NonEscapingGlobalVariable var |
@@ -1571,8 +1585,8 @@ module PointsTo {
deco = f.getADecorator().getAFlowNode() |
exists(Object o |
points_to(deco, _, o, _, _) |
not o = theStaticMethodType() and
not o = theClassMethodType()
o != theStaticMethodType() and
o != theClassMethodType()
)
or not deco instanceof NameNode
)
@@ -1589,7 +1603,7 @@ module PointsTo {
|
obj instanceof ClassObject and value = obj and cls = objcls
or
not obj instanceof ClassObject and value = objcls and cls = Types::class_get_meta_class(objcls)
obj.notClass() and value = objcls and cls = Types::class_get_meta_class(objcls)
)
}
@@ -1707,16 +1721,17 @@ module PointsTo {
call = def.getCall() and
var = def.getSourceVariable() and
context.untrackableCall(call) and
exists(PyFunctionObject modifier |
exists(PyFunctionObject modifier, Function f |
f = modifier.getFunction() and
call = get_a_call(modifier, context) and
not modifies_escaping_variable(modifier, var)
not modifies_escaping_variable(f, var)
)
)
}
private predicate modifies_escaping_variable(FunctionObject modifier, PythonSsaSourceVariable var) {
private predicate modifies_escaping_variable(Function modifier, PythonSsaSourceVariable var) {
exists(var.redefinedAtCallSite()) and
modifier.getFunction().getBody().contains(var.(Variable).getAStore())
modifier.getBody().contains(var.(Variable).getAStore())
}
pragma [noinline]
@@ -2320,7 +2335,7 @@ module PointsTo {
or
cls = theObjectType() and result = 0
or
exists(builtin_base_type(cls)) and not cls = theObjectType() and result = 1
exists(builtin_base_type(cls)) and cls != theObjectType() and result = 1
or
cls = theUnknownType() and result = 1
}
@@ -2476,7 +2491,7 @@ module PointsTo {
/** INTERNAL -- Use `ClassObject.declaredAttribute(name). instead. */
cached predicate class_declared_attribute(ClassObject owner, string name, Object value, ClassObject vcls, ObjectOrCfg origin) {
/* Note that src_var must be a local variable, we aren't interested in the value that any global variable may hold */
not value = undefinedVariable() and
value != undefinedVariable() and
exists(EssaVariable var, LocalVariable src_var |
var.getSourceVariable() = src_var and
src_var.getId() = name and
@@ -2561,7 +2576,12 @@ module PointsTo {
or
exists(int i | failed_inference(class_base_type(cls, i), _) and reason = "Failed inference for base class at position " + i)
or
exists(int i | strictcount(class_base_type(cls, i)) > 1 and reason = "Multiple bases at position " + i)
exists(int i, Object base1, Object base2 |
base1 = class_base_type(cls, i) and
base2 = class_base_type(cls, i) and
base1 != base2 and
reason = "Multiple bases at position " + i
)
or
exists(int i, int j | class_base_type(cls, i) = class_base_type(cls, j) and i != j and reason = "Duplicate bases classes")
or
@@ -2581,7 +2601,7 @@ module PointsTo {
private ClassObject declared_meta_class(ClassObject cls) {
exists(Object obj |
ssa_variable_points_to(metaclass_var(cls), _, obj, _, _) |
ssa_variable_points_to(metaclass_var(cls.getPyClass()), _, obj, _, _) |
result = obj
or
obj = unknownValue() and result = theUnknownType()
@@ -2597,28 +2617,30 @@ module PointsTo {
private boolean has_metaclass_var_metaclass(ClassObject cls) {
exists(Object obj |
ssa_variable_points_to(metaclass_var(cls), _, obj, _, _) |
ssa_variable_points_to(metaclass_var(cls.getPyClass()), _, obj, _, _) |
obj = undefinedVariable() and result = false
or
obj != undefinedVariable() and result = true
)
or
not exists(metaclass_var(cls)) and result = false
exists(Class pycls |
pycls = cls.getPyClass() and
not exists(metaclass_var(pycls)) and result = false
)
}
private boolean has_declared_metaclass(ClassObject cls) {
py_cobjecttypes(cls, _) and result = true
or
not cls.isBuiltin() and
result = has_six_add_metaclass(cls).booleanOr(has_metaclass_var_metaclass(cls))
}
private EssaVariable metaclass_var(ClassObject cls) {
result.getASourceUse() = cls.getPyClass().getMetaClass().getAFlowNode()
private EssaVariable metaclass_var(Class cls) {
result.getASourceUse() = cls.getMetaClass().getAFlowNode()
or
major_version() = 2 and not exists(cls.getPyClass().getMetaClass()) and
major_version() = 2 and not exists(cls.getMetaClass()) and
result.getName() = "__metaclass__" and
cls.getPyClass().(ImportTimeScope).entryEdge(result.getAUse(), _)
cls.(ImportTimeScope).entryEdge(result.getAUse(), _)
}
private ClassObject get_inherited_metaclass(ClassObject cls) {
@@ -2628,7 +2650,7 @@ module PointsTo {
exists(Object base |
base = class_base_type(cls, _) and
result = theUnknownType() |
not base instanceof ClassObject
base.notClass()
or
base = theUnknownType()
)

4
python/ql/src/semmle/python/types/ClassObject.qll
View File

@@ -392,6 +392,10 @@ class ClassObject extends Object {
result.getFunction().refersTo(this)
}
predicate notClass() {
none()
}
}
/** The 'str' class. This is the same as the 'bytes' class for

8
python/ql/src/semmle/python/types/ModuleObject.qll
View File

@@ -226,6 +226,14 @@ class PackageObject extends ModuleObject {
result.getModule() = this.getModule().getInitModule()
}
/** Holds if this package has no `__init__.py` file. */
predicate hasNoInitModule() {
not exists(Module m |
m.isPackageInit() and
m.getFile().getParent() = this.getPath()
)
}
override predicate exportsComplete() {
not exists(this.getInitModule())
or

8
python/ql/src/semmle/python/types/Object.qll
View File

@@ -151,6 +151,14 @@ class Object extends @py_object {
)
}
final predicate maybe() {
not exists(this.booleanValue())
}
predicate notClass() {
any()
}
/** Holds if this object can be referred to by `longName`
* For example, the modules `dict` in the `sys` module
* has the long name `sys.modules` and the name `os.path.join`

10
python/ql/src/semmle/python/web/tornado/Request.qll
View File

@@ -15,16 +15,22 @@ class TornadoRequest extends TaintKind {
result instanceof ExternalStringDictKind and
(
name = "headers" or
name = "arguments" or
name = "cookies"
)
or
result instanceof ExternalStringKind and
(
name = "path" or
name = "uri" or
name = "query" or
name = "body"
)
or
result instanceof ExternalStringSequenceDictKind and
(
name = "arguments" or
name = "query_arguments" or
name = "body_arguments"
)
}
}

3
python/ql/src/semmle/python/web/twisted/Request.qll
View File

@@ -19,8 +19,7 @@ class TwistedRequest extends TaintKind {
or
result instanceof ExternalStringKind and
(
name = "uri" or
name = "path"
name = "uri"
)
}