hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Polish RegexEscape

Browse Source
This commit is contained in:
jorgectf
2021-03-26 10:15:12 +01:00
parent 3d990c5950
commit 805f86a5cf
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
python/ql/src/experimental/semmle/python/Concepts.qll
View File

@@ -46,8 +46,17 @@ class RegexExecution extends DataFlow::Node {
Attribute getRegexMethod() { result = range.getRegexMethod() }
}
class RegexEscape extends DataFlow::Node {
class RegexEscape extends DataFlow::CallCfgNode {
DataFlow::Node regexNode;
Attribute regexMethod;
RegexEscape() {
this = API::moduleImport("re").getMember("escape").getACall().(DataFlow::CallCfgNode).getArg(0)
this = API::moduleImport("re").getMember("escape").getACall() and
regexNode = this.getArg(0) and
regexMethod = this.asExpr().(Attribute)
}
DataFlow::Node getRegexNode() { result = regexNode }
Attribute getRegexMethod() { result = regexMethod }
}

4
python/ql/src/experimental/semmle/python/security/injection/RegexInjection.qll
View File

@@ -20,5 +20,7 @@ class RegexInjectionFlowConfig extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { sink = any(RegexExecution re).getRegexNode() }
override predicate isSanitizer(DataFlow::Node sanitizer) { sanitizer instanceof RegexEscape }
override predicate isSanitizer(DataFlow::Node sanitizer) {
sanitizer = sanitizer.(RegexEscape).getRegexNode()
}
}