hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-19 18:28:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into python-cwe-312

Browse Source
This commit is contained in:
Mark Shannon
2019-08-30 10:30:51 +01:00
parent 4f172bd075 4f26b58a1a
commit 811815aa4e
135 changed files with 12128 additions and 2591 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
python/ql/src/Security/CWE-022/TarSlip.ql
View File

@@ -187,6 +187,18 @@ class TarSlipConfiguration extends TaintTracking::Configuration {
sanitizer instanceof ExcludeTarFilePy
}
override predicate isBarrier(DataFlow::Node node) {
// Avoid flow into the tarfile module
exists(ParameterDefinition def |
node.asVariable().getDefinition() = def
or
node.asCfgNode() = def.getDefiningNode()
|
def.getScope() = Value::named("tarfile.open").(CallableValue).getScope()
or
def.isSelf() and def.getScope().getEnclosingModule().getName() = "tarfile"
)
}
}

12
python/ql/src/Security/CWE-089/SqlInjection.ql
View File

@@ -32,6 +32,18 @@ class SQLInjectionConfiguration extends TaintTracking::Configuration {
}
/* Additional configuration to support tracking of DB objects. Connections, cursors, etc. */
class DbConfiguration extends TaintTracking::Configuration {
DbConfiguration() { this = "DB configuration" }
override predicate isSource(TaintTracking::Source source) {
source instanceof DjangoModelObjects or
source instanceof DbConnectionSource
}
}
from SQLInjectionConfiguration config, TaintedPathSource src, TaintedPathSink sink
where config.hasFlowPath(src, sink)
select sink.getSink(), src, sink, "This SQL query depends on $@.", src.getSource(), "a user-provided value"

2
python/ql/src/Security/CWE-312/CleartextLogging.ql
View File

@@ -38,4 +38,4 @@ class CleartextLoggingConfiguration extends TaintTracking::Configuration {
from CleartextLoggingConfiguration config, TaintedPathSource source, TaintedPathSink sink
where config.hasFlowPath(source, sink)
select sink.getSink(), source, sink, "Sensitive data returned by $@ is logged here.",
source.getSource(), source.getNode().(SensitiveData::Source).repr()
source.getSource(), source.getCfgNode().(SensitiveData::Source).repr()

2
python/ql/src/Security/CWE-312/CleartextStorage.ql
View File

@@ -37,4 +37,4 @@ class CleartextStorageConfiguration extends TaintTracking::Configuration {
from CleartextStorageConfiguration config, TaintedPathSource source, TaintedPathSink sink
where config.hasFlowPath(source, sink)
select sink.getSink(), source, sink, "Sensitive data from $@ is stored here.",
source.getSource(), source.getNode().(SensitiveData::Source).repr()
source.getSource(), source.getCfgNode().(SensitiveData::Source).repr()

147
python/ql/src/Variables/Undefined.qll
View File

@@ -9,44 +9,6 @@ class Uninitialized extends TaintKind {
}
/** A source of an uninitialized variable.
* Either the start of the scope or a deletion.
*/
class UninitializedSource extends TaintedDefinition {
UninitializedSource() {
exists(FastLocalVariable var |
this.getSourceVariable() = var and
not var.escapes() |
this instanceof ScopeEntryDefinition
or
this instanceof DeletionDefinition
)
}
override predicate isSourceOf(TaintKind kind) {
kind instanceof Uninitialized
}
}
/** A loop where we are guaranteed (or is at least likely) to execute the body at least once.
*/
class AtLeastOnceLoop extends DataFlowExtension::DataFlowVariable {
AtLeastOnceLoop() {
loop_entry_variables(this, _)
}
/* If we are guaranteed to iterate over a loop at least once, then we can prune any edges that
* don't pass through the body.
*/
override predicate prunedSuccessor(EssaVariable succ) {
loop_entry_variables(this, succ)
}
}
private predicate loop_entry_variables(EssaVariable pred, EssaVariable succ) {
exists(PhiFunction phi, BasicBlock pb |
loop_entry_edge(pb, phi.getBasicBlock()) and
@@ -64,43 +26,6 @@ private predicate loop_entry_edge(BasicBlock pred, BasicBlock loop) {
)
}
class UnitializedSanitizer extends Sanitizer {
UnitializedSanitizer() { this = "use of variable" }
override
predicate sanitizingDefinition(TaintKind taint, EssaDefinition def) {
// An assignment cannot leave a variable uninitialized
taint instanceof Uninitialized and
(
def instanceof AssignmentDefinition
or
def instanceof ExceptionCapture
or
def instanceof ParameterDefinition
or
/* A use is a "sanitizer" of "uninitialized", as any use of an undefined
* variable will raise, making the subsequent code unreacahable.
*/
exists(def.(EssaNodeRefinement).getInput().getASourceUse())
or
exists(def.(PhiFunction).getAnInput().getASourceUse())
or
exists(def.(EssaEdgeRefinement).getInput().getASourceUse())
)
}
override
predicate sanitizingNode(TaintKind taint, ControlFlowNode node) {
taint instanceof Uninitialized and
exists(EssaVariable v |
v.getASourceUse() = node and
not first_use(node, v)
)
}
}
/** Since any use of a local will raise if it is uninitialized, then
* any use dominated by another use of the same variable must be defined, or is unreachable.
*/
@@ -124,15 +49,75 @@ private predicate maybe_call_to_exiting_function(CallNode call) {
)
}
/** Prune edges where the predecessor block looks like it might contain a call to an exit function. */
class ExitFunctionGuardedEdge extends DataFlowExtension::DataFlowVariable {
override predicate prunedSuccessor(EssaVariable succ) {
exists(CallNode exit_call |
succ.(PhiFunction).getInput(exit_call.getBasicBlock()) = this and
maybe_call_to_exiting_function(exit_call)
predicate exitFunctionGuardedEdge(EssaVariable pred, EssaVariable succ) {
exists(CallNode exit_call |
succ.(PhiFunction).getInput(exit_call.getBasicBlock()) = pred and
maybe_call_to_exiting_function(exit_call)
)
}
class UninitializedConfig extends TaintTracking::Configuration {
UninitializedConfig() {
this = "Unitialized local config"
}
override predicate isSource(DataFlow::Node source, TaintKind kind) {
kind instanceof Uninitialized and
exists(EssaVariable var |
source.asVariable() = var and
var.getSourceVariable() instanceof FastLocalVariable and
not var.getSourceVariable().(Variable).escapes() |
var instanceof ScopeEntryDefinition
or
var instanceof DeletionDefinition
)
}
override predicate isBarrier(DataFlow::Node node, TaintKind kind) {
kind instanceof Uninitialized and
(
definition(node.asVariable())
or
use(node.asVariable())
or
sanitizingNode(node.asCfgNode())
)
}
private predicate definition(EssaDefinition def) {
def instanceof AssignmentDefinition
or
def instanceof ExceptionCapture
or
def instanceof ParameterDefinition
}
private predicate use(EssaDefinition def) {
exists(def.(EssaNodeRefinement).getInput().getASourceUse())
or
exists(def.(PhiFunction).getAnInput().getASourceUse())
or
exists(def.(EssaEdgeRefinement).getInput().getASourceUse())
}
private predicate sanitizingNode(ControlFlowNode node) {
exists(EssaVariable v |
v.getASourceUse() = node and
not first_use(node, v)
)
}
override predicate isBarrierEdge(DataFlow::Node src, DataFlow::Node dest) {
/* If we are guaranteed to iterate over a loop at least once, then we can prune any edges that
* don't pass through the body.
*/
loop_entry_variables(src.asVariable(), dest.asVariable())
or
exitFunctionGuardedEdge(src.asVariable(), dest.asVariable())
}
}

145
python/ql/src/semmle/python/dataflow/Configuration.qll Normal file
View File

@@ -0,0 +1,145 @@
import python
import semmle.python.security.TaintTracking
private import semmle.python.objects.ObjectInternal
private import semmle.python.dataflow.Implementation
module TaintTracking {
class Source = TaintSource;
class Sink = TaintSink;
class Extension = DataFlowExtension::DataFlowNode;
class PathSource = TaintTrackingNode;
class PathSink = TaintTrackingNode;
abstract class Configuration extends string {
/* Required to prevent compiler warning */
bindingset[this]
Configuration() { this = this }
/* Old implementation API */
predicate isSource(Source source) { none() }
predicate isSink(Sink sink) { none() }
predicate isSanitizer(Sanitizer sanitizer) { none() }
predicate isExtension(Extension extension) { none() }
/* New implementation API */
/**
* Holds if `source` is a source of taint of `kind` that is relevant
* for this configuration.
*/
predicate isSource(DataFlow::Node node, TaintKind kind) {
exists(TaintSource source |
this.isSource(source) and
node.asCfgNode() = source and
source.isSourceOf(kind)
)
}
/**
* Holds if `sink` is a sink of taint of `kind` that is relevant
* for this configuration.
*/
predicate isSink(DataFlow::Node node, TaintKind kind) {
exists(TaintSink sink |
node.asCfgNode() = sink and
sink.sinks(kind)
)
}
/**
* Holds if `src -> dest` should be considered as a flow edge
* in addition to standard data flow edges.
*/
predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node dest) { none() }
/**
* Holds if `src -> dest` is a flow edge converting taint from `srckind` to `destkind`.
*/
predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node dest, TaintKind srckind, TaintKind destkind) {
none()
}
/**
* Holds if `node` should be considered as a barrier to flow of any kind.
*/
predicate isBarrier(DataFlow::Node node) { none() }
/**
* Holds if `node` should be considered as a barrier to flow of `kind`.
*/
predicate isBarrier(DataFlow::Node node, TaintKind kind) {
exists(Sanitizer sanitizer |
this.isSanitizer(sanitizer)
|
sanitizer.sanitizingNode(kind, node.asCfgNode())
or
sanitizer.sanitizingEdge(kind, node.asVariable())
or
sanitizer.sanitizingSingleEdge(kind, node.asVariable())
or
sanitizer.sanitizingDefinition(kind, node.asVariable())
or
exists(MethodCallsiteRefinement call, FunctionObject callee |
call = node.asVariable().getDefinition() and
callee.getACall() = call.getCall() and
sanitizer.sanitizingCall(kind, callee)
)
)
}
/**
* Holds if flow from `src` to `dest` is prohibited.
*/
predicate isBarrierEdge(DataFlow::Node src, DataFlow::Node dest) { none() }
/**
* Holds if control flow from `test` along the `isTrue` edge is prohibited.
*/
predicate isBarrierTest(ControlFlowNode test, boolean isTrue) { none() }
/**
* Holds if flow from `src` to `dest` is prohibited when the incoming taint is `srckind` and the outgoing taint is `destkind`.
* Note that `srckind` and `destkind` can be the same.
*/
predicate isBarrierEdge(DataFlow::Node src, DataFlow::Node dest, TaintKind srckind, TaintKind destkind) { none() }
/* Common query API */
predicate hasFlowPath(PathSource source, PathSink sink) {
this.(TaintTrackingImplementation).hasFlowPath(source, sink)
}
/* Old query API */
/* deprecated */
predicate hasFlow(Source source, Sink sink) {
exists(PathSource psource, PathSink psink |
this.hasFlowPath(psource, psink) and
source = psource.getNode().asCfgNode() and
sink = psink.getNode().asCfgNode()
)
}
/* New query API */
predicate hasSimpleFlow(DataFlow::Node source, DataFlow::Node sink) {
exists(PathSource psource, PathSink psink |
this.hasFlowPath(psource, psink) and
source = psource.getNode() and
sink = psink.getNode()
)
}
}
}

852
python/ql/src/semmle/python/dataflow/Implementation.qll Normal file
View File

@@ -0,0 +1,852 @@
import python
import semmle.python.security.TaintTracking
private import semmle.python.objects.ObjectInternal
private import semmle.python.pointsto.Filters as Filters
import semmle.python.dataflow.Legacy
/* See tests/library-tests/taint/examples
* For examples of taint sources, sinks and flow,
* including attribute paths, contexts and edges.
*/
newtype TTaintTrackingContext =
TNoParam()
or
TParamContext(TaintKind param, AttributePath path, int n) {
any(TaintTrackingImplementation impl).callWithTaintedArgument(_, _, _, _, n, path, param)
}
/** The context for taint-tracking.
* There are two types of contexts:
* * No context; the context at a source.
* * Tainted parameter; tracks the taint and attribute-path for a parameter
* Used to track taint through calls accurately and reasonably efficiently.
*/
class TaintTrackingContext extends TTaintTrackingContext {
string toString() {
this = TNoParam() and result = ""
or
exists(TaintKind param, AttributePath path, int n |
this = TParamContext(param, path, n) and
result = "p" + n.toString() + path.extension() + " = " + param
)
}
TaintKind getParameterTaint(int n) {
this = TParamContext(result, _, n)
}
AttributePath getAttributePath() {
this = TParamContext(_, result, _)
}
TaintTrackingContext getCaller() {
result = this.getCaller(_)
}
TaintTrackingContext getCaller(CallNode call) {
exists(TaintKind param, AttributePath path, int n |
this = TParamContext(param, path, n) and
exists(TaintTrackingImplementation impl |
impl.callWithTaintedArgument(_, call, result, _, n, path, param)
)
)
}
predicate isTop() {
this = TNoParam()
}
}
private newtype TAttributePath =
TNoAttribute()
or
TAttribute(string name) {
exists(Attribute a | a.getName() = name)
}
/* It might make sense to add another level, attribute of attribute.
* But some experimentation would be needed.
*/
/** The attribute of the tracked value holding the taint.
* This is usually "no attribute".
* Used for tracking tainted attributes of objects.
*/
abstract class AttributePath extends TAttributePath {
abstract string toString();
abstract string extension();
abstract AttributePath fromAttribute(string name);
AttributePath getAttribute(string name) {
this = result.fromAttribute(name)
}
predicate noAttribute() {
this = TNoAttribute()
}
}
/** AttributePath for no attribute. */
class NoAttribute extends TNoAttribute, AttributePath {
override string toString() { result = "no attribute" }
override string extension() { result = "" }
override AttributePath fromAttribute(string name) {
none()
}
}
/** AttributePath for an attribute. */
class NamedAttributePath extends TAttribute, AttributePath {
override string toString() {
exists(string attr |
this = TAttribute(attr) and
result = "attribute " + attr
)
}
override string extension() {
exists(string attr |
this = TAttribute(attr) and
result = "." + attr
)
}
override AttributePath fromAttribute(string name) {
this = TAttribute(name) and result = TNoAttribute()
}
}
/** Type representing the (node, context, path, kind) tuple.
* Construction of this type is mutually recursive with `TaintTrackingImplementation.flowStep(...)`
*/
newtype TTaintTrackingNode =
TTaintTrackingNode_(DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, TaintTracking::Configuration config) {
config.(TaintTrackingImplementation).flowSource(node, context, path, kind)
or
config.(TaintTrackingImplementation).flowStep(_, node, context, path, kind, _)
}
/** Class representing the (node, context, path, kind) tuple.
* Used for context-sensitive path-aware taint-tracking.
*/
class TaintTrackingNode extends TTaintTrackingNode {
string toString() {
if this.getPath() instanceof NoAttribute then (
result = this.getTaintKind().repr()
) else (
result = this.getPath().extension() + " = " + this.getTaintKind().repr()
)
}
/** Gets the data flow node for this taint-tracking node */
DataFlow::Node getNode() {
this = TTaintTrackingNode_(result, _, _, _, _)
}
/** Gets the taint kind for this taint-tracking node */
TaintKind getTaintKind() {
this = TTaintTrackingNode_(_, _, _, result, _)
}
/** Gets the taint-tracking context for this taint-tracking node */
TaintTrackingContext getContext() {
this = TTaintTrackingNode_(_, result, _, _, _)
}
/** Gets the attribute path context for this taint-tracking node */
AttributePath getPath() {
this = TTaintTrackingNode_(_, _, result, _, _)
}
TaintTracking::Configuration getConfiguration() {
this = TTaintTrackingNode_(_, _, _, _, result)
}
Location getLocation() {
result = this.getNode().getLocation()
}
predicate isSource() {
this.getConfiguration().(TaintTrackingImplementation).isPathSource(this)
}
predicate isSink() {
this.getConfiguration().(TaintTrackingImplementation).isPathSink(this)
}
ControlFlowNode getCfgNode() {
result = this.getNode().asCfgNode()
}
/** Get the AST node for this node. */
AstNode getAstNode() {
result = this.getCfgNode().getNode()
}
TaintTrackingNode getASuccessor(string edgeLabel) {
this.isVisible() and
result = this.unlabeledSuccessor*().labeledSuccessor(edgeLabel)
}
TaintTrackingNode getASuccessor() {
result = this.getASuccessor(_)
or
this.isVisible() and
result = this.unlabeledSuccessor+() and
result.isSink()
}
private TaintTrackingNode unlabeledSuccessor() {
this.getConfiguration().(TaintTrackingImplementation).flowStep(this, result, "")
}
private TaintTrackingNode labeledSuccessor(string label) {
not label = "" and
this.getConfiguration().(TaintTrackingImplementation).flowStep(this, result, label)
}
private predicate isVisible() {
any(TaintTrackingNode pred).labeledSuccessor(_) = this
or
this.isSource()
}
predicate flowsTo(TaintTrackingNode other) {
this.getASuccessor*() = other
}
}
/** The implementation of taint-tracking
* Each `TaintTrackingImplementation` is also a `TaintTracking::Configuration`
* It is implemented as a separate class for clarity and to keep the code
* in `TaintTracking::Configuration` simpler.
*/
class TaintTrackingImplementation extends string {
TaintTrackingImplementation() {
this instanceof TaintTracking::Configuration
}
/** Hold if there is a flow from `source`, which is a taint source, to
* `sink`, which is a taint sink, with this configuration.
*/
predicate hasFlowPath(TaintTrackingNode source, TaintTrackingNode sink) {
this.isPathSource(source) and
this.isPathSink(sink) and
source.flowsTo(sink)
}
/** Hold if `node` is a source of taint `kind` with context `context` and attribute path `path`.
*/
predicate flowSource(DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind) {
context = TNoParam() and path = TNoAttribute() and
this.(TaintTracking::Configuration).isSource(node, kind)
}
/** Hold if `source` is a source of taint. */
predicate isPathSource(TaintTrackingNode source) {
exists(DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind |
source = TTaintTrackingNode_(node, context, path, kind, this) and
this.flowSource(node, context, path, kind)
)
}
/** Hold if `sink` is a taint sink. */
predicate isPathSink(TaintTrackingNode sink) {
exists(DataFlow::Node node, AttributePath path, TaintKind kind |
sink = TTaintTrackingNode_(node, _, path, kind, this) and
path = TNoAttribute() and
this.(TaintTracking::Configuration).isSink(node, kind)
)
}
/** Hold if taint flows to `src` to `dest` in a single step, labeled with `edgeLabel`
* `edgeLabel` is purely informative.
*/
predicate flowStep(TaintTrackingNode src, TaintTrackingNode dest, string edgeLabel) {
exists(DataFlow::Node node, TaintTrackingContext ctx, AttributePath path, TaintKind kind |
dest = TTaintTrackingNode_(node, ctx, path, kind, this) and
this.flowStep(src, node, ctx, path, kind, edgeLabel)
)
}
/** Hold if taint flows to `src` to `(node, context, path, kind)` in a single step, labelled with `egdeLabel` with this configuration.
* `edgeLabel` is purely informative.
*/
predicate flowStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
this.unprunedStep(src, node, context, path, kind, edgeLabel) and
node.getBasicBlock().likelyReachable() and
not this.(TaintTracking::Configuration).isBarrier(node) and
(
not path = TNoAttribute()
or
not this.(TaintTracking::Configuration).isBarrier(node, kind) and
exists(DataFlow::Node srcnode, TaintKind srckind |
src = TTaintTrackingNode_(srcnode, _, _, srckind, this) and
not this.prunedEdge(srcnode, node, srckind, kind)
)
)
}
private predicate prunedEdge(DataFlow::Node srcnode, DataFlow::Node destnode, TaintKind srckind, TaintKind destkind) {
this.(TaintTracking::Configuration).isBarrierEdge(srcnode, destnode, srckind, destkind)
or
srckind = destkind and this.(TaintTracking::Configuration).isBarrierEdge(srcnode, destnode)
}
private predicate unprunedStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
this.importStep(src, node, context, path, kind, edgeLabel)
or
this.fromImportStep(src, node, context, path, kind, edgeLabel)
or
this.attributeLoadStep(src, node, context, path, kind, edgeLabel)
or
this.getattrStep(src, node, context, path, kind, edgeLabel)
or
this.useStep(src, node, context, path, kind, edgeLabel)
or
this.callTaintStep(src, node, context, path, kind, edgeLabel)
or
this.returnFlowStep(src, node, context, path, kind, edgeLabel)
or
this.callFlowStep(src, node, context, path, kind, edgeLabel)
or
this.iterationStep(src, node, context, path, kind, edgeLabel)
or
this.yieldStep(src, node, context, path, kind, edgeLabel)
or
this.parameterStep(src, node, context, path, kind, edgeLabel)
or
this.ifExpStep(src, node, context, path, kind, edgeLabel)
or
this.essaFlowStep(src, node, context, path, kind, edgeLabel)
or
this.instantiationStep(src, node, context, path, kind, edgeLabel)
or
this.legacyExtensionStep(src, node, context, path, kind, edgeLabel)
or
exists(DataFlow::Node srcnode, TaintKind srckind |
this.(TaintTracking::Configuration).isAdditionalFlowStep(srcnode, node, srckind, kind) and
src = TTaintTrackingNode_(srcnode, context, path, srckind, this) and
path.noAttribute() and edgeLabel = "additional with kind"
)
or
exists(DataFlow::Node srcnode |
this.(TaintTracking::Configuration).isAdditionalFlowStep(srcnode, node) and
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
path.noAttribute() and edgeLabel = "additional"
)
or
exists(DataFlow::Node srcnode, TaintKind srckind |
src = TTaintTrackingNode_(srcnode, context, path, srckind, this) and
path.noAttribute()
|
kind = srckind.getTaintForFlowStep(srcnode.asCfgNode(), node.asCfgNode(), edgeLabel)
or
kind = srckind.(CollectionKind).getMember() and
srckind.(CollectionKind).flowToMember(srcnode, node) and
edgeLabel = "to member"
or
srckind = kind.(CollectionKind).getMember() and
kind.(CollectionKind).flowFromMember(srcnode, node) and
edgeLabel = "from member"
or
kind = srckind and srckind.flowStep(srcnode, node, edgeLabel)
or
kind = srckind and srckind instanceof DictKind and DictKind::flowStep(srcnode.asCfgNode(), node.asCfgNode(), edgeLabel)
or
kind = srckind and srckind instanceof SequenceKind and SequenceKind::flowStep(srcnode.asCfgNode(), node.asCfgNode(), edgeLabel)
)
}
pragma [noinline]
predicate importStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
edgeLabel = "import" and
exists(ModuleValue m, string name, AttributePath srcpath |
src = TTaintTrackingNode_(_, context, srcpath, kind, this) and
this.moduleAttributeTainted(m, name, src) and
node.asCfgNode().pointsTo(m) and
path = srcpath.getAttribute(name)
)
}
pragma [noinline]
predicate fromImportStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
edgeLabel = "from import" and
exists(ModuleValue m, string name |
src = TTaintTrackingNode_(_, context, path, kind, this) and
this.moduleAttributeTainted(m, name, src) and
node.asCfgNode().(ImportMemberNode).getModule(name).pointsTo(m)
)
}
pragma [noinline]
predicate attributeLoadStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(DataFlow::Node srcnode, AttributePath srcpath, string attrname |
src = TTaintTrackingNode_(srcnode, context, srcpath, kind, this) and
srcnode.asCfgNode() = node.asCfgNode().(AttrNode).getObject(attrname) and
path = srcpath.fromAttribute(attrname) and edgeLabel = "from path attribute"
)
or
exists(DataFlow::Node srcnode, TaintKind srckind, string attrname |
src = TTaintTrackingNode_(srcnode, context, path, srckind, this) and
srcnode.asCfgNode() = node.asCfgNode().(AttrNode).getObject(attrname) and
kind = srckind.getTaintOfAttribute(attrname) and edgeLabel = "from taint attribute" and
path instanceof NoAttribute
)
}
pragma [noinline]
predicate getattrStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(DataFlow::Node srcnode, AttributePath srcpath, TaintKind srckind, string attrname |
src = TTaintTrackingNode_(srcnode, context, srcpath, srckind, this) and
exists(CallNode call, ControlFlowNode arg |
call = node.asCfgNode() and
call.getFunction().pointsTo(ObjectInternal::builtin("getattr")) and
arg = call.getArg(0) and
attrname = call.getArg(1).getNode().(StrConst).getText() and
arg = srcnode.asCfgNode()
|
path = srcpath.fromAttribute(attrname) and
kind = srckind
or
path = srcpath and
kind = srckind.getTaintOfAttribute(attrname)
)
) and edgeLabel = "getattr"
}
pragma [noinline]
predicate useStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
node.asCfgNode() = srcnode.asVariable().getASourceUse()
) and edgeLabel = "use"
}
/* If the return value is tainted without context, then it always flows back to the caller */
pragma [noinline]
predicate returnFlowStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(CallNode call, PythonFunctionObjectInternal pyfunc, DataFlow::Node retval |
pyfunc.getACall() = call and
context = TNoParam() and
src = TTaintTrackingNode_(retval, TNoParam(), path, kind, this) and
node.asCfgNode() = call and
retval.asCfgNode() = any(Return ret | ret.getScope() = pyfunc.getScope()).getValue().getAFlowNode()
) and
edgeLabel = "return"
}
/* Avoid taint flow from return value to caller as it can produce imprecise flow graphs
* Step directly from tainted argument to call result.
*/
pragma [noinline]
predicate callFlowStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(CallNode call, PythonFunctionObjectInternal pyfunc, TaintTrackingContext callee, DataFlow::Node retval, TaintTrackingNode retnode |
this.callContexts(call, src, pyfunc, context, callee) and
retnode = TTaintTrackingNode_(retval, callee, path, kind, this) and
node.asCfgNode() = call and
retval.asCfgNode() = any(Return ret | ret.getScope() = pyfunc.getScope()).getValue().getAFlowNode()
) and
edgeLabel = "call"
}
pragma [noinline]
predicate callContexts(CallNode call, TaintTrackingNode argnode, PythonFunctionObjectInternal pyfunc, TaintTrackingContext caller, TaintTrackingContext callee) {
exists(int arg, TaintKind callerKind, AttributePath callerPath |
this.callWithTaintedArgument(argnode, call, caller, pyfunc, arg, callerPath, callerKind) and
callee = TParamContext(callerKind, callerPath, arg)
)
}
predicate callWithTaintedArgument(TaintTrackingNode src, CallNode call, TaintTrackingContext caller, CallableValue pyfunc, int arg, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, caller, path, kind, this) and
srcnode.asCfgNode() = pyfunc.getArgumentForCall(call, arg)
)
}
predicate instantiationStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(PythonFunctionValue init, EssaVariable self, TaintTrackingContext callee |
instantiationCall(node.asCfgNode(), src, init, context, callee) and
this.(EssaTaintTracking).taintedDefinition(_, self.getDefinition(), callee, path, kind) and
self.getSourceVariable().(Variable).isSelf() and
BaseFlow::reaches_exit(self) and
self.getScope() = init.getScope()
) and
edgeLabel = "instantiation"
}
predicate instantiationCall(CallNode call, TaintTrackingNode argnode, PythonFunctionObjectInternal init, TaintTrackingContext caller, TaintTrackingContext callee) {
exists(ClassValue cls |
call.getFunction().pointsTo(cls) and
cls.lookup("__init__") = init
|
exists(int arg, TaintKind callerKind, AttributePath callerPath, DataFlow::Node argument |
argnode = TTaintTrackingNode_(argument, caller, callerPath, callerKind, this) and
call.getArg(arg-1) = argument.asCfgNode() and
callee = TParamContext(callerKind, callerPath, arg)
)
)
}
pragma [noinline]
predicate callTaintStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(DataFlow::Node srcnode, CallNode call, TaintKind srckind, string name |
src = TTaintTrackingNode_(srcnode, context, path, srckind, this) and
call.getFunction().(AttrNode).getObject(name) = src.getNode().asCfgNode() and
kind = srckind.getTaintOfMethodResult(name) and
node.asCfgNode() = call
) and edgeLabel = "call"
}
pragma [noinline]
predicate iterationStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(ForNode for, DataFlow::Node sequence, TaintKind seqkind |
src = TTaintTrackingNode_(sequence, context, path, seqkind, this) and
for.iterates(_, sequence.asCfgNode()) and
node.asCfgNode() = for and
path.noAttribute() and
kind = seqkind.getTaintForIteration()
) and edgeLabel = "iteration"
}
pragma [noinline]
predicate parameterStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(CallNode call, PythonFunctionObjectInternal pyfunc, int arg |
this.callWithTaintedArgument(src, call, _, pyfunc, arg, path, kind) and
node.asCfgNode() = pyfunc.getParameter(arg) and
context = TParamContext(kind, path, arg)
) and edgeLabel = "parameter"
}
pragma [noinline]
predicate yieldStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(DataFlow::Node srcnode, TaintKind itemkind |
src = TTaintTrackingNode_(srcnode, context, path, itemkind, this) and
itemkind = kind.getTaintForIteration() and
exists(PyFunctionObject func |
func.getFunction().isGenerator() and
func.getACall() = node.asCfgNode() and
exists(Yield yield |
yield.getScope() = func.getFunction() and
yield.getValue() = srcnode.asCfgNode().getNode()
)
)
) and edgeLabel = "yield"
}
pragma [noinline]
predicate ifExpStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
srcnode.asCfgNode() = node.asCfgNode().(IfExprNode).getAnOperand()
) and edgeLabel = "if exp"
}
pragma [noinline]
predicate essaFlowStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
this.(EssaTaintTracking).taintedDefinition(src, node.asVariable().getDefinition(), context, path, kind) and edgeLabel = ""
}
pragma [noinline]
predicate legacyExtensionStep(TaintTrackingNode src, DataFlow::Node node, TaintTrackingContext context, AttributePath path, TaintKind kind, string edgeLabel) {
exists(TaintTracking::Extension extension, DataFlow::Node srcnode, TaintKind srckind |
this.(TaintTracking::Configuration).isExtension(extension) and
src = TTaintTrackingNode_(srcnode, context, path, srckind, this) and
srcnode.asCfgNode() = extension
|
extension.getASuccessorNode() = node.asCfgNode() and kind = srckind
or
extension.getASuccessorNode(srckind, kind) = node.asCfgNode()
or
extension.getASuccessorVariable() = node.asVariable() and kind = srckind
) and edgeLabel = "legacy extension"
}
predicate moduleAttributeTainted(ModuleValue m, string name, TaintTrackingNode taint) {
exists(DataFlow::Node srcnode, EssaVariable var |
taint = TTaintTrackingNode_(srcnode, TNoParam(), _, _, this) and
var = srcnode.asVariable() and
var.getName() = name and
BaseFlow::reaches_exit(var) and
var.getScope() = m.getScope()
)
}
}
/** Another taint-tracking class to help partition the code for clarity
* This class handle tracking of ESSA variables. */
private class EssaTaintTracking extends string {
EssaTaintTracking() {
this instanceof TaintTracking::Configuration
}
pragma [noinline]
predicate taintedDefinition(TaintTrackingNode src, EssaDefinition defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
this.taintedPhi(src, defn, context, path, kind)
or
this.taintedAssignment(src, defn, context, path, kind)
or
this.taintedAttributeAssignment(src, defn, context, path, kind)
or
this.taintedParameterDefinition(src, defn, context, path, kind)
or
this.taintedCallsite(src, defn, context, path, kind)
or
this.taintedMethodCallsite(src, defn, context, path, kind)
or
this.taintedUniEdge(src, defn, context, path, kind)
or
this.taintedPiNode(src, defn, context, path, kind)
or
this.taintedArgument(src, defn, context, path, kind)
or
this.taintedExceptionCapture(src, defn, context, path, kind)
or
this.taintedScopeEntryDefinition(src, defn, context, path, kind)
or
this.taintedWith(src, defn, context, path, kind)
}
pragma [noinline]
private predicate taintedPhi(TaintTrackingNode src, PhiFunction defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode, BasicBlock pred, EssaVariable predvar, DataFlow::Node phi |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
defn = phi.asVariable().getDefinition() and
predvar = defn.getInput(pred) and
not pred.unlikelySuccessor(defn.getBasicBlock()) and
not this.(TaintTracking::Configuration).isBarrierEdge(srcnode, phi) and
srcnode.asVariable() = predvar
)
}
pragma [noinline]
private predicate taintedAssignment(TaintTrackingNode src, AssignmentDefinition defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
defn.getValue() = srcnode.asCfgNode()
)
}
pragma [noinline]
private predicate taintedAttributeAssignment(TaintTrackingNode src, AttributeAssignment defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode, AttributePath srcpath, string attrname |
src = TTaintTrackingNode_(srcnode, context, srcpath, kind, this) and
defn.getValue() = srcnode.asCfgNode() and
defn.getName() = attrname and
path = srcpath.getAttribute(attrname)
)
}
pragma [noinline]
private predicate taintedParameterDefinition(TaintTrackingNode src, ParameterDefinition defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
srcnode.asCfgNode() = defn.getDefiningNode()
)
}
pragma [noinline]
private predicate taintedCallsite(TaintTrackingNode src, CallsiteRefinement defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
/* In the interest of simplicity and performance we assume that tainted escaping variables remain tainted across calls.
* In the cases were this assumption is false, it is easy enough to add an additional barrier.
*/
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
srcnode.asVariable() = defn.getInput()
)
}
pragma [noinline]
private predicate taintedMethodCallsite(TaintTrackingNode src, MethodCallsiteRefinement defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
srcnode.asVariable() = defn.getInput()
)
}
pragma [noinline]
private predicate taintedUniEdge(TaintTrackingNode src, SingleSuccessorGuard defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
srcnode.asVariable() = defn.getInput() and
not this.(TaintTracking::Configuration).isBarrierTest(defn.getTest(), defn.getSense())
)
}
private predicate taintedPiNode(TaintTrackingNode src, PyEdgeRefinement defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
taintedPiNodeOneway(src, defn, context, path, kind)
or
taintedPiNodeBothways(src, defn, context, path, kind)
}
pragma [noinline]
private predicate taintedPiNodeOneway(TaintTrackingNode src, PyEdgeRefinement defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode, ControlFlowNode use |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
not this.(TaintTracking::Configuration).isBarrierTest(defn.getTest(), defn.getSense()) and
defn.getSense() = testEvaluates(defn, defn.getTest(), use, src)
)
}
pragma [noinline]
private predicate taintedPiNodeBothways(TaintTrackingNode src, PyEdgeRefinement defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode, ControlFlowNode test, ControlFlowNode use |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
piNodeTestAndUse(defn, test, use) and
srcnode.asVariable() = defn.getInput() and
not this.(TaintTracking::Configuration).isBarrierTest(test, defn.getSense()) and
testEvaluatesMaybe(test, use)
)
}
pragma [noinline]
private predicate taintedArgument(TaintTrackingNode src, ArgumentRefinement defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
defn.getInput() = srcnode.asVariable()
)
}
pragma [noinline]
private predicate taintedExceptionCapture(TaintTrackingNode src, ExceptionCapture defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
srcnode.asCfgNode() = defn.getDefiningNode()
)
}
pragma [noinline]
private predicate taintedScopeEntryDefinition(TaintTrackingNode src, ScopeEntryDefinition defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(EssaVariable var |
BaseFlow::scope_entry_value_transfer_from_earlier(var, _, defn, _) and
this.taintedDefinition(src, var.getDefinition(), context, path, kind)
)
}
pragma [noinline]
private predicate taintedWith(TaintTrackingNode src, WithDefinition defn, TaintTrackingContext context, AttributePath path, TaintKind kind) {
exists(DataFlow::Node srcnode |
src = TTaintTrackingNode_(srcnode, context, path, kind, this) and
with_flow(_, srcnode.asCfgNode(), defn.getDefiningNode())
)
}
/** Gets the boolean value that `test` evaluates to when `use` is tainted with `kind`
* and `test` and `use` are part of a test in a branch.
*/
private boolean testEvaluates(PyEdgeRefinement defn, ControlFlowNode test, ControlFlowNode use, TaintTrackingNode src) {
defn.getTest().getAChild*() = use and
exists(DataFlow::Node srcnode, TaintKind kind |
srcnode.asVariable() = defn.getInput() and
srcnode.asVariable().getASourceUse() = use and
src = TTaintTrackingNode_(srcnode, _, TNoAttribute(), kind, this)
|
test = use and result = kind.booleanValue()
or
exists(ControlFlowNode const |
Filters::equality_test(test, use, result.booleanNot(), const) and
const.getNode() instanceof ImmutableLiteral
)
or
exists(ControlFlowNode c, ClassValue cls |
Filters::isinstance(test, c, use) and
c.pointsTo(cls)
|
exists(ClassValue scls |
scls = kind.getType() |
scls.getASuperType() = cls and result = true
or
not scls.getASuperType() = cls and result = false
)
or
not exists(kind.getType()) and result = maybe()
)
)
or
result = testEvaluates(defn, not_operand(test), use, src).booleanNot()
}
/** Holds if `test` is the test in a branch and `use` is that test
* with all the `not` prefixes removed.
*/
private predicate boolean_filter(ControlFlowNode test, ControlFlowNode use) {
any(PyEdgeRefinement ref).getTest() = test and
(
use = test
or
exists(ControlFlowNode notuse |
boolean_filter(test, notuse) and
use = not_operand(notuse)
)
)
}
}
private predicate testEvaluatesMaybe(ControlFlowNode test, ControlFlowNode use) {
any(PyEdgeRefinement ref).getTest().getAChild*() = test and
test.getAChild*() = use and
not test.(UnaryExprNode).getNode().getOp() instanceof Not and
not Filters::equality_test(test, use, _, _) and
not Filters::isinstance(test, _, use) and
not test = use
or
testEvaluatesMaybe(not_operand(test), use)
}
/** Gets the operand of a unary `not` expression. */
private ControlFlowNode not_operand(ControlFlowNode expr) {
expr.(UnaryExprNode).getNode().getOp() instanceof Not and
result = expr.(UnaryExprNode).getOperand()
}
/* Helper predicate for tainted_with */
private predicate with_flow(With with, ControlFlowNode contextManager, ControlFlowNode var) {
with.getContextExpr() = contextManager.getNode() and
with.getOptionalVars() = var.getNode() and
contextManager.strictlyDominates(var)
}
/* Helper predicate for taintedPiNode */
pragma [noinline]
private predicate piNodeTestAndUse(PyEdgeRefinement defn, ControlFlowNode test, ControlFlowNode use) {
test = defn.getTest() and use = defn.getInput().getASourceUse() and test.getAChild*() = use
}
module Implementation {
/* A call that returns a copy (or similar) of the argument */
predicate copyCall(ControlFlowNode fromnode, CallNode tonode) {
tonode.getFunction().(AttrNode).getObject("copy") = fromnode
or
exists(ModuleObject copy, string name |
name = "copy" or name = "deepcopy" |
copy.attr(name).(FunctionObject).getACall() = tonode and
tonode.getArg(0) = fromnode
)
or
tonode.getFunction().pointsTo(ObjectInternal::builtin("reversed")) and
tonode.getArg(0) = fromnode
}
}

94
python/ql/src/semmle/python/dataflow/Legacy.qll Normal file
View File

@@ -0,0 +1,94 @@
import semmle.python.security.TaintTracking
private import semmle.python.objects.ObjectInternal
import semmle.python.dataflow.Implementation
/* For backwards compatibility -- Use `TaintTrackingContext` instead. */
deprecated
class CallContext extends TaintTrackingContext {
TaintTrackingContext getCallee(CallNode call) {
result.getCaller(call) = this
}
predicate appliesToScope(Scope s) {
exists(PythonFunctionObjectInternal func, TaintKind param, AttributePath path, int n |
this = TParamContext(param, path, n) and
exists(TaintTrackingImplementation impl |
impl.callWithTaintedArgument(_, _, _, func, n, path, param) and
s = func.getScope()
)
)
or
this.isTop()
}
}
/* Backwards compatibility with config-less taint-tracking */
private class LegacyConfiguration extends TaintTracking::Configuration {
LegacyConfiguration() {
/* A name that won't be accidentally chosen by users */
this = "Semmle: Internal legacy configuration"
}
override predicate isSource(TaintSource src) {
isValid() and
src = src
}
override predicate isSink(TaintSink sink) {
isValid() and
sink = sink
}
override predicate isSanitizer(Sanitizer sanitizer) {
isValid() and
sanitizer = sanitizer
}
private predicate isValid() {
not exists(TaintTracking::Configuration config | config != this)
}
override predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node dest) {
isValid() and
exists(DataFlowExtension::DataFlowNode legacyExtension |
src.asCfgNode() = legacyExtension
|
dest.asCfgNode() = legacyExtension.getASuccessorNode()
or
dest.asVariable() = legacyExtension.getASuccessorVariable()
or
dest.asCfgNode() = legacyExtension.getAReturnSuccessorNode(_)
or
dest.asCfgNode() = legacyExtension.getACalleeSuccessorNode(_)
)
}
override predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node dest, TaintKind srckind, TaintKind destkind) {
isValid() and
exists(DataFlowExtension::DataFlowNode legacyExtension |
src.asCfgNode() = legacyExtension
|
dest.asCfgNode() = legacyExtension.getASuccessorNode(srckind, destkind)
)
}
override predicate isBarrierEdge(DataFlow::Node src, DataFlow::Node dest) {
isValid() and
(
exists(DataFlowExtension::DataFlowVariable legacyExtension |
src.asVariable() = legacyExtension and
legacyExtension.prunedSuccessor(dest.asVariable())
)
or
exists(DataFlowExtension::DataFlowNode legacyExtension |
src.asCfgNode() = legacyExtension and
legacyExtension.prunedSuccessor(dest.asCfgNode())
)
)
}
}

16
python/ql/src/semmle/python/essa/Essa.qll
View File

@@ -170,6 +170,8 @@ abstract class EssaDefinition extends TEssaDefinition {
result.getDefinition() = this
}
abstract BasicBlock getBasicBlock();
}
/** An ESSA definition corresponding to an edge refinement of the underlying variable.
@@ -233,6 +235,10 @@ class EssaEdgeRefinement extends EssaDefinition, TEssaEdgeDefinition {
result = this.getPredecessor().getScope()
}
override BasicBlock getBasicBlock(){
result = this.getSuccessor()
}
}
/** A Phi-function as specified in classic SSA form. */
@@ -295,7 +301,7 @@ class PhiFunction extends EssaDefinition, TPhiFunction {
}
/** Gets the basic block that succeeds this phi node. */
BasicBlock getBasicBlock() {
override BasicBlock getBasicBlock() {
this = TPhiFunction(_, result)
}
@@ -446,6 +452,10 @@ class EssaNodeDefinition extends EssaDefinition, TEssaNodeDefinition {
)
}
override BasicBlock getBasicBlock(){
result = this.getDefiningNode().getBasicBlock()
}
}
/** A definition of an ESSA variable that takes another ESSA variable as an input.
@@ -512,6 +522,10 @@ class EssaNodeRefinement extends EssaDefinition, TEssaNodeRefinement {
)
}
override BasicBlock getBasicBlock(){
result = this.getDefiningNode().getBasicBlock()
}
}
pragma[noopt]

12
python/ql/src/semmle/python/security/Crypto.qll
View File

@@ -192,4 +192,16 @@ module Cryptography {
}
private class CipherConfig extends TaintTracking::Configuration {
CipherConfig() { this = "Crypto cipher config" }
override predicate isSource(TaintTracking::Source source) {
source instanceof Pycrypto::CipherInstanceSource
or
source instanceof Cryptography::CipherSource
}
}

23
python/ql/src/semmle/python/security/Paths.qll
View File

@@ -1,9 +1,20 @@
import python
import semmle.python.dataflow.Implementation
import semmle.python.security.TaintTracking
module TaintTrackingPaths {
predicate edge(TaintTrackingNode src, TaintTrackingNode dest, string label) {
exists(TaintTrackingNode source, TaintTrackingNode sink |
source.getConfiguration().hasFlowPath(source, sink) and
source.getASuccessor*() = src and
src.getASuccessor(label) = dest and
dest.getASuccessor*() = sink
)
}
query predicate edges(TaintedNode fromnode, TaintedNode tonode) {
fromnode.getASuccessor() = tonode and
/* Don't record flow past sinks */
not fromnode.isSink()
}
query predicate edges(TaintTrackingNode fromnode, TaintTrackingNode tonode) {
TaintTrackingPaths::edge(fromnode, tonode, _)
}

2
python/ql/src/semmle/python/security/TaintTest.qll
View File

@@ -4,4 +4,4 @@
import python
import TaintTracking::TaintFlowImplementation as TaintFlowTest
import semmle.python.dataflow.Implementation as TaintFlowTest

1277
python/ql/src/semmle/python/security/TaintTracking.qll
View File

File diff suppressed because it is too large Load Diff

4
python/ql/src/semmle/python/web/Http.qll
View File

@@ -1,5 +1,5 @@
import python
import semmle.python.security.TaintTracking
import semmle.python.dataflow.Implementation
import semmle.python.security.strings.External
import HttpConstants
@@ -16,7 +16,7 @@ class WsgiEnvironment extends TaintKind {
WsgiEnvironment() { this = "wsgi.environment" }
override TaintKind getTaintForFlowStep(ControlFlowNode fromnode, ControlFlowNode tonode) {
result = this and TaintFlowImplementation::copyCall(fromnode, tonode)
result = this and Implementation::copyCall(fromnode, tonode)
or
result = this and
tonode.(CallNode).getFunction().refersTo(theDictType()) and

93
python/ql/test/library-tests/taint/config/RockPaperScissors.expected Normal file
View File

@@ -0,0 +1,93 @@
edges
| carrier.py:17:9:17:31 | .attr = simple.test | carrier.py:18:10:18:10 | .attr = simple.test |
| carrier.py:17:25:17:30 | simple.test | carrier.py:17:9:17:31 | .attr = simple.test |
| carrier.py:18:10:18:10 | .attr = simple.test | carrier.py:18:10:18:15 | simple.test |
| carrier.py:21:9:21:28 | explicit.carrier | carrier.py:22:10:22:10 | explicit.carrier |
| carrier.py:22:10:22:10 | explicit.carrier | carrier.py:22:10:22:22 | simple.test |
| carrier.py:25:9:25:36 | .attr = simple.test | carrier.py:26:10:26:10 | .attr = simple.test |
| carrier.py:25:13:25:35 | .attr = simple.test | carrier.py:25:9:25:36 | .attr = simple.test |
| carrier.py:25:29:25:34 | simple.test | carrier.py:25:13:25:35 | .attr = simple.test |
| carrier.py:26:10:26:10 | .attr = simple.test | carrier.py:26:10:26:21 | simple.test |
| carrier.py:29:9:29:33 | explicit.carrier | carrier.py:30:10:30:10 | explicit.carrier |
| carrier.py:29:13:29:32 | explicit.carrier | carrier.py:29:9:29:33 | explicit.carrier |
| carrier.py:30:10:30:10 | explicit.carrier | carrier.py:30:10:30:22 | simple.test |
| carrier.py:33:9:33:45 | .attr = explicit.carrier | carrier.py:34:9:34:9 | .attr = explicit.carrier |
| carrier.py:33:25:33:44 | explicit.carrier | carrier.py:33:9:33:45 | .attr = explicit.carrier |
| carrier.py:34:9:34:9 | .attr = explicit.carrier | carrier.py:34:9:34:14 | explicit.carrier |
| carrier.py:34:9:34:14 | explicit.carrier | carrier.py:35:10:35:10 | explicit.carrier |
| carrier.py:35:10:35:10 | explicit.carrier | carrier.py:35:10:35:22 | simple.test |
| deep.py:20:5:20:14 | simple.test | deep.py:22:6:22:6 | simple.test |
| deep.py:20:8:20:13 | simple.test | deep.py:20:5:20:14 | simple.test |
| module.py:3:13:3:18 | simple.test | test.py:85:8:85:13 | .dangerous = simple.test |
| module.py:3:13:3:18 | simple.test | test.py:88:9:88:14 | .dangerous = simple.test |
| module.py:3:13:3:18 | simple.test | test.py:110:11:110:16 | .dangerous = simple.test |
| module.py:3:13:3:18 | simple.test | test.py:115:11:115:16 | .dangerous = simple.test |
| module.py:3:13:3:18 | simple.test | test.py:155:20:155:38 | simple.test |
| module.py:7:12:7:17 | simple.test | test.py:100:9:100:31 | simple.test |
| rockpaperscissors.py:24:9:24:12 | rock | rockpaperscissors.py:25:9:25:9 | rock |
| rockpaperscissors.py:25:9:25:9 | rock | rockpaperscissors.py:25:9:25:16 | scissors |
| rockpaperscissors.py:25:9:25:16 | scissors | rockpaperscissors.py:25:9:25:23 | paper |
| rockpaperscissors.py:25:9:25:23 | paper | rockpaperscissors.py:26:14:26:14 | paper |
| test.py:6:9:6:14 | simple.test | test.py:7:10:7:10 | simple.test |
| test.py:10:12:10:17 | simple.test | test.py:16:9:16:16 | simple.test |
| test.py:10:12:10:17 | simple.test | test.py:24:9:24:16 | simple.test |
| test.py:10:12:10:17 | simple.test | test.py:44:12:44:22 | simple.test |
| test.py:12:10:12:12 | simple.test | test.py:13:10:13:12 | simple.test |
| test.py:16:9:16:16 | simple.test | test.py:17:10:17:10 | simple.test |
| test.py:20:9:20:14 | simple.test | test.py:21:10:21:10 | simple.test |
| test.py:21:10:21:10 | simple.test | test.py:12:10:12:12 | simple.test |
| test.py:24:9:24:16 | simple.test | test.py:25:10:25:10 | simple.test |
| test.py:25:10:25:10 | simple.test | test.py:12:10:12:12 | simple.test |
| test.py:37:13:37:18 | simple.test | test.py:41:14:41:14 | simple.test |
| test.py:44:12:44:22 | simple.test | test.py:54:9:54:17 | simple.test |
| test.py:46:11:46:13 | simple.test | test.py:47:10:47:12 | simple.test |
| test.py:47:10:47:12 | simple.test | test.py:12:10:12:12 | simple.test |
| test.py:49:17:49:19 | simple.test | test.py:51:14:51:16 | simple.test |
| test.py:51:14:51:16 | simple.test | test.py:12:10:12:12 | simple.test |
| test.py:54:9:54:17 | simple.test | test.py:55:11:55:11 | simple.test |
| test.py:55:11:55:11 | simple.test | test.py:46:11:46:13 | simple.test |
| test.py:62:13:62:18 | simple.test | test.py:63:17:63:17 | simple.test |
| test.py:63:17:63:17 | simple.test | test.py:49:17:49:19 | simple.test |
| test.py:67:13:67:18 | simple.test | test.py:70:17:70:17 | simple.test |
| test.py:70:17:70:17 | simple.test | test.py:49:17:49:19 | simple.test |
| test.py:76:9:76:14 | simple.test | test.py:77:13:77:13 | simple.test |
| test.py:77:9:77:14 | simple.test | test.py:78:10:78:10 | simple.test |
| test.py:77:13:77:13 | simple.test | test.py:77:9:77:14 | simple.test |
| test.py:85:8:85:13 | .dangerous = simple.test | test.py:88:9:88:14 | .dangerous = simple.test |
| test.py:85:8:85:13 | .dangerous = simple.test | test.py:110:11:110:16 | .dangerous = simple.test |
| test.py:85:8:85:13 | .dangerous = simple.test | test.py:115:11:115:16 | .dangerous = simple.test |
| test.py:88:9:88:14 | .dangerous = simple.test | test.py:88:9:88:24 | simple.test |
| test.py:88:9:88:24 | simple.test | test.py:89:10:89:10 | simple.test |
| test.py:100:9:100:31 | simple.test | test.py:101:10:101:10 | simple.test |
| test.py:105:12:105:14 | .x = simple.test | test.py:106:10:106:12 | .x = simple.test |
| test.py:106:10:106:12 | .x = simple.test | test.py:106:10:106:14 | simple.test |
| test.py:110:11:110:16 | .dangerous = simple.test | test.py:110:11:110:26 | simple.test |
| test.py:110:11:110:26 | simple.test | test.py:111:10:111:10 | .x = simple.test |
| test.py:111:10:111:10 | .x = simple.test | test.py:111:10:111:12 | simple.test |
| test.py:115:11:115:16 | .dangerous = simple.test | test.py:115:11:115:26 | simple.test |
| test.py:115:11:115:26 | simple.test | test.py:116:13:116:13 | .x = simple.test |
| test.py:116:9:116:14 | .x = simple.test | test.py:117:12:117:12 | .x = simple.test |
| test.py:116:13:116:13 | .x = simple.test | test.py:116:9:116:14 | .x = simple.test |
| test.py:117:12:117:12 | .x = simple.test | test.py:105:12:105:14 | .x = simple.test |
| test.py:126:13:126:25 | simple.test | test.py:130:21:130:21 | simple.test |
| test.py:128:13:128:18 | simple.test | test.py:132:14:132:14 | simple.test |
| test.py:155:20:155:38 | simple.test | test.py:156:6:156:11 | simple.test |
| test.py:159:10:159:15 | simple.test | test.py:160:14:160:14 | simple.test |
| test.py:163:9:163:14 | simple.test | test.py:165:10:165:10 | simple.test |
| test.py:178:9:178:14 | simple.test | test.py:180:14:180:14 | simple.test |
| test.py:178:9:178:14 | simple.test | test.py:186:14:186:14 | simple.test |
| test.py:195:9:195:14 | simple.test | test.py:197:14:197:14 | simple.test |
| test.py:195:9:195:14 | simple.test | test.py:199:14:199:14 | simple.test |
| test.py:208:11:208:18 | sequence of simple.test | test.py:209:14:209:16 | sequence of simple.test |
| test.py:208:12:208:17 | simple.test | test.py:208:11:208:18 | sequence of simple.test |
| test.py:209:5:209:17 | simple.test | test.py:210:15:210:15 | simple.test |
| test.py:209:14:209:16 | sequence of simple.test | test.py:209:5:209:17 | simple.test |
| test.py:210:15:210:15 | simple.test | test.py:213:14:213:32 | iterable.simple |
| test.py:210:15:210:15 | simple.test | test.py:213:14:213:32 | sequence of simple.test |
| test.py:213:5:213:33 | simple.test | test.py:214:14:214:14 | simple.test |
| test.py:213:14:213:32 | iterable.simple | test.py:213:5:213:33 | simple.test |
| test.py:213:14:213:32 | sequence of simple.test | test.py:213:5:213:33 | simple.test |
#select
| rockpaperscissors.py:13:10:13:17 | SCISSORS | rockpaperscissors.py:13:10:13:17 | scissors | rockpaperscissors.py:13:10:13:17 | scissors | $@ loses to $@. | rockpaperscissors.py:13:10:13:17 | SCISSORS | scissors | rockpaperscissors.py:13:10:13:17 | SCISSORS | scissors |
| rockpaperscissors.py:16:11:16:14 | ROCK | rockpaperscissors.py:16:11:16:14 | rock | rockpaperscissors.py:16:11:16:14 | rock | $@ loses to $@. | rockpaperscissors.py:16:11:16:14 | ROCK | rock | rockpaperscissors.py:16:11:16:14 | ROCK | rock |
| rockpaperscissors.py:26:14:26:14 | y | rockpaperscissors.py:24:9:24:12 | rock | rockpaperscissors.py:26:14:26:14 | paper | $@ loses to $@. | rockpaperscissors.py:24:9:24:12 | ROCK | rock | rockpaperscissors.py:26:14:26:14 | y | paper |

13
python/ql/test/library-tests/taint/config/RockPaperScissors.ql Normal file
View File

@@ -0,0 +1,13 @@
/**
* @kind path-problem
*/
import python
import semmle.python.security.TaintTracking
import TaintLib
import semmle.python.security.Paths
from RockPaperScissorConfig config, TaintedPathSource src, TaintedPathSink sink
where config.hasFlowPath(src, sink)
select sink.getSink(), src, sink, "$@ loses to $@.", src.getNode(), src.getTaintKind().toString(), sink.getNode(), sink.getTaintKind().toString()

115
python/ql/test/library-tests/taint/config/Simple.expected Normal file
View File

@@ -0,0 +1,115 @@
edges
| carrier.py:17:9:17:31 | .attr = simple.test | carrier.py:18:10:18:10 | .attr = simple.test |
| carrier.py:17:25:17:30 | simple.test | carrier.py:17:9:17:31 | .attr = simple.test |
| carrier.py:18:10:18:10 | .attr = simple.test | carrier.py:18:10:18:15 | simple.test |
| carrier.py:21:9:21:28 | explicit.carrier | carrier.py:22:10:22:10 | explicit.carrier |
| carrier.py:22:10:22:10 | explicit.carrier | carrier.py:22:10:22:22 | simple.test |
| carrier.py:25:9:25:36 | .attr = simple.test | carrier.py:26:10:26:10 | .attr = simple.test |
| carrier.py:25:13:25:35 | .attr = simple.test | carrier.py:25:9:25:36 | .attr = simple.test |
| carrier.py:25:29:25:34 | simple.test | carrier.py:25:13:25:35 | .attr = simple.test |
| carrier.py:26:10:26:10 | .attr = simple.test | carrier.py:26:10:26:21 | simple.test |
| carrier.py:29:9:29:33 | explicit.carrier | carrier.py:30:10:30:10 | explicit.carrier |
| carrier.py:29:13:29:32 | explicit.carrier | carrier.py:29:9:29:33 | explicit.carrier |
| carrier.py:30:10:30:10 | explicit.carrier | carrier.py:30:10:30:22 | simple.test |
| carrier.py:33:9:33:45 | .attr = explicit.carrier | carrier.py:34:9:34:9 | .attr = explicit.carrier |
| carrier.py:33:25:33:44 | explicit.carrier | carrier.py:33:9:33:45 | .attr = explicit.carrier |
| carrier.py:34:9:34:9 | .attr = explicit.carrier | carrier.py:34:9:34:14 | explicit.carrier |
| carrier.py:34:9:34:14 | explicit.carrier | carrier.py:35:10:35:10 | explicit.carrier |
| carrier.py:35:10:35:10 | explicit.carrier | carrier.py:35:10:35:22 | simple.test |
| deep.py:20:5:20:14 | simple.test | deep.py:22:6:22:6 | simple.test |
| deep.py:20:8:20:13 | simple.test | deep.py:20:5:20:14 | simple.test |
| module.py:3:13:3:18 | simple.test | test.py:85:8:85:13 | .dangerous = simple.test |
| module.py:3:13:3:18 | simple.test | test.py:88:9:88:14 | .dangerous = simple.test |
| module.py:3:13:3:18 | simple.test | test.py:110:11:110:16 | .dangerous = simple.test |
| module.py:3:13:3:18 | simple.test | test.py:115:11:115:16 | .dangerous = simple.test |
| module.py:3:13:3:18 | simple.test | test.py:155:20:155:38 | simple.test |
| module.py:7:12:7:17 | simple.test | test.py:100:9:100:31 | simple.test |
| rockpaperscissors.py:24:9:24:12 | rock | rockpaperscissors.py:25:9:25:9 | rock |
| rockpaperscissors.py:25:9:25:9 | rock | rockpaperscissors.py:25:9:25:16 | scissors |
| rockpaperscissors.py:25:9:25:16 | scissors | rockpaperscissors.py:25:9:25:23 | paper |
| rockpaperscissors.py:25:9:25:23 | paper | rockpaperscissors.py:26:14:26:14 | paper |
| test.py:6:9:6:14 | simple.test | test.py:7:10:7:10 | simple.test |
| test.py:10:12:10:17 | simple.test | test.py:16:9:16:16 | simple.test |
| test.py:10:12:10:17 | simple.test | test.py:24:9:24:16 | simple.test |
| test.py:10:12:10:17 | simple.test | test.py:44:12:44:22 | simple.test |
| test.py:12:10:12:12 | simple.test | test.py:13:10:13:12 | simple.test |
| test.py:16:9:16:16 | simple.test | test.py:17:10:17:10 | simple.test |
| test.py:20:9:20:14 | simple.test | test.py:21:10:21:10 | simple.test |
| test.py:21:10:21:10 | simple.test | test.py:12:10:12:12 | simple.test |
| test.py:24:9:24:16 | simple.test | test.py:25:10:25:10 | simple.test |
| test.py:25:10:25:10 | simple.test | test.py:12:10:12:12 | simple.test |
| test.py:37:13:37:18 | simple.test | test.py:41:14:41:14 | simple.test |
| test.py:44:12:44:22 | simple.test | test.py:54:9:54:17 | simple.test |
| test.py:46:11:46:13 | simple.test | test.py:47:10:47:12 | simple.test |
| test.py:47:10:47:12 | simple.test | test.py:12:10:12:12 | simple.test |
| test.py:49:17:49:19 | simple.test | test.py:51:14:51:16 | simple.test |
| test.py:51:14:51:16 | simple.test | test.py:12:10:12:12 | simple.test |
| test.py:54:9:54:17 | simple.test | test.py:55:11:55:11 | simple.test |
| test.py:55:11:55:11 | simple.test | test.py:46:11:46:13 | simple.test |
| test.py:62:13:62:18 | simple.test | test.py:63:17:63:17 | simple.test |
| test.py:63:17:63:17 | simple.test | test.py:49:17:49:19 | simple.test |
| test.py:67:13:67:18 | simple.test | test.py:70:17:70:17 | simple.test |
| test.py:70:17:70:17 | simple.test | test.py:49:17:49:19 | simple.test |
| test.py:76:9:76:14 | simple.test | test.py:77:13:77:13 | simple.test |
| test.py:77:9:77:14 | simple.test | test.py:78:10:78:10 | simple.test |
| test.py:77:13:77:13 | simple.test | test.py:77:9:77:14 | simple.test |
| test.py:85:8:85:13 | .dangerous = simple.test | test.py:88:9:88:14 | .dangerous = simple.test |
| test.py:85:8:85:13 | .dangerous = simple.test | test.py:110:11:110:16 | .dangerous = simple.test |
| test.py:85:8:85:13 | .dangerous = simple.test | test.py:115:11:115:16 | .dangerous = simple.test |
| test.py:88:9:88:14 | .dangerous = simple.test | test.py:88:9:88:24 | simple.test |
| test.py:88:9:88:24 | simple.test | test.py:89:10:89:10 | simple.test |
| test.py:100:9:100:31 | simple.test | test.py:101:10:101:10 | simple.test |
| test.py:105:12:105:14 | .x = simple.test | test.py:106:10:106:12 | .x = simple.test |
| test.py:106:10:106:12 | .x = simple.test | test.py:106:10:106:14 | simple.test |
| test.py:110:11:110:16 | .dangerous = simple.test | test.py:110:11:110:26 | simple.test |
| test.py:110:11:110:26 | simple.test | test.py:111:10:111:10 | .x = simple.test |
| test.py:111:10:111:10 | .x = simple.test | test.py:111:10:111:12 | simple.test |
| test.py:115:11:115:16 | .dangerous = simple.test | test.py:115:11:115:26 | simple.test |
| test.py:115:11:115:26 | simple.test | test.py:116:13:116:13 | .x = simple.test |
| test.py:116:9:116:14 | .x = simple.test | test.py:117:12:117:12 | .x = simple.test |
| test.py:116:13:116:13 | .x = simple.test | test.py:116:9:116:14 | .x = simple.test |
| test.py:117:12:117:12 | .x = simple.test | test.py:105:12:105:14 | .x = simple.test |
| test.py:126:13:126:25 | simple.test | test.py:130:21:130:21 | simple.test |
| test.py:128:13:128:18 | simple.test | test.py:132:14:132:14 | simple.test |
| test.py:155:20:155:38 | simple.test | test.py:156:6:156:11 | simple.test |
| test.py:159:10:159:15 | simple.test | test.py:160:14:160:14 | simple.test |
| test.py:163:9:163:14 | simple.test | test.py:165:10:165:10 | simple.test |
| test.py:178:9:178:14 | simple.test | test.py:180:14:180:14 | simple.test |
| test.py:178:9:178:14 | simple.test | test.py:186:14:186:14 | simple.test |
| test.py:195:9:195:14 | simple.test | test.py:197:14:197:14 | simple.test |
| test.py:195:9:195:14 | simple.test | test.py:199:14:199:14 | simple.test |
| test.py:208:11:208:18 | sequence of simple.test | test.py:209:14:209:16 | sequence of simple.test |
| test.py:208:12:208:17 | simple.test | test.py:208:11:208:18 | sequence of simple.test |
| test.py:209:5:209:17 | simple.test | test.py:210:15:210:15 | simple.test |
| test.py:209:14:209:16 | sequence of simple.test | test.py:209:5:209:17 | simple.test |
| test.py:210:15:210:15 | simple.test | test.py:213:14:213:32 | iterable.simple |
| test.py:210:15:210:15 | simple.test | test.py:213:14:213:32 | sequence of simple.test |
| test.py:213:5:213:33 | simple.test | test.py:214:14:214:14 | simple.test |
| test.py:213:14:213:32 | iterable.simple | test.py:213:5:213:33 | simple.test |
| test.py:213:14:213:32 | sequence of simple.test | test.py:213:5:213:33 | simple.test |
#select
| carrier.py:18:10:18:15 | Attribute | carrier.py:17:25:17:30 | simple.test | carrier.py:18:10:18:15 | simple.test | $@ flows to $@. | carrier.py:17:25:17:30 | SOURCE | simple.test | carrier.py:18:10:18:15 | Attribute | simple.test |
| carrier.py:26:10:26:21 | Attribute() | carrier.py:25:29:25:34 | simple.test | carrier.py:26:10:26:21 | simple.test | $@ flows to $@. | carrier.py:25:29:25:34 | SOURCE | simple.test | carrier.py:26:10:26:21 | Attribute() | simple.test |
| deep.py:22:6:22:6 | x | deep.py:20:8:20:13 | simple.test | deep.py:22:6:22:6 | simple.test | $@ flows to $@. | deep.py:20:8:20:13 | SOURCE | simple.test | deep.py:22:6:22:6 | x | simple.test |
| test.py:3:10:3:15 | SOURCE | test.py:3:10:3:15 | simple.test | test.py:3:10:3:15 | simple.test | $@ flows to $@. | test.py:3:10:3:15 | SOURCE | simple.test | test.py:3:10:3:15 | SOURCE | simple.test |
| test.py:7:10:7:10 | s | test.py:6:9:6:14 | simple.test | test.py:7:10:7:10 | simple.test | $@ flows to $@. | test.py:6:9:6:14 | SOURCE | simple.test | test.py:7:10:7:10 | s | simple.test |
| test.py:13:10:13:12 | arg | test.py:10:12:10:17 | simple.test | test.py:13:10:13:12 | simple.test | $@ flows to $@. | test.py:10:12:10:17 | SOURCE | simple.test | test.py:13:10:13:12 | arg | simple.test |
| test.py:13:10:13:12 | arg | test.py:20:9:20:14 | simple.test | test.py:13:10:13:12 | simple.test | $@ flows to $@. | test.py:20:9:20:14 | SOURCE | simple.test | test.py:13:10:13:12 | arg | simple.test |
| test.py:13:10:13:12 | arg | test.py:62:13:62:18 | simple.test | test.py:13:10:13:12 | simple.test | $@ flows to $@. | test.py:62:13:62:18 | SOURCE | simple.test | test.py:13:10:13:12 | arg | simple.test |
| test.py:13:10:13:12 | arg | test.py:67:13:67:18 | simple.test | test.py:13:10:13:12 | simple.test | $@ flows to $@. | test.py:67:13:67:18 | SOURCE | simple.test | test.py:13:10:13:12 | arg | simple.test |
| test.py:17:10:17:10 | t | test.py:10:12:10:17 | simple.test | test.py:17:10:17:10 | simple.test | $@ flows to $@. | test.py:10:12:10:17 | SOURCE | simple.test | test.py:17:10:17:10 | t | simple.test |
| test.py:41:14:41:14 | t | test.py:37:13:37:18 | simple.test | test.py:41:14:41:14 | simple.test | $@ flows to $@. | test.py:37:13:37:18 | SOURCE | simple.test | test.py:41:14:41:14 | t | simple.test |
| test.py:78:10:78:10 | t | test.py:76:9:76:14 | simple.test | test.py:78:10:78:10 | simple.test | $@ flows to $@. | test.py:76:9:76:14 | SOURCE | simple.test | test.py:78:10:78:10 | t | simple.test |
| test.py:89:10:89:10 | t | module.py:3:13:3:18 | simple.test | test.py:89:10:89:10 | simple.test | $@ flows to $@. | module.py:3:13:3:18 | SOURCE | simple.test | test.py:89:10:89:10 | t | simple.test |
| test.py:101:10:101:10 | t | module.py:7:12:7:17 | simple.test | test.py:101:10:101:10 | simple.test | $@ flows to $@. | module.py:7:12:7:17 | SOURCE | simple.test | test.py:101:10:101:10 | t | simple.test |
| test.py:106:10:106:14 | Attribute | module.py:3:13:3:18 | simple.test | test.py:106:10:106:14 | simple.test | $@ flows to $@. | module.py:3:13:3:18 | SOURCE | simple.test | test.py:106:10:106:14 | Attribute | simple.test |
| test.py:111:10:111:12 | Attribute | module.py:3:13:3:18 | simple.test | test.py:111:10:111:12 | simple.test | $@ flows to $@. | module.py:3:13:3:18 | SOURCE | simple.test | test.py:111:10:111:12 | Attribute | simple.test |
| test.py:132:14:132:14 | t | test.py:128:13:128:18 | simple.test | test.py:132:14:132:14 | simple.test | $@ flows to $@. | test.py:128:13:128:18 | SOURCE | simple.test | test.py:132:14:132:14 | t | simple.test |
| test.py:156:6:156:11 | unsafe | module.py:3:13:3:18 | simple.test | test.py:156:6:156:11 | simple.test | $@ flows to $@. | module.py:3:13:3:18 | SOURCE | simple.test | test.py:156:6:156:11 | unsafe | simple.test |
| test.py:160:14:160:14 | t | test.py:159:10:159:15 | simple.test | test.py:160:14:160:14 | simple.test | $@ flows to $@. | test.py:159:10:159:15 | SOURCE | simple.test | test.py:160:14:160:14 | t | simple.test |
| test.py:165:10:165:10 | s | test.py:163:9:163:14 | simple.test | test.py:165:10:165:10 | simple.test | $@ flows to $@. | test.py:163:9:163:14 | SOURCE | simple.test | test.py:165:10:165:10 | s | simple.test |
| test.py:180:14:180:14 | t | test.py:178:9:178:14 | simple.test | test.py:180:14:180:14 | simple.test | $@ flows to $@. | test.py:178:9:178:14 | SOURCE | simple.test | test.py:180:14:180:14 | t | simple.test |
| test.py:186:14:186:14 | t | test.py:178:9:178:14 | simple.test | test.py:186:14:186:14 | simple.test | $@ flows to $@. | test.py:178:9:178:14 | SOURCE | simple.test | test.py:186:14:186:14 | t | simple.test |
| test.py:197:14:197:14 | t | test.py:195:9:195:14 | simple.test | test.py:197:14:197:14 | simple.test | $@ flows to $@. | test.py:195:9:195:14 | SOURCE | simple.test | test.py:197:14:197:14 | t | simple.test |
| test.py:199:14:199:14 | t | test.py:195:9:195:14 | simple.test | test.py:199:14:199:14 | simple.test | $@ flows to $@. | test.py:195:9:195:14 | SOURCE | simple.test | test.py:199:14:199:14 | t | simple.test |
| test.py:214:14:214:14 | x | test.py:208:12:208:17 | simple.test | test.py:214:14:214:14 | simple.test | $@ flows to $@. | test.py:208:12:208:17 | SOURCE | simple.test | test.py:214:14:214:14 | x | simple.test |

13
python/ql/test/library-tests/taint/config/Simple.ql Normal file
View File

@@ -0,0 +1,13 @@
/**
* @kind path-problem
*/
import python
import semmle.python.security.TaintTracking
import TaintLib
import semmle.python.security.Paths
from SimpleConfig config, TaintedPathSource src, TaintedPathSink sink
where config.hasFlowPath(src, sink)
select sink.getSink(), src, sink, "$@ flows to $@.", src.getNode(), src.getTaintKind().toString(), sink.getNode(), sink.getTaintKind().toString()

336
python/ql/test/library-tests/taint/config/TaintLib.qll Normal file
View File

@@ -0,0 +1,336 @@
import python
import semmle.python.security.TaintTracking
class SimpleTest extends TaintKind {
SimpleTest() {
this = "simple.test"
}
}
abstract class TestConfig extends TaintTracking::Configuration {
bindingset[this]
TestConfig() { any() }
}
class SimpleConfig extends TestConfig {
SimpleConfig() { this = "Simple config" }
override predicate isSource(DataFlow::Node node, TaintKind kind) {
node.asCfgNode().(NameNode).getId() = "SOURCE" and
kind instanceof SimpleTest
}
override predicate isSink(DataFlow::Node node, TaintKind kind) {
exists(CallNode call |
call.getFunction().(NameNode).getId() = "SINK" and
node.asCfgNode() = call.getAnArg()
) and
kind instanceof SimpleTest
}
override predicate isBarrier(DataFlow::Node node, TaintKind kind) {
node.asCfgNode().(CallNode).getFunction().(NameNode).getId() = "SANITIZE" and
kind instanceof SimpleTest
}
}
class BasicCustomTaint extends TaintKind {
BasicCustomTaint() {
this = "basic.custom"
}
override TaintKind getTaintForFlowStep(ControlFlowNode fromnode, ControlFlowNode tonode) {
tonode.(CallNode).getAnArg() = fromnode and
tonode.(CallNode).getFunction().(NameNode).getId() = "TAINT_FROM_ARG" and
result = this
}
}
class BasicCustomConfig extends TestConfig {
BasicCustomConfig() { this = "Basic custom config" }
override predicate isSource(DataFlow::Node node, TaintKind kind) {
node.asCfgNode().(NameNode).getId() = "CUSTOM_SOURCE" and
kind instanceof SimpleTest
}
override predicate isSink(DataFlow::Node node, TaintKind kind) {
exists(CallNode call |
call.getFunction().(NameNode).getId() = "CUSTOM_SINK" and
node.asCfgNode() = call.getAnArg()
) and
kind instanceof SimpleTest
}
}
class Rock extends TaintKind {
Rock() { this = "rock" }
override TaintKind getTaintOfMethodResult(string name) {
name = "prev" and result instanceof Scissors
}
}
class Paper extends TaintKind {
Paper() { this = "paper" }
override TaintKind getTaintOfMethodResult(string name) {
name = "prev" and result instanceof Rock
}
}
class Scissors extends TaintKind {
Scissors() { this = "scissors" }
override TaintKind getTaintOfMethodResult(string name) {
name = "prev" and result instanceof Paper
}
}
class RockPaperScissorConfig extends TestConfig {
RockPaperScissorConfig() { this = "Rock-paper-scissors config" }
override predicate isSource(DataFlow::Node node, TaintKind kind) {
exists(string name |
node.asCfgNode().(NameNode).getId() = name and
kind = name.toLowerCase()
|
name = "ROCK" or name = "PAPER" or name = "SCISSORS"
)
}
override predicate isSink(DataFlow::Node node, TaintKind kind) {
exists(string name |
function_param(name, node) |
name = "paper" and kind = "rock"
or
name = "rock" and kind = "scissors"
or
name = "scissors" and kind = "paper"
)
}
}
private predicate function_param(string funcname, DataFlow::Node arg) {
exists(FunctionObject f |
f.getName() = funcname and
arg.asCfgNode() = f.getArgumentForCall(_, _)
)
}
class TaintCarrier extends TaintKind {
TaintCarrier() { this = "explicit.carrier" }
override TaintKind getTaintOfMethodResult(string name) {
name = "get_taint" and result instanceof SimpleTest
}
}
class TaintCarrierConfig extends TestConfig {
TaintCarrierConfig() { this = "Taint carrier config" }
override predicate isSource(DataFlow::Node node, TaintKind kind) {
node.asCfgNode().(NameNode).getId() = "TAINT_CARRIER_SOURCE" and
kind instanceof TaintCarrier
}
override predicate isSink(DataFlow::Node node, TaintKind kind) {
exists(CallNode call |
call.getFunction().(NameNode).getId() = "SINK" and
node.asCfgNode() = call.getAnArg()
) and
kind instanceof SimpleTest
}
override predicate isBarrier(DataFlow::Node node, TaintKind kind) {
node.asCfgNode().(CallNode).getFunction().(NameNode).getId() = "SANITIZE" and
kind instanceof SimpleTest
}
}
/* Some more realistic examples */
abstract class UserInput extends TaintKind {
bindingset[this]
UserInput() { any() }
}
class UserInputSource extends TaintSource {
UserInputSource() {
this.(CallNode).getFunction().(NameNode).getId() = "user_input"
}
override predicate isSourceOf(TaintKind kind) {
kind instanceof UserInput
}
override string toString() {
result = "user.input.source"
}
}
class SqlInjectionTaint extends UserInput {
SqlInjectionTaint() { this = "SQL injection" }
}
class CommandInjectionTaint extends UserInput {
CommandInjectionTaint() { this = "Command injection" }
}
class SqlSanitizer extends Sanitizer {
SqlSanitizer() { this = "SQL sanitizer" }
/** Holds if `test` shows value to be untainted with `taint` */
override predicate sanitizingEdge(TaintKind taint, PyEdgeRefinement test) {
exists(FunctionObject f, CallNode call |
f.getName() = "isEscapedSql" and
test.getTest() = call and
call.getAnArg() = test.getSourceVariable().getAUse() and
f.getACall() = call and
test.getSense() = true
) and
taint instanceof SqlInjectionTaint
}
}
class CommandSanitizer extends Sanitizer {
CommandSanitizer() { this = "Command sanitizer" }
/** Holds if `test` shows value to be untainted with `taint` */
override predicate sanitizingEdge(TaintKind taint, PyEdgeRefinement test) {
exists(FunctionObject f |
f.getName() = "isValidCommand" and
f.getACall().(CallNode).getAnArg() = test.getSourceVariable().getAUse() and
test.getSense() = true
) and
taint instanceof CommandInjectionTaint
}
}
class SqlQuery extends TaintSink {
SqlQuery() {
exists(CallNode call |
call.getFunction().(NameNode).getId() = "sql_query" and
call.getAnArg() = this
)
}
override string toString() { result = "SQL query" }
override predicate sinks(TaintKind taint) {
taint instanceof SqlInjectionTaint
}
}
class OsCommand extends TaintSink {
OsCommand() {
exists(CallNode call |
call.getFunction().(NameNode).getId() = "os_command" and
call.getAnArg() = this
)
}
override string toString() { result = "OS command" }
override predicate sinks(TaintKind taint) {
taint instanceof CommandInjectionTaint
}
}
class Falsey extends TaintKind {
Falsey() { this = "falsey" }
override boolean booleanValue() {
result = false
}
}
class FalseySource extends TaintSource {
FalseySource() {
this.(NameNode).getId() = "FALSEY"
}
override predicate isSourceOf(TaintKind kind) {
kind instanceof Falsey
}
override string toString() {
result = "falsey.source"
}
}
class TaintIterable extends TaintKind {
TaintIterable() {
this = "iterable.simple"
}
override TaintKind getTaintForIteration() {
result instanceof SimpleTest
}
}
class TaintIterableSource extends TaintSource {
TaintIterableSource() {
this.(NameNode).getId() = "ITERABLE_SOURCE"
}
override predicate isSourceOf(TaintKind kind) {
kind instanceof TaintIterable
}
}

29
python/ql/test/library-tests/taint/config/TaintedArgument.expected Normal file
View File

@@ -0,0 +1,29 @@
| Rock-paper-scissors config | rockpaperscissors.py:13:10:13:17 | scissors | rockpaperscissors.py:13:5:13:18 | ControlFlowNode for rock() | | rockpaperscissors.py:3:1:3:14 | Function rock | 0 | no attribute | scissors |
| Rock-paper-scissors config | rockpaperscissors.py:16:11:16:14 | rock | rockpaperscissors.py:16:5:16:15 | ControlFlowNode for paper() | | rockpaperscissors.py:6:1:6:15 | Function paper | 0 | no attribute | rock |
| Rock-paper-scissors config | rockpaperscissors.py:21:14:21:14 | scissors | rockpaperscissors.py:21:5:21:15 | ControlFlowNode for scissors() | | rockpaperscissors.py:9:1:9:18 | Function scissors | 0 | no attribute | scissors |
| Rock-paper-scissors config | rockpaperscissors.py:26:14:26:14 | paper | rockpaperscissors.py:26:5:26:15 | ControlFlowNode for scissors() | | rockpaperscissors.py:9:1:9:18 | Function scissors | 0 | no attribute | paper |
| Rock-paper-scissors config | rockpaperscissors.py:31:11:31:11 | scissors | rockpaperscissors.py:31:5:31:12 | ControlFlowNode for paper() | | rockpaperscissors.py:6:1:6:15 | Function paper | 0 | no attribute | scissors |
| Rock-paper-scissors config | rockpaperscissors.py:32:11:32:11 | paper | rockpaperscissors.py:32:5:32:12 | ControlFlowNode for paper() | | rockpaperscissors.py:6:1:6:15 | Function paper | 0 | no attribute | paper |
| Simple config | carrier.py:17:25:17:30 | simple.test | carrier.py:17:9:17:31 | ControlFlowNode for ImplicitCarrier() | | carrier.py:4:5:4:28 | Function ImplicitCarrier.__init__ | 1 | no attribute | simple.test |
| Simple config | carrier.py:25:13:25:35 | .attr = simple.test | carrier.py:25:9:25:36 | ControlFlowNode for hub() | | carrier.py:13:1:13:13 | Function hub | 0 | attribute attr | simple.test |
| Simple config | carrier.py:25:29:25:34 | simple.test | carrier.py:25:13:25:35 | ControlFlowNode for ImplicitCarrier() | | carrier.py:4:5:4:28 | Function ImplicitCarrier.__init__ | 1 | no attribute | simple.test |
| Simple config | carrier.py:26:10:26:10 | .attr = simple.test | carrier.py:26:10:26:21 | ControlFlowNode for Attribute() | | carrier.py:10:5:10:23 | Function ImplicitCarrier.get_attr | 0 | attribute attr | simple.test |
| Simple config | deep.py:6:15:6:17 | simple.test | deep.py:6:12:6:18 | ControlFlowNode for f1() | p0 = simple.test | deep.py:2:1:2:12 | Function f1 | 0 | no attribute | simple.test |
| Simple config | deep.py:9:15:9:17 | simple.test | deep.py:9:12:9:18 | ControlFlowNode for f2() | p0 = simple.test | deep.py:5:1:5:12 | Function f2 | 0 | no attribute | simple.test |
| Simple config | deep.py:12:15:12:17 | simple.test | deep.py:12:12:12:18 | ControlFlowNode for f3() | p0 = simple.test | deep.py:8:1:8:12 | Function f3 | 0 | no attribute | simple.test |
| Simple config | deep.py:15:15:15:17 | simple.test | deep.py:15:12:15:18 | ControlFlowNode for f4() | p0 = simple.test | deep.py:11:1:11:12 | Function f4 | 0 | no attribute | simple.test |
| Simple config | deep.py:18:15:18:17 | simple.test | deep.py:18:12:18:18 | ControlFlowNode for f5() | p0 = simple.test | deep.py:14:1:14:12 | Function f5 | 0 | no attribute | simple.test |
| Simple config | deep.py:20:8:20:13 | simple.test | deep.py:20:5:20:14 | ControlFlowNode for f6() | | deep.py:17:1:17:12 | Function f6 | 0 | no attribute | simple.test |
| Simple config | test.py:21:10:21:10 | simple.test | test.py:21:5:21:11 | ControlFlowNode for sink() | | test.py:12:1:12:14 | Function sink | 0 | no attribute | simple.test |
| Simple config | test.py:25:10:25:10 | simple.test | test.py:25:5:25:11 | ControlFlowNode for sink() | | test.py:12:1:12:14 | Function sink | 0 | no attribute | simple.test |
| Simple config | test.py:47:10:47:12 | simple.test | test.py:47:5:47:13 | ControlFlowNode for sink() | p0 = simple.test | test.py:12:1:12:14 | Function sink | 0 | no attribute | simple.test |
| Simple config | test.py:51:14:51:16 | simple.test | test.py:51:9:51:17 | ControlFlowNode for sink() | p1 = simple.test | test.py:12:1:12:14 | Function sink | 0 | no attribute | simple.test |
| Simple config | test.py:55:11:55:11 | simple.test | test.py:55:5:55:12 | ControlFlowNode for sink2() | | test.py:46:1:46:15 | Function sink2 | 0 | no attribute | simple.test |
| Simple config | test.py:63:17:63:17 | simple.test | test.py:63:5:63:18 | ControlFlowNode for sink3() | | test.py:49:1:49:21 | Function sink3 | 1 | no attribute | simple.test |
| Simple config | test.py:70:17:70:17 | simple.test | test.py:70:5:70:18 | ControlFlowNode for sink3() | | test.py:49:1:49:21 | Function sink3 | 1 | no attribute | simple.test |
| Simple config | test.py:77:13:77:13 | simple.test | test.py:77:9:77:14 | ControlFlowNode for hub() | | test.py:72:1:72:13 | Function hub | 0 | no attribute | simple.test |
| Simple config | test.py:116:13:116:13 | .x = simple.test | test.py:116:9:116:14 | ControlFlowNode for hub() | | test.py:72:1:72:13 | Function hub | 0 | attribute x | simple.test |
| Simple config | test.py:117:12:117:12 | .x = simple.test | test.py:117:5:117:13 | ControlFlowNode for x_sink() | | test.py:105:1:105:16 | Function x_sink | 0 | attribute x | simple.test |
| Simple config | test.py:196:19:196:19 | simple.test | test.py:196:8:196:25 | ControlFlowNode for isinstance() | | file://:0:0:0:0 | Builtin-function isinstance | 0 | no attribute | simple.test |
| Taint carrier config | carrier.py:29:13:29:32 | explicit.carrier | carrier.py:29:9:29:33 | ControlFlowNode for hub() | | carrier.py:13:1:13:13 | Function hub | 0 | no attribute | explicit.carrier |
| Taint carrier config | carrier.py:33:25:33:44 | explicit.carrier | carrier.py:33:9:33:45 | ControlFlowNode for ImplicitCarrier() | | carrier.py:4:5:4:28 | Function ImplicitCarrier.__init__ | 1 | no attribute | explicit.carrier |

14
python/ql/test/library-tests/taint/config/TaintedArgument.ql Normal file
View File

@@ -0,0 +1,14 @@
import python
import semmle.python.security.TaintTracking
import TaintLib
import semmle.python.dataflow.Implementation
from TaintTrackingImplementation config, TaintTrackingNode src, CallNode call,
TaintTrackingContext caller, CallableValue pyfunc, int arg, AttributePath path, TaintKind kind
where config instanceof TestConfig and
config.callWithTaintedArgument(src, call, caller, pyfunc, arg, path, kind)
select config, src, call, caller, pyfunc, arg, path, kind

314
python/ql/test/library-tests/taint/config/TestNode.expected Normal file
View File

@@ -0,0 +1,314 @@
| carrier.py:4 | explicit.carrier | SSA variable arg | no attribute | p1 = explicit.carrier |
| carrier.py:4 | explicit.carrier | arg | no attribute | p1 = explicit.carrier |
| carrier.py:4 | simple.test | SSA variable arg | no attribute | p1 = simple.test |
| carrier.py:4 | simple.test | arg | no attribute | p1 = simple.test |
| carrier.py:5 | explicit.carrier | SSA variable self | attribute attr | p1 = explicit.carrier |
| carrier.py:5 | explicit.carrier | arg | no attribute | p1 = explicit.carrier |
| carrier.py:5 | simple.test | SSA variable self | attribute attr | p1 = simple.test |
| carrier.py:5 | simple.test | arg | no attribute | p1 = simple.test |
| carrier.py:10 | simple.test | SSA variable self | attribute attr | p0.attr = simple.test |
| carrier.py:10 | simple.test | self | attribute attr | p0.attr = simple.test |
| carrier.py:11 | simple.test | Attribute | no attribute | p0.attr = simple.test |
| carrier.py:11 | simple.test | self | attribute attr | p0.attr = simple.test |
| carrier.py:13 | explicit.carrier | SSA variable arg | no attribute | p0 = explicit.carrier |
| carrier.py:13 | explicit.carrier | arg | no attribute | p0 = explicit.carrier |
| carrier.py:13 | simple.test | SSA variable arg | attribute attr | p0.attr = simple.test |
| carrier.py:13 | simple.test | arg | attribute attr | p0.attr = simple.test |
| carrier.py:14 | explicit.carrier | arg | no attribute | p0 = explicit.carrier |
| carrier.py:14 | simple.test | arg | attribute attr | p0.attr = simple.test |
| carrier.py:17 | simple.test | ImplicitCarrier() | attribute attr | |
| carrier.py:17 | simple.test | SOURCE | no attribute | |
| carrier.py:17 | simple.test | SSA variable c | attribute attr | |
| carrier.py:18 | simple.test | Attribute | no attribute | |
| carrier.py:18 | simple.test | c | attribute attr | |
| carrier.py:21 | explicit.carrier | SSA variable c | no attribute | |
| carrier.py:21 | explicit.carrier | TAINT_CARRIER_SOURCE | no attribute | |
| carrier.py:22 | explicit.carrier | SSA variable c | no attribute | |
| carrier.py:22 | explicit.carrier | c | no attribute | |
| carrier.py:22 | simple.test | Attribute() | no attribute | |
| carrier.py:25 | simple.test | ImplicitCarrier() | attribute attr | |
| carrier.py:25 | simple.test | SOURCE | no attribute | |
| carrier.py:25 | simple.test | SSA variable c | attribute attr | |
| carrier.py:25 | simple.test | hub() | attribute attr | |
| carrier.py:26 | simple.test | Attribute() | no attribute | |
| carrier.py:26 | simple.test | SSA variable c | attribute attr | |
| carrier.py:26 | simple.test | c | attribute attr | |
| carrier.py:29 | explicit.carrier | SSA variable c | no attribute | |
| carrier.py:29 | explicit.carrier | TAINT_CARRIER_SOURCE | no attribute | |
| carrier.py:29 | explicit.carrier | hub() | no attribute | |
| carrier.py:30 | explicit.carrier | SSA variable c | no attribute | |
| carrier.py:30 | explicit.carrier | c | no attribute | |
| carrier.py:30 | simple.test | Attribute() | no attribute | |
| carrier.py:33 | explicit.carrier | ImplicitCarrier() | attribute attr | |
| carrier.py:33 | explicit.carrier | SSA variable c | attribute attr | |
| carrier.py:33 | explicit.carrier | TAINT_CARRIER_SOURCE | no attribute | |
| carrier.py:34 | explicit.carrier | Attribute | no attribute | |
| carrier.py:34 | explicit.carrier | SSA variable x | no attribute | |
| carrier.py:34 | explicit.carrier | c | attribute attr | |
| carrier.py:35 | explicit.carrier | SSA variable x | no attribute | |
| carrier.py:35 | explicit.carrier | x | no attribute | |
| carrier.py:35 | simple.test | Attribute() | no attribute | |
| deep.py:2 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:2 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:3 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:5 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:5 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:6 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:6 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:6 | simple.test | f1() | no attribute | p0 = simple.test |
| deep.py:8 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:8 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:9 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:9 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:9 | simple.test | f2() | no attribute | p0 = simple.test |
| deep.py:11 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:11 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:12 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:12 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:12 | simple.test | f3() | no attribute | p0 = simple.test |
| deep.py:14 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:14 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:15 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:15 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:15 | simple.test | f4() | no attribute | p0 = simple.test |
| deep.py:17 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:17 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:18 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| deep.py:18 | simple.test | arg | no attribute | p0 = simple.test |
| deep.py:18 | simple.test | f5() | no attribute | p0 = simple.test |
| deep.py:20 | simple.test | GSSA Variable x | no attribute | |
| deep.py:20 | simple.test | SOURCE | no attribute | |
| deep.py:20 | simple.test | f6() | no attribute | |
| deep.py:22 | simple.test | GSSA Variable x | no attribute | |
| deep.py:22 | simple.test | x | no attribute | |
| module.py:3 | simple.test | GSSA Variable dangerous | no attribute | |
| module.py:3 | simple.test | SOURCE | no attribute | |
| module.py:7 | simple.test | SOURCE | no attribute | |
| module.py:10 | simple.test | SOURCE | no attribute | |
| rockpaperscissors.py:3 | scissors | SSA variable arg | no attribute | p0 = scissors |
| rockpaperscissors.py:3 | scissors | arg | no attribute | p0 = scissors |
| rockpaperscissors.py:6 | paper | SSA variable arg | no attribute | p0 = paper |
| rockpaperscissors.py:6 | paper | arg | no attribute | p0 = paper |
| rockpaperscissors.py:6 | rock | SSA variable arg | no attribute | p0 = rock |
| rockpaperscissors.py:6 | rock | arg | no attribute | p0 = rock |
| rockpaperscissors.py:6 | scissors | SSA variable arg | no attribute | p0 = scissors |
| rockpaperscissors.py:6 | scissors | arg | no attribute | p0 = scissors |
| rockpaperscissors.py:9 | paper | SSA variable arg | no attribute | p0 = paper |
| rockpaperscissors.py:9 | paper | arg | no attribute | p0 = paper |
| rockpaperscissors.py:9 | scissors | SSA variable arg | no attribute | p0 = scissors |
| rockpaperscissors.py:9 | scissors | arg | no attribute | p0 = scissors |
| rockpaperscissors.py:13 | scissors | SCISSORS | no attribute | |
| rockpaperscissors.py:16 | rock | ROCK | no attribute | |
| rockpaperscissors.py:19 | rock | ROCK | no attribute | |
| rockpaperscissors.py:19 | rock | SSA variable x | no attribute | |
| rockpaperscissors.py:20 | rock | SSA variable x | no attribute | |
| rockpaperscissors.py:20 | rock | x | no attribute | |
| rockpaperscissors.py:20 | scissors | Attribute() | no attribute | |
| rockpaperscissors.py:20 | scissors | SSA variable y | no attribute | |
| rockpaperscissors.py:21 | scissors | SSA variable y | no attribute | |
| rockpaperscissors.py:21 | scissors | y | no attribute | |
| rockpaperscissors.py:24 | rock | ROCK | no attribute | |
| rockpaperscissors.py:24 | rock | SSA variable x | no attribute | |
| rockpaperscissors.py:25 | paper | Attribute() | no attribute | |
| rockpaperscissors.py:25 | paper | SSA variable y | no attribute | |
| rockpaperscissors.py:25 | rock | SSA variable x | no attribute | |
| rockpaperscissors.py:25 | rock | x | no attribute | |
| rockpaperscissors.py:25 | scissors | Attribute() | no attribute | |
| rockpaperscissors.py:26 | paper | SSA variable y | no attribute | |
| rockpaperscissors.py:26 | paper | y | no attribute | |
| rockpaperscissors.py:29 | scissors | SCISSORS | no attribute | |
| rockpaperscissors.py:29 | scissors | SSA variable x | no attribute | |
| rockpaperscissors.py:30 | paper | Attribute() | no attribute | |
| rockpaperscissors.py:30 | paper | SSA variable y | no attribute | |
| rockpaperscissors.py:30 | scissors | SSA variable x | no attribute | |
| rockpaperscissors.py:30 | scissors | x | no attribute | |
| rockpaperscissors.py:31 | scissors | SSA variable x | no attribute | |
| rockpaperscissors.py:31 | scissors | x | no attribute | |
| rockpaperscissors.py:32 | paper | SSA variable y | no attribute | |
| rockpaperscissors.py:32 | paper | y | no attribute | |
| test.py:3 | simple.test | SOURCE | no attribute | |
| test.py:6 | simple.test | SOURCE | no attribute | |
| test.py:6 | simple.test | SSA variable s | no attribute | |
| test.py:7 | simple.test | SSA variable s | no attribute | |
| test.py:7 | simple.test | s | no attribute | |
| test.py:10 | simple.test | SOURCE | no attribute | |
| test.py:12 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| test.py:12 | simple.test | arg | no attribute | p0 = simple.test |
| test.py:13 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| test.py:13 | simple.test | arg | no attribute | p0 = simple.test |
| test.py:16 | simple.test | SSA variable t | no attribute | |
| test.py:16 | simple.test | source() | no attribute | |
| test.py:17 | simple.test | SSA variable t | no attribute | |
| test.py:17 | simple.test | t | no attribute | |
| test.py:20 | simple.test | SOURCE | no attribute | |
| test.py:20 | simple.test | SSA variable t | no attribute | |
| test.py:21 | simple.test | SSA variable t | no attribute | |
| test.py:21 | simple.test | t | no attribute | |
| test.py:24 | simple.test | SSA variable t | no attribute | |
| test.py:24 | simple.test | source() | no attribute | |
| test.py:25 | simple.test | SSA variable t | no attribute | |
| test.py:25 | simple.test | t | no attribute | |
| test.py:31 | simple.test | SOURCE | no attribute | |
| test.py:31 | simple.test | SSA variable t | no attribute | |
| test.py:37 | simple.test | SOURCE | no attribute | |
| test.py:37 | simple.test | SSA variable t | no attribute | |
| test.py:41 | simple.test | SSA variable t | no attribute | |
| test.py:41 | simple.test | t | no attribute | |
| test.py:44 | simple.test | source() | no attribute | |
| test.py:46 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| test.py:46 | simple.test | arg | no attribute | p0 = simple.test |
| test.py:47 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| test.py:47 | simple.test | arg | no attribute | p0 = simple.test |
| test.py:49 | simple.test | SSA variable arg | no attribute | p1 = simple.test |
| test.py:49 | simple.test | arg | no attribute | p1 = simple.test |
| test.py:51 | simple.test | SSA variable arg | no attribute | p1 = simple.test |
| test.py:51 | simple.test | arg | no attribute | p1 = simple.test |
| test.py:54 | simple.test | SSA variable t | no attribute | |
| test.py:54 | simple.test | source2() | no attribute | |
| test.py:55 | simple.test | SSA variable t | no attribute | |
| test.py:55 | simple.test | t | no attribute | |
| test.py:62 | simple.test | SOURCE | no attribute | |
| test.py:62 | simple.test | SSA variable t | no attribute | |
| test.py:63 | simple.test | SSA variable t | no attribute | |
| test.py:63 | simple.test | t | no attribute | |
| test.py:67 | simple.test | SOURCE | no attribute | |
| test.py:67 | simple.test | SSA variable t | no attribute | |
| test.py:70 | simple.test | SSA variable t | no attribute | |
| test.py:70 | simple.test | t | no attribute | |
| test.py:72 | simple.test | SSA variable arg | attribute x | p0.x = simple.test |
| test.py:72 | simple.test | SSA variable arg | no attribute | p0 = simple.test |
| test.py:72 | simple.test | arg | attribute x | p0.x = simple.test |
| test.py:72 | simple.test | arg | no attribute | p0 = simple.test |
| test.py:73 | simple.test | arg | attribute x | p0.x = simple.test |
| test.py:73 | simple.test | arg | no attribute | p0 = simple.test |
| test.py:76 | simple.test | SOURCE | no attribute | |
| test.py:76 | simple.test | SSA variable t | no attribute | |
| test.py:77 | simple.test | SSA variable t | no attribute | |
| test.py:77 | simple.test | hub() | no attribute | |
| test.py:77 | simple.test | t | no attribute | |
| test.py:78 | simple.test | SSA variable t | no attribute | |
| test.py:78 | simple.test | t | no attribute | |
| test.py:85 | simple.test | GSSA Variable module | attribute dangerous | |
| test.py:85 | simple.test | ImportExpr | attribute dangerous | |
| test.py:87 | simple.test | GSSA Variable module | attribute dangerous | |
| test.py:88 | simple.test | Attribute | no attribute | |
| test.py:88 | simple.test | SSA variable t | no attribute | |
| test.py:88 | simple.test | module | attribute dangerous | |
| test.py:89 | simple.test | SSA variable t | no attribute | |
| test.py:89 | simple.test | t | no attribute | |
| test.py:91 | simple.test | GSSA Variable module | attribute dangerous | |
| test.py:92 | simple.test | module | attribute dangerous | |
| test.py:95 | simple.test | GSSA Variable module | attribute dangerous | |
| test.py:96 | simple.test | module | attribute dangerous | |
| test.py:99 | simple.test | GSSA Variable module | attribute dangerous | |
| test.py:100 | simple.test | Attribute() | no attribute | |
| test.py:100 | simple.test | SSA variable t | no attribute | |
| test.py:100 | simple.test | module | attribute dangerous | |
| test.py:101 | simple.test | SSA variable t | no attribute | |
| test.py:101 | simple.test | t | no attribute | |
| test.py:105 | simple.test | SSA variable arg | attribute x | p0.x = simple.test |
| test.py:105 | simple.test | arg | attribute x | p0.x = simple.test |
| test.py:106 | simple.test | Attribute | no attribute | p0.x = simple.test |
| test.py:106 | simple.test | arg | attribute x | p0.x = simple.test |
| test.py:108 | simple.test | GSSA Variable module | attribute dangerous | |
| test.py:110 | simple.test | Attribute | no attribute | |
| test.py:110 | simple.test | SSA variable t | attribute x | |
| test.py:110 | simple.test | module | attribute dangerous | |
| test.py:111 | simple.test | Attribute | no attribute | |
| test.py:111 | simple.test | t | attribute x | |
| test.py:113 | simple.test | GSSA Variable module | attribute dangerous | |
| test.py:115 | simple.test | Attribute | no attribute | |
| test.py:115 | simple.test | SSA variable t | attribute x | |
| test.py:115 | simple.test | module | attribute dangerous | |
| test.py:116 | simple.test | SSA variable t | attribute x | |
| test.py:116 | simple.test | hub() | attribute x | |
| test.py:116 | simple.test | t | attribute x | |
| test.py:117 | simple.test | SSA variable t | attribute x | |
| test.py:117 | simple.test | t | attribute x | |
| test.py:120 | simple.test | CUSTOM_SOURCE | no attribute | |
| test.py:120 | simple.test | SSA variable t | no attribute | |
| test.py:121 | simple.test | t | no attribute | |
| test.py:126 | simple.test | CUSTOM_SOURCE | no attribute | |
| test.py:126 | simple.test | SSA variable t | no attribute | |
| test.py:128 | simple.test | SOURCE | no attribute | |
| test.py:128 | simple.test | SSA variable t | no attribute | |
| test.py:130 | simple.test | SSA variable t | no attribute | |
| test.py:130 | simple.test | t | no attribute | |
| test.py:132 | simple.test | SSA variable t | no attribute | |
| test.py:132 | simple.test | t | no attribute | |
| test.py:136 | simple.test | CUSTOM_SOURCE | no attribute | |
| test.py:136 | simple.test | SSA variable t | no attribute | |
| test.py:138 | simple.test | SOURCE | no attribute | |
| test.py:138 | simple.test | SSA variable t | no attribute | |
| test.py:140 | simple.test | SSA variable t | no attribute | |
| test.py:140 | simple.test | t | no attribute | |
| test.py:142 | simple.test | SSA variable t | no attribute | |
| test.py:142 | simple.test | t | no attribute | |
| test.py:146 | simple.test | CUSTOM_SOURCE | no attribute | |
| test.py:146 | simple.test | SSA variable t | no attribute | |
| test.py:148 | simple.test | SOURCE | no attribute | |
| test.py:148 | simple.test | SSA variable t | no attribute | |
| test.py:149 | simple.test | t | no attribute | |
| test.py:155 | simple.test | GSSA Variable unsafe | no attribute | |
| test.py:155 | simple.test | ImportExpr | attribute dangerous | |
| test.py:155 | simple.test | ImportMember | no attribute | |
| test.py:156 | simple.test | GSSA Variable unsafe | no attribute | |
| test.py:156 | simple.test | unsafe | no attribute | |
| test.py:159 | simple.test | SOURCE | no attribute | |
| test.py:159 | simple.test | SSA variable t | no attribute | |
| test.py:160 | simple.test | SSA variable t | no attribute | |
| test.py:160 | simple.test | t | no attribute | |
| test.py:163 | simple.test | SOURCE | no attribute | |
| test.py:163 | simple.test | SSA variable s | no attribute | |
| test.py:164 | simple.test | SSA variable s | no attribute | |
| test.py:164 | simple.test | s | no attribute | |
| test.py:165 | simple.test | SSA variable s | no attribute | |
| test.py:165 | simple.test | s | no attribute | |
| test.py:168 | [simple.test] | List | no attribute | |
| test.py:168 | [simple.test] | SSA variable l | no attribute | |
| test.py:168 | simple.test | SOURCE | no attribute | |
| test.py:169 | simple.test | SOURCE | no attribute | |
| test.py:169 | {simple.test} | Dict | no attribute | |
| test.py:169 | {simple.test} | SSA variable d | no attribute | |
| test.py:170 | [simple.test] | SSA variable l | no attribute | |
| test.py:170 | [simple.test] | l | no attribute | |
| test.py:171 | {simple.test} | SSA variable d | no attribute | |
| test.py:171 | {simple.test} | d | no attribute | |
| test.py:174 | [simple.test] | SSA variable l | no attribute | |
| test.py:174 | [simple.test] | SSA variable l2 | no attribute | |
| test.py:174 | [simple.test] | l | no attribute | |
| test.py:174 | [simple.test] | list() | no attribute | |
| test.py:175 | {simple.test} | SSA variable d | no attribute | |
| test.py:175 | {simple.test} | SSA variable d2 | no attribute | |
| test.py:175 | {simple.test} | d | no attribute | |
| test.py:175 | {simple.test} | dict() | no attribute | |
| test.py:178 | simple.test | SOURCE | no attribute | |
| test.py:178 | simple.test | SSA variable t | no attribute | |
| test.py:179 | simple.test | t | no attribute | |
| test.py:180 | simple.test | SSA variable t | no attribute | |
| test.py:180 | simple.test | t | no attribute | |
| test.py:183 | simple.test | SSA variable t | no attribute | |
| test.py:183 | simple.test | t | no attribute | |
| test.py:186 | simple.test | SSA variable t | no attribute | |
| test.py:186 | simple.test | t | no attribute | |
| test.py:194 | simple.test | SSA variable t | no attribute | |
| test.py:195 | simple.test | SOURCE | no attribute | |
| test.py:195 | simple.test | SSA variable t | no attribute | |
| test.py:196 | simple.test | t | no attribute | |
| test.py:197 | simple.test | SSA variable t | no attribute | |
| test.py:197 | simple.test | t | no attribute | |
| test.py:199 | simple.test | SSA variable t | no attribute | |
| test.py:199 | simple.test | t | no attribute | |
| test.py:208 | [simple.test] | List | no attribute | |
| test.py:208 | [simple.test] | SSA variable seq | no attribute | |
| test.py:208 | simple.test | SOURCE | no attribute | |
| test.py:209 | [simple.test] | seq | no attribute | |
| test.py:209 | simple.test | For | no attribute | |
| test.py:209 | simple.test | SSA variable i | no attribute | |
| test.py:210 | simple.test | i | no attribute | |
| test.py:213 | [simple.test] | flow_in_generator() | no attribute | |
| test.py:213 | iterable.simple | flow_in_generator() | no attribute | |
| test.py:213 | simple.test | For | no attribute | |
| test.py:213 | simple.test | SSA variable x | no attribute | |
| test.py:214 | simple.test | SSA variable x | no attribute | |
| test.py:214 | simple.test | x | no attribute | |

10
python/ql/test/library-tests/taint/config/TestNode.ql Normal file
View File

@@ -0,0 +1,10 @@
import python
import semmle.python.security.TaintTracking
import semmle.python.dataflow.Implementation
import TaintLib
from TaintTrackingNode n
where n.getConfiguration() instanceof TestConfig
select n.getLocation().toString(), n.getTaintKind(), n.getNode().toString(), n.getPath().toString(), n.getContext().toString()

80
python/ql/test/library-tests/taint/config/TestSink.expected Normal file
View File

@@ -0,0 +1,80 @@
| carrier.py:18 | Simple config | Attribute | simple.test |
| carrier.py:18 | Taint carrier config | Attribute | simple.test |
| carrier.py:22 | Simple config | Attribute() | simple.test |
| carrier.py:22 | Taint carrier config | Attribute() | simple.test |
| carrier.py:26 | Simple config | Attribute() | simple.test |
| carrier.py:26 | Taint carrier config | Attribute() | simple.test |
| carrier.py:30 | Simple config | Attribute() | simple.test |
| carrier.py:30 | Taint carrier config | Attribute() | simple.test |
| carrier.py:35 | Simple config | Attribute() | simple.test |
| carrier.py:35 | Taint carrier config | Attribute() | simple.test |
| deep.py:22 | Simple config | x | simple.test |
| deep.py:22 | Taint carrier config | x | simple.test |
| rockpaperscissors.py:13 | Rock-paper-scissors config | SCISSORS | scissors |
| rockpaperscissors.py:16 | Rock-paper-scissors config | ROCK | rock |
| rockpaperscissors.py:21 | Rock-paper-scissors config | y | paper |
| rockpaperscissors.py:26 | Rock-paper-scissors config | y | paper |
| rockpaperscissors.py:31 | Rock-paper-scissors config | x | rock |
| rockpaperscissors.py:32 | Rock-paper-scissors config | y | rock |
| test.py:3 | Simple config | SOURCE | simple.test |
| test.py:3 | Taint carrier config | SOURCE | simple.test |
| test.py:7 | Simple config | s | simple.test |
| test.py:7 | Taint carrier config | s | simple.test |
| test.py:13 | Simple config | arg | simple.test |
| test.py:13 | Taint carrier config | arg | simple.test |
| test.py:17 | Simple config | t | simple.test |
| test.py:17 | Taint carrier config | t | simple.test |
| test.py:33 | Simple config | t | simple.test |
| test.py:33 | Taint carrier config | t | simple.test |
| test.py:41 | Simple config | t | simple.test |
| test.py:41 | Taint carrier config | t | simple.test |
| test.py:78 | Simple config | t | simple.test |
| test.py:78 | Taint carrier config | t | simple.test |
| test.py:83 | Simple config | t | simple.test |
| test.py:83 | Taint carrier config | t | simple.test |
| test.py:89 | Simple config | t | simple.test |
| test.py:89 | Taint carrier config | t | simple.test |
| test.py:93 | Simple config | t | simple.test |
| test.py:93 | Taint carrier config | t | simple.test |
| test.py:97 | Simple config | t | simple.test |
| test.py:97 | Taint carrier config | t | simple.test |
| test.py:101 | Simple config | t | simple.test |
| test.py:101 | Taint carrier config | t | simple.test |
| test.py:106 | Simple config | Attribute | simple.test |
| test.py:106 | Taint carrier config | Attribute | simple.test |
| test.py:111 | Simple config | Attribute | simple.test |
| test.py:111 | Taint carrier config | Attribute | simple.test |
| test.py:122 | Basic custom config | t | simple.test |
| test.py:130 | Basic custom config | t | simple.test |
| test.py:132 | Simple config | t | simple.test |
| test.py:132 | Taint carrier config | t | simple.test |
| test.py:140 | Basic custom config | t | simple.test |
| test.py:142 | Simple config | t | simple.test |
| test.py:142 | Taint carrier config | t | simple.test |
| test.py:151 | Basic custom config | t | simple.test |
| test.py:153 | Simple config | t | simple.test |
| test.py:153 | Taint carrier config | t | simple.test |
| test.py:156 | Simple config | unsafe | simple.test |
| test.py:156 | Taint carrier config | unsafe | simple.test |
| test.py:160 | Simple config | t | simple.test |
| test.py:160 | Taint carrier config | t | simple.test |
| test.py:165 | Simple config | s | simple.test |
| test.py:165 | Taint carrier config | s | simple.test |
| test.py:172 | Simple config | Subscript | simple.test |
| test.py:172 | Taint carrier config | Subscript | simple.test |
| test.py:173 | Simple config | Subscript | simple.test |
| test.py:173 | Taint carrier config | Subscript | simple.test |
| test.py:180 | Simple config | t | simple.test |
| test.py:180 | Taint carrier config | t | simple.test |
| test.py:182 | Simple config | t | simple.test |
| test.py:182 | Taint carrier config | t | simple.test |
| test.py:184 | Simple config | t | simple.test |
| test.py:184 | Taint carrier config | t | simple.test |
| test.py:186 | Simple config | t | simple.test |
| test.py:186 | Taint carrier config | t | simple.test |
| test.py:197 | Simple config | t | simple.test |
| test.py:197 | Taint carrier config | t | simple.test |
| test.py:199 | Simple config | t | simple.test |
| test.py:199 | Taint carrier config | t | simple.test |
| test.py:214 | Simple config | x | simple.test |
| test.py:214 | Taint carrier config | x | simple.test |

8
python/ql/test/library-tests/taint/config/TestSink.ql Normal file
View File

@@ -0,0 +1,8 @@
import python
import semmle.python.security.TaintTracking
import TaintLib
from TestConfig config, DataFlow::Node sink, TaintKind kind
where config.isSink(sink, kind)
select sink.getLocation().toString(), config, sink.toString(), kind

37
python/ql/test/library-tests/taint/config/TestSource.expected Normal file
View File

@@ -0,0 +1,37 @@
| Basic custom config | test.py:120 | 120 | CUSTOM_SOURCE | simple.test |
| Basic custom config | test.py:126 | 126 | CUSTOM_SOURCE | simple.test |
| Basic custom config | test.py:136 | 136 | CUSTOM_SOURCE | simple.test |
| Basic custom config | test.py:146 | 146 | CUSTOM_SOURCE | simple.test |
| Rock-paper-scissors config | rockpaperscissors.py:13 | 13 | SCISSORS | scissors |
| Rock-paper-scissors config | rockpaperscissors.py:16 | 16 | ROCK | rock |
| Rock-paper-scissors config | rockpaperscissors.py:19 | 19 | ROCK | rock |
| Rock-paper-scissors config | rockpaperscissors.py:24 | 24 | ROCK | rock |
| Rock-paper-scissors config | rockpaperscissors.py:29 | 29 | SCISSORS | scissors |
| Simple config | carrier.py:17 | 17 | SOURCE | simple.test |
| Simple config | carrier.py:25 | 25 | SOURCE | simple.test |
| Simple config | deep.py:20 | 20 | SOURCE | simple.test |
| Simple config | module.py:3 | 3 | SOURCE | simple.test |
| Simple config | module.py:7 | 7 | SOURCE | simple.test |
| Simple config | module.py:10 | 10 | SOURCE | simple.test |
| Simple config | test.py:3 | 3 | SOURCE | simple.test |
| Simple config | test.py:6 | 6 | SOURCE | simple.test |
| Simple config | test.py:10 | 10 | SOURCE | simple.test |
| Simple config | test.py:20 | 20 | SOURCE | simple.test |
| Simple config | test.py:31 | 31 | SOURCE | simple.test |
| Simple config | test.py:37 | 37 | SOURCE | simple.test |
| Simple config | test.py:62 | 62 | SOURCE | simple.test |
| Simple config | test.py:67 | 67 | SOURCE | simple.test |
| Simple config | test.py:76 | 76 | SOURCE | simple.test |
| Simple config | test.py:128 | 128 | SOURCE | simple.test |
| Simple config | test.py:138 | 138 | SOURCE | simple.test |
| Simple config | test.py:148 | 148 | SOURCE | simple.test |
| Simple config | test.py:159 | 159 | SOURCE | simple.test |
| Simple config | test.py:163 | 163 | SOURCE | simple.test |
| Simple config | test.py:168 | 168 | SOURCE | simple.test |
| Simple config | test.py:169 | 169 | SOURCE | simple.test |
| Simple config | test.py:178 | 178 | SOURCE | simple.test |
| Simple config | test.py:195 | 195 | SOURCE | simple.test |
| Simple config | test.py:208 | 208 | SOURCE | simple.test |
| Taint carrier config | carrier.py:21 | 21 | TAINT_CARRIER_SOURCE | explicit.carrier |
| Taint carrier config | carrier.py:29 | 29 | TAINT_CARRIER_SOURCE | explicit.carrier |
| Taint carrier config | carrier.py:33 | 33 | TAINT_CARRIER_SOURCE | explicit.carrier |

8
python/ql/test/library-tests/taint/config/TestSource.ql Normal file
View File

@@ -0,0 +1,8 @@
import python
import semmle.python.security.TaintTracking
import TaintLib
from TestConfig config, DataFlow::Node source, TaintKind kind
where config.isSource(source, kind)
select config, source.getLocation().toString(), source.getLocation().getStartLine(), source.toString(), kind

158
python/ql/test/library-tests/taint/config/TestStep.expected Normal file
View File

@@ -0,0 +1,158 @@
| Basic custom config: | simple.test | test.py:120 | CUSTOM_SOURCE | | --> | simple.test | test.py:121 | t | |
| Basic custom config: | simple.test | test.py:126 | CUSTOM_SOURCE | | --> | simple.test | test.py:130 | t | |
| Basic custom config: | simple.test | test.py:136 | CUSTOM_SOURCE | | --> | simple.test | test.py:142 | t | |
| Basic custom config: | simple.test | test.py:146 | CUSTOM_SOURCE | | --> | simple.test | test.py:149 | t | |
| Rock-paper-scissors config: | paper | rockpaperscissors.py:25 | Attribute() | | --> | paper | rockpaperscissors.py:26 | y | |
| Rock-paper-scissors config: | paper | rockpaperscissors.py:26 | y | | --> | paper | rockpaperscissors.py:9 | arg | p0 = paper |
| Rock-paper-scissors config: | paper | rockpaperscissors.py:30 | Attribute() | | --> | paper | rockpaperscissors.py:32 | y | |
| Rock-paper-scissors config: | paper | rockpaperscissors.py:32 | y | | --> | paper | rockpaperscissors.py:6 | arg | p0 = paper |
| Rock-paper-scissors config: | rock | rockpaperscissors.py:16 | ROCK | | --> | rock | rockpaperscissors.py:6 | arg | p0 = rock |
| Rock-paper-scissors config: | rock | rockpaperscissors.py:19 | ROCK | | --> | rock | rockpaperscissors.py:20 | x | |
| Rock-paper-scissors config: | rock | rockpaperscissors.py:20 | x | | --> | scissors | rockpaperscissors.py:20 | Attribute() | |
| Rock-paper-scissors config: | rock | rockpaperscissors.py:24 | ROCK | | --> | rock | rockpaperscissors.py:25 | x | |
| Rock-paper-scissors config: | rock | rockpaperscissors.py:25 | x | | --> | scissors | rockpaperscissors.py:25 | Attribute() | |
| Rock-paper-scissors config: | scissors | rockpaperscissors.py:13 | SCISSORS | | --> | scissors | rockpaperscissors.py:3 | arg | p0 = scissors |
| Rock-paper-scissors config: | scissors | rockpaperscissors.py:20 | Attribute() | | --> | scissors | rockpaperscissors.py:21 | y | |
| Rock-paper-scissors config: | scissors | rockpaperscissors.py:21 | y | | --> | scissors | rockpaperscissors.py:9 | arg | p0 = scissors |
| Rock-paper-scissors config: | scissors | rockpaperscissors.py:25 | Attribute() | | --> | paper | rockpaperscissors.py:25 | Attribute() | |
| Rock-paper-scissors config: | scissors | rockpaperscissors.py:29 | SCISSORS | | --> | scissors | rockpaperscissors.py:30 | x | |
| Rock-paper-scissors config: | scissors | rockpaperscissors.py:29 | SCISSORS | | --> | scissors | rockpaperscissors.py:31 | x | |
| Rock-paper-scissors config: | scissors | rockpaperscissors.py:30 | x | | --> | paper | rockpaperscissors.py:30 | Attribute() | |
| Rock-paper-scissors config: | scissors | rockpaperscissors.py:31 | x | | --> | scissors | rockpaperscissors.py:6 | arg | p0 = scissors |
| Simple config: | [simple.test] | test.py:168 | List | | --> | [simple.test] | test.py:170 | l | |
| Simple config: | [simple.test] | test.py:168 | List | | --> | [simple.test] | test.py:174 | l | |
| Simple config: | [simple.test] | test.py:174 | l | | --> | [simple.test] | test.py:174 | list() | |
| Simple config: | [simple.test] | test.py:208 | List | | --> | [simple.test] | test.py:209 | seq | |
| Simple config: | [simple.test] | test.py:209 | seq | | --> | simple.test | test.py:209 | For | |
| Simple config: | [simple.test] | test.py:213 | flow_in_generator() | | --> | simple.test | test.py:213 | For | |
| Simple config: | iterable.simple | test.py:213 | flow_in_generator() | | --> | simple.test | test.py:213 | For | |
| Simple config: | simple.test | carrier.py:4 | arg | p1 = simple.test | --> | simple.test | carrier.py:5 | arg | p1 = simple.test |
| Simple config: | simple.test | carrier.py:10 | self | p0.attr = simple.test | --> | simple.test | carrier.py:11 | self | p0.attr = simple.test |
| Simple config: | simple.test | carrier.py:11 | self | p0.attr = simple.test | --> | simple.test | carrier.py:11 | Attribute | p0.attr = simple.test |
| Simple config: | simple.test | carrier.py:13 | arg | p0.attr = simple.test | --> | simple.test | carrier.py:14 | arg | p0.attr = simple.test |
| Simple config: | simple.test | carrier.py:17 | ImplicitCarrier() | | --> | simple.test | carrier.py:18 | c | |
| Simple config: | simple.test | carrier.py:17 | SOURCE | | --> | simple.test | carrier.py:4 | arg | p1 = simple.test |
| Simple config: | simple.test | carrier.py:17 | SOURCE | | --> | simple.test | carrier.py:17 | ImplicitCarrier() | |
| Simple config: | simple.test | carrier.py:18 | c | | --> | simple.test | carrier.py:18 | Attribute | |
| Simple config: | simple.test | carrier.py:25 | ImplicitCarrier() | | --> | simple.test | carrier.py:13 | arg | p0.attr = simple.test |
| Simple config: | simple.test | carrier.py:25 | ImplicitCarrier() | | --> | simple.test | carrier.py:25 | hub() | |
| Simple config: | simple.test | carrier.py:25 | SOURCE | | --> | simple.test | carrier.py:4 | arg | p1 = simple.test |
| Simple config: | simple.test | carrier.py:25 | SOURCE | | --> | simple.test | carrier.py:25 | ImplicitCarrier() | |
| Simple config: | simple.test | carrier.py:25 | hub() | | --> | simple.test | carrier.py:26 | c | |
| Simple config: | simple.test | carrier.py:26 | c | | --> | simple.test | carrier.py:10 | self | p0.attr = simple.test |
| Simple config: | simple.test | carrier.py:26 | c | | --> | simple.test | carrier.py:26 | Attribute() | |
| Simple config: | simple.test | deep.py:2 | arg | p0 = simple.test | --> | simple.test | deep.py:3 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:5 | arg | p0 = simple.test | --> | simple.test | deep.py:6 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:6 | arg | p0 = simple.test | --> | simple.test | deep.py:2 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:6 | arg | p0 = simple.test | --> | simple.test | deep.py:6 | f1() | p0 = simple.test |
| Simple config: | simple.test | deep.py:8 | arg | p0 = simple.test | --> | simple.test | deep.py:9 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:9 | arg | p0 = simple.test | --> | simple.test | deep.py:5 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:9 | arg | p0 = simple.test | --> | simple.test | deep.py:9 | f2() | p0 = simple.test |
| Simple config: | simple.test | deep.py:11 | arg | p0 = simple.test | --> | simple.test | deep.py:12 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:12 | arg | p0 = simple.test | --> | simple.test | deep.py:8 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:12 | arg | p0 = simple.test | --> | simple.test | deep.py:12 | f3() | p0 = simple.test |
| Simple config: | simple.test | deep.py:14 | arg | p0 = simple.test | --> | simple.test | deep.py:15 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:15 | arg | p0 = simple.test | --> | simple.test | deep.py:11 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:15 | arg | p0 = simple.test | --> | simple.test | deep.py:15 | f4() | p0 = simple.test |
| Simple config: | simple.test | deep.py:17 | arg | p0 = simple.test | --> | simple.test | deep.py:18 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:18 | arg | p0 = simple.test | --> | simple.test | deep.py:14 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:18 | arg | p0 = simple.test | --> | simple.test | deep.py:18 | f5() | p0 = simple.test |
| Simple config: | simple.test | deep.py:20 | SOURCE | | --> | simple.test | deep.py:17 | arg | p0 = simple.test |
| Simple config: | simple.test | deep.py:20 | SOURCE | | --> | simple.test | deep.py:20 | f6() | |
| Simple config: | simple.test | deep.py:20 | f6() | | --> | simple.test | deep.py:22 | x | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:85 | ImportExpr | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:88 | module | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:92 | module | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:96 | module | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:100 | module | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:110 | module | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:115 | module | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:155 | ImportExpr | |
| Simple config: | simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:155 | ImportMember | |
| Simple config: | simple.test | module.py:7 | SOURCE | | --> | simple.test | test.py:100 | Attribute() | |
| Simple config: | simple.test | test.py:6 | SOURCE | | --> | simple.test | test.py:7 | s | |
| Simple config: | simple.test | test.py:10 | SOURCE | | --> | simple.test | test.py:16 | source() | |
| Simple config: | simple.test | test.py:10 | SOURCE | | --> | simple.test | test.py:24 | source() | |
| Simple config: | simple.test | test.py:10 | SOURCE | | --> | simple.test | test.py:44 | source() | |
| Simple config: | simple.test | test.py:12 | arg | p0 = simple.test | --> | simple.test | test.py:13 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:16 | source() | | --> | simple.test | test.py:17 | t | |
| Simple config: | simple.test | test.py:20 | SOURCE | | --> | simple.test | test.py:21 | t | |
| Simple config: | simple.test | test.py:21 | t | | --> | simple.test | test.py:12 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:24 | source() | | --> | simple.test | test.py:25 | t | |
| Simple config: | simple.test | test.py:25 | t | | --> | simple.test | test.py:12 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:37 | SOURCE | | --> | simple.test | test.py:41 | t | |
| Simple config: | simple.test | test.py:44 | source() | | --> | simple.test | test.py:54 | source2() | |
| Simple config: | simple.test | test.py:46 | arg | p0 = simple.test | --> | simple.test | test.py:47 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:47 | arg | p0 = simple.test | --> | simple.test | test.py:12 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:49 | arg | p1 = simple.test | --> | simple.test | test.py:51 | arg | p1 = simple.test |
| Simple config: | simple.test | test.py:51 | arg | p1 = simple.test | --> | simple.test | test.py:12 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:54 | source2() | | --> | simple.test | test.py:55 | t | |
| Simple config: | simple.test | test.py:55 | t | | --> | simple.test | test.py:46 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:62 | SOURCE | | --> | simple.test | test.py:63 | t | |
| Simple config: | simple.test | test.py:63 | t | | --> | simple.test | test.py:49 | arg | p1 = simple.test |
| Simple config: | simple.test | test.py:67 | SOURCE | | --> | simple.test | test.py:70 | t | |
| Simple config: | simple.test | test.py:70 | t | | --> | simple.test | test.py:49 | arg | p1 = simple.test |
| Simple config: | simple.test | test.py:72 | arg | p0 = simple.test | --> | simple.test | test.py:73 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:72 | arg | p0.x = simple.test | --> | simple.test | test.py:73 | arg | p0.x = simple.test |
| Simple config: | simple.test | test.py:76 | SOURCE | | --> | simple.test | test.py:77 | t | |
| Simple config: | simple.test | test.py:77 | hub() | | --> | simple.test | test.py:78 | t | |
| Simple config: | simple.test | test.py:77 | t | | --> | simple.test | test.py:72 | arg | p0 = simple.test |
| Simple config: | simple.test | test.py:77 | t | | --> | simple.test | test.py:77 | hub() | |
| Simple config: | simple.test | test.py:85 | ImportExpr | | --> | simple.test | test.py:88 | module | |
| Simple config: | simple.test | test.py:85 | ImportExpr | | --> | simple.test | test.py:92 | module | |
| Simple config: | simple.test | test.py:85 | ImportExpr | | --> | simple.test | test.py:96 | module | |
| Simple config: | simple.test | test.py:85 | ImportExpr | | --> | simple.test | test.py:100 | module | |
| Simple config: | simple.test | test.py:85 | ImportExpr | | --> | simple.test | test.py:110 | module | |
| Simple config: | simple.test | test.py:85 | ImportExpr | | --> | simple.test | test.py:115 | module | |
| Simple config: | simple.test | test.py:88 | Attribute | | --> | simple.test | test.py:89 | t | |
| Simple config: | simple.test | test.py:88 | module | | --> | simple.test | test.py:88 | Attribute | |
| Simple config: | simple.test | test.py:100 | Attribute() | | --> | simple.test | test.py:101 | t | |
| Simple config: | simple.test | test.py:105 | arg | p0.x = simple.test | --> | simple.test | test.py:106 | arg | p0.x = simple.test |
| Simple config: | simple.test | test.py:106 | arg | p0.x = simple.test | --> | simple.test | test.py:106 | Attribute | p0.x = simple.test |
| Simple config: | simple.test | test.py:110 | Attribute | | --> | simple.test | test.py:111 | t | |
| Simple config: | simple.test | test.py:110 | module | | --> | simple.test | test.py:110 | Attribute | |
| Simple config: | simple.test | test.py:111 | t | | --> | simple.test | test.py:111 | Attribute | |
| Simple config: | simple.test | test.py:115 | Attribute | | --> | simple.test | test.py:116 | t | |
| Simple config: | simple.test | test.py:115 | module | | --> | simple.test | test.py:115 | Attribute | |
| Simple config: | simple.test | test.py:116 | hub() | | --> | simple.test | test.py:117 | t | |
| Simple config: | simple.test | test.py:116 | t | | --> | simple.test | test.py:72 | arg | p0.x = simple.test |
| Simple config: | simple.test | test.py:116 | t | | --> | simple.test | test.py:116 | hub() | |
| Simple config: | simple.test | test.py:117 | t | | --> | simple.test | test.py:105 | arg | p0.x = simple.test |
| Simple config: | simple.test | test.py:128 | SOURCE | | --> | simple.test | test.py:132 | t | |
| Simple config: | simple.test | test.py:138 | SOURCE | | --> | simple.test | test.py:140 | t | |
| Simple config: | simple.test | test.py:148 | SOURCE | | --> | simple.test | test.py:149 | t | |
| Simple config: | simple.test | test.py:155 | ImportMember | | --> | simple.test | test.py:156 | unsafe | |
| Simple config: | simple.test | test.py:159 | SOURCE | | --> | simple.test | test.py:160 | t | |
| Simple config: | simple.test | test.py:163 | SOURCE | | --> | simple.test | test.py:164 | s | |
| Simple config: | simple.test | test.py:163 | SOURCE | | --> | simple.test | test.py:165 | s | |
| Simple config: | simple.test | test.py:168 | SOURCE | | --> | [simple.test] | test.py:168 | List | |
| Simple config: | simple.test | test.py:169 | SOURCE | | --> | {simple.test} | test.py:169 | Dict | |
| Simple config: | simple.test | test.py:178 | SOURCE | | --> | simple.test | test.py:179 | t | |
| Simple config: | simple.test | test.py:178 | SOURCE | | --> | simple.test | test.py:180 | t | |
| Simple config: | simple.test | test.py:178 | SOURCE | | --> | simple.test | test.py:183 | t | |
| Simple config: | simple.test | test.py:178 | SOURCE | | --> | simple.test | test.py:186 | t | |
| Simple config: | simple.test | test.py:195 | SOURCE | | --> | simple.test | test.py:196 | t | |
| Simple config: | simple.test | test.py:195 | SOURCE | | --> | simple.test | test.py:197 | t | |
| Simple config: | simple.test | test.py:195 | SOURCE | | --> | simple.test | test.py:199 | t | |
| Simple config: | simple.test | test.py:208 | SOURCE | | --> | [simple.test] | test.py:208 | List | |
| Simple config: | simple.test | test.py:209 | For | | --> | simple.test | test.py:210 | i | |
| Simple config: | simple.test | test.py:210 | i | | --> | [simple.test] | test.py:213 | flow_in_generator() | |
| Simple config: | simple.test | test.py:210 | i | | --> | iterable.simple | test.py:213 | flow_in_generator() | |
| Simple config: | simple.test | test.py:213 | For | | --> | simple.test | test.py:214 | x | |
| Simple config: | {simple.test} | test.py:169 | Dict | | --> | {simple.test} | test.py:171 | d | |
| Simple config: | {simple.test} | test.py:169 | Dict | | --> | {simple.test} | test.py:175 | d | |
| Simple config: | {simple.test} | test.py:175 | d | | --> | {simple.test} | test.py:175 | dict() | |
| Taint carrier config: | explicit.carrier | carrier.py:4 | arg | p1 = explicit.carrier | --> | explicit.carrier | carrier.py:5 | arg | p1 = explicit.carrier |
| Taint carrier config: | explicit.carrier | carrier.py:13 | arg | p0 = explicit.carrier | --> | explicit.carrier | carrier.py:14 | arg | p0 = explicit.carrier |
| Taint carrier config: | explicit.carrier | carrier.py:21 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:22 | c | |
| Taint carrier config: | explicit.carrier | carrier.py:22 | c | | --> | simple.test | carrier.py:22 | Attribute() | |
| Taint carrier config: | explicit.carrier | carrier.py:29 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:13 | arg | p0 = explicit.carrier |
| Taint carrier config: | explicit.carrier | carrier.py:29 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:29 | hub() | |
| Taint carrier config: | explicit.carrier | carrier.py:29 | hub() | | --> | explicit.carrier | carrier.py:30 | c | |
| Taint carrier config: | explicit.carrier | carrier.py:30 | c | | --> | simple.test | carrier.py:30 | Attribute() | |
| Taint carrier config: | explicit.carrier | carrier.py:33 | ImplicitCarrier() | | --> | explicit.carrier | carrier.py:34 | c | |
| Taint carrier config: | explicit.carrier | carrier.py:33 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:4 | arg | p1 = explicit.carrier |
| Taint carrier config: | explicit.carrier | carrier.py:33 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:33 | ImplicitCarrier() | |
| Taint carrier config: | explicit.carrier | carrier.py:34 | Attribute | | --> | explicit.carrier | carrier.py:35 | x | |
| Taint carrier config: | explicit.carrier | carrier.py:34 | c | | --> | explicit.carrier | carrier.py:34 | Attribute | |
| Taint carrier config: | explicit.carrier | carrier.py:35 | x | | --> | simple.test | carrier.py:35 | Attribute() | |

13
python/ql/test/library-tests/taint/config/TestStep.ql Normal file
View File

@@ -0,0 +1,13 @@
import python
import semmle.python.security.TaintTracking
import TaintLib
import semmle.python.dataflow.Implementation
from TaintTrackingNode n, TaintTrackingNode s, TestConfig config
where s = n.getASuccessor() and config = n.getConfiguration()
select
config + ":",
n.getTaintKind(), n.getLocation().toString(), n.getNode().toString(), n.getContext(),
" --> ",
s.getTaintKind(), s.getLocation().toString(), s.getNode().toString(), s.getContext()

35
python/ql/test/library-tests/taint/config/carrier.py Normal file
View File

@@ -0,0 +1,35 @@
class ImplicitCarrier(object):
def __init__(self, arg):
self.attr = arg
def set_attr(self, arg):
self.attr = arg
def get_attr(self):
return self.attr
def hub(arg):
return arg
def test1():
c = ImplicitCarrier(SOURCE)
SINK(c.attr)
def test2():
c = TAINT_CARRIER_SOURCE
SINK(c.get_taint())
def test3():
c = hub(ImplicitCarrier(SOURCE))
SINK(c.get_attr())
def test4():
c = hub(TAINT_CARRIER_SOURCE)
SINK(c.get_taint())
def test5():
c = ImplicitCarrier(TAINT_CARRIER_SOURCE)
x = c.attr
SINK(x.get_taint())

23
python/ql/test/library-tests/taint/config/deep.py Normal file
View File

@@ -0,0 +1,23 @@
def f1(arg):
return arg
def f2(arg):
return f1(arg)
def f3(arg):
return f2(arg)
def f4(arg):
return f3(arg)
def f5(arg):
return f4(arg)
def f6(arg):
return f5(arg)
x = f6(SOURCE)
SINK(x)

11
python/ql/test/library-tests/taint/config/module.py Normal file
View File

@@ -0,0 +1,11 @@
dangerous = SOURCE
safe = "safe"
def dangerous_func():
return SOURCE
safe2 = SOURCE
safe2 = "safe"

32
python/ql/test/library-tests/taint/config/rockpaperscissors.py Normal file
View File

@@ -0,0 +1,32 @@
def rock(arg):
"SCISSORS are vulnerable"
def paper(arg):
"ROCK is vulnerable"
def scissors(arg):
"PAPER is vulnerable"
def test1():
rock(SCISSORS)
def test2():
paper(ROCK)
def test3():
x = ROCK
y = x.prev() #scissors
scissors(y)
def test4():
x = ROCK
y = x.prev().prev() # paper
scissors(y)
def test5():
x = SCISSORS
y = x.prev() # paper
paper(x)
paper(y)

36
python/ql/test/library-tests/taint/config/sanitizer.py Normal file
View File

@@ -0,0 +1,36 @@
#Sanitizer functions
def isEscapedSql(arg): pass
def isValidCommand(arg): pass
def sql_inject1():
x = user_input()
if isEscapedSql(x):
sql_query(x) # Safe
else:
sql_query(x) # DANGEROUS
def command_inject1():
x = user_input()
if isValidCommand(x):
os_command(x) # Safe
else:
os_command(x) # DANGEROUS
def sql_inject2():
x = user_input()
if notASanitizer(x):
sql_query(x) # DANGEROUS
else:
sql_query(x) # DANGEROUS
def command_inject2():
x = user_input()
if notASanitizer(x):
os_command(x) # DANGEROUS
else:
os_command(x) # DANGEROUS

215
python/ql/test/library-tests/taint/config/test.py Normal file
View File

@@ -0,0 +1,215 @@
def test1():
SINK(SOURCE)
def test2():
s = SOURCE
SINK(s)
def source():
return SOURCE
def sink(arg):
SINK(arg)
def test3():
t = source()
SINK(t)
def test4():
t = SOURCE
sink(t)
def test5():
t = source()
sink(t)
def test6(cond):
if cond:
t = "Safe"
else:
t = SOURCE
if cond:
SINK(t)
def test7(cond):
if cond:
t = SOURCE
else:
t = "Safe"
if cond:
SINK(t)
def source2(arg):
return source(arg)
def sink2(arg):
sink(arg)
def sink3(cond, arg):
if cond:
sink(arg)
def test8(cond):
t = source2()
sink2(t)
#False positive
def test9(cond):
if cond:
t = "Safe"
else:
t = SOURCE
sink3(cond, t)
def test10(cond):
if cond:
t = SOURCE
else:
t = "Safe"
sink3(cond, t)
def hub(arg):
return arg
def test11():
t = SOURCE
t = hub(t)
SINK(t)
def test12():
t = "safe"
t = hub(t)
SINK(t)
import module
def test13():
t = module.dangerous
SINK(t)
def test14():
t = module.safe
SINK(t)
def test15():
t = module.safe2
SINK(t)
def test16():
t = module.dangerous_func()
SINK(t)
class C(object): pass
def x_sink(arg):
SINK(arg.x)
def test17():
t = C()
t.x = module.dangerous
SINK(t.x)
def test18():
t = C()
t.x = module.dangerous
t = hub(t)
x_sink(t)
def test19():
t = CUSTOM_SOURCE
t = hub(TAINT_FROM_ARG(t))
CUSTOM_SINK(t)
def test20(cond):
if cond:
t = CUSTOM_SOURCE
else:
t = SOURCE
if cond:
CUSTOM_SINK(t)
else:
SINK(t)
def test21(cond):
if cond:
t = CUSTOM_SOURCE
else:
t = SOURCE
if not cond:
CUSTOM_SINK(t)
else:
SINK(t)
def test22(cond):
if cond:
t = CUSTOM_SOURCE
else:
t = SOURCE
t = TAINT_FROM_ARG(t)
if cond:
CUSTOM_SINK(t)
else:
SINK(t)
from module import dangerous as unsafe
SINK(unsafe)
def test23():
with SOURCE as t:
SINK(t)
def test24():
s = SOURCE
SANITIZE(s)
SINK(s)
def test_update_extend(x, y):
l = [SOURCE]
d = {"key" : SOURCE}
x.extend(l)
y.update(d)
SINK(x[0])
SINK(y["key"])
l2 = list(l)
d2 = dict(d)
def test_truth():
t = SOURCE
if t:
SINK(t)
else:
SINK(t)
if not t:
SINK(t)
else:
SINK(t)
def test_early_exit():
t = FALSEY
if not t:
return
t
def flow_through_type_test_if_no_class():
t = SOURCE
if isinstance(t, str):
SINK(t)
else:
SINK(t)
def flow_in_iteration():
t = ITERABLE_SOURCE
for i in t:
i
return i
def flow_in_generator():
seq = [SOURCE]
for i in seq:
yield i
def flow_from_generator():
for x in flow_in_generator():
SINK(x)

2
python/ql/test/library-tests/taint/dataflow/Dataflow.expected
View File

@@ -10,7 +10,5 @@
| test.py:108:13:108:18 | ControlFlowNode for SOURCE | test.py:112:14:112:14 | ControlFlowNode for t |
| test.py:139:10:139:15 | ControlFlowNode for SOURCE | test.py:140:14:140:14 | ControlFlowNode for t |
| test.py:143:9:143:14 | ControlFlowNode for SOURCE | test.py:145:10:145:10 | ControlFlowNode for s |
| test.py:148:10:148:15 | ControlFlowNode for SOURCE | test.py:152:10:152:13 | ControlFlowNode for Subscript |
| test.py:149:18:149:23 | ControlFlowNode for SOURCE | test.py:153:10:153:17 | ControlFlowNode for Subscript |
| test.py:158:9:158:14 | ControlFlowNode for SOURCE | test.py:160:14:160:14 | ControlFlowNode for t |
| test.py:158:9:158:14 | ControlFlowNode for SOURCE | test.py:166:14:166:14 | ControlFlowNode for t |

31
python/ql/test/library-tests/taint/dataflow/TestNode.expected
View File

@@ -1,17 +1,10 @@
WARNING: Predicate getNode has been deprecated and may be removed in future (TestNode.ql:5,77-84)
| Taint Data flow | test.py:3 | SOURCE | |
| Taint Data flow | test.py:6 | SOURCE | |
| Taint Data flow | test.py:7 | s | |
| Taint Data flow | test.py:10 | SOURCE | |
| Taint Data flow | test.py:12 | arg | test.py:21 |
| Taint Data flow | test.py:12 | arg | test.py:25 |
| Taint Data flow | test.py:12 | arg | test.py:47 from test.py:55 |
| Taint Data flow | test.py:12 | arg | test.py:51 from test.py:63 |
| Taint Data flow | test.py:12 | arg | test.py:51 from test.py:70 |
| Taint Data flow | test.py:13 | arg | test.py:21 |
| Taint Data flow | test.py:13 | arg | test.py:25 |
| Taint Data flow | test.py:13 | arg | test.py:47 from test.py:55 |
| Taint Data flow | test.py:13 | arg | test.py:51 from test.py:63 |
| Taint Data flow | test.py:13 | arg | test.py:51 from test.py:70 |
| Taint Data flow | test.py:12 | arg | p0 = Data flow |
| Taint Data flow | test.py:13 | arg | p0 = Data flow |
| Taint Data flow | test.py:16 | source() | |
| Taint Data flow | test.py:17 | t | |
| Taint Data flow | test.py:20 | SOURCE | |
@@ -22,20 +15,18 @@
| Taint Data flow | test.py:37 | SOURCE | |
| Taint Data flow | test.py:41 | t | |
| Taint Data flow | test.py:44 | source() | |
| Taint Data flow | test.py:46 | arg | test.py:55 |
| Taint Data flow | test.py:47 | arg | test.py:55 |
| Taint Data flow | test.py:49 | arg | test.py:63 |
| Taint Data flow | test.py:49 | arg | test.py:70 |
| Taint Data flow | test.py:51 | arg | test.py:63 |
| Taint Data flow | test.py:51 | arg | test.py:70 |
| Taint Data flow | test.py:46 | arg | p0 = Data flow |
| Taint Data flow | test.py:47 | arg | p0 = Data flow |
| Taint Data flow | test.py:49 | arg | p1 = Data flow |
| Taint Data flow | test.py:51 | arg | p1 = Data flow |
| Taint Data flow | test.py:54 | source2() | |
| Taint Data flow | test.py:55 | t | |
| Taint Data flow | test.py:62 | SOURCE | |
| Taint Data flow | test.py:63 | t | |
| Taint Data flow | test.py:67 | SOURCE | |
| Taint Data flow | test.py:70 | t | |
| Taint Data flow | test.py:72 | arg | test.py:77 |
| Taint Data flow | test.py:73 | arg | test.py:77 |
| Taint Data flow | test.py:72 | arg | p0 = Data flow |
| Taint Data flow | test.py:73 | arg | p0 = Data flow |
| Taint Data flow | test.py:76 | SOURCE | |
| Taint Data flow | test.py:77 | hub() | |
| Taint Data flow | test.py:77 | t | |
@@ -53,8 +44,6 @@
| Taint Data flow | test.py:145 | s | |
| Taint Data flow | test.py:148 | SOURCE | |
| Taint Data flow | test.py:149 | SOURCE | |
| Taint Data flow | test.py:152 | Subscript | |
| Taint Data flow | test.py:153 | Subscript | |
| Taint Data flow | test.py:158 | SOURCE | |
| Taint Data flow | test.py:159 | t | |
| Taint Data flow | test.py:160 | t | |
@@ -62,11 +51,9 @@
| Taint Data flow | test.py:166 | t | |
| Taint [Data flow] | test.py:148 | List | |
| Taint [Data flow] | test.py:150 | l | |
| Taint [Data flow] | test.py:152 | x | |
| Taint [Data flow] | test.py:154 | l | |
| Taint [Data flow] | test.py:154 | list() | |
| Taint {Data flow} | test.py:149 | Dict | |
| Taint {Data flow} | test.py:151 | d | |
| Taint {Data flow} | test.py:153 | y | |
| Taint {Data flow} | test.py:155 | d | |
| Taint {Data flow} | test.py:155 | dict() | |

2
python/ql/test/library-tests/taint/dataflow/TestNode.ql
View File

@@ -2,4 +2,4 @@ import python
import Config
from TaintedNode n
select n.getTrackedValue(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext()
select "Taint " + n.getTaintKind(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext()

60
python/ql/test/library-tests/taint/example/DilbertConfig.qll Normal file
View File

@@ -0,0 +1,60 @@
/**
* @kind path-problem
*
* An example configuration.
* See ExampleConfiguration.expected for the results of running this query.
*/
import python
import semmle.python.dataflow.Configuration
/* First of all we set up some TaintKinds */
class Engineer extends TaintKind {
Engineer() { this = "Wally" or this = "Dilbert" }
}
class Wally extends Engineer {
Wally() { this = "Wally" }
}
/** Then the configuration */
class DilbertConfig extends TaintTracking::Configuration {
DilbertConfig() { this = "Dilbert config" }
override predicate isSource(DataFlow::Node node, TaintKind kind) {
node.asAstNode().(Name).getId() = "ENGINEER" and kind instanceof Engineer
}
override predicate isSink(DataFlow::Node node, TaintKind kind) {
/* Engineers hate meetings */
function_param("meeting", node) and kind instanceof Engineer
}
override predicate isBarrier(DataFlow::Node node, TaintKind kind) {
/* There is no way that Wally is working through lunch */
function_param("lunch", node) and kind instanceof Wally
}
override predicate isBarrier(DataFlow::Node node) {
/* Even the conscientious stop work if the building is on fire */
function_param("fire", node)
}
}
/** Helper predicate looking for `funcname(..., arg, ...)` */
private predicate function_param(string funcname, DataFlow::Node arg) {
exists(Call call |
call.getFunc().(Name).getId() = funcname and
arg.asAstNode() = call.getAnArg()
)
}

85
python/ql/test/library-tests/taint/example/Edges.expected Normal file
View File

@@ -0,0 +1,85 @@
| 5: SSA variable worker = Dilbert (p1 = Dilbert) | use | 6: worker = Dilbert (p1 = Dilbert) |
| 5: SSA variable worker = Wally (p1 = Wally) | use | 6: worker = Wally (p1 = Wally) |
| 5: worker = Dilbert (p1 = Dilbert) | [dataflow] | 5: SSA variable worker = Dilbert (p1 = Dilbert) |
| 5: worker = Wally (p1 = Wally) | [dataflow] | 5: SSA variable worker = Wally (p1 = Wally) |
| 6: worker = Dilbert (p1 = Dilbert) | [dataflow] | 6: SSA variable self.worker = Dilbert (p1 = Dilbert) |
| 6: worker = Wally (p1 = Wally) | [dataflow] | 6: SSA variable self.worker = Wally (p1 = Wally) |
| 8: SSA variable worker = Dilbert (p0 = Dilbert) | [dataflow] | 10: SSA variable worker = Dilbert (p0 = Dilbert) |
| 8: SSA variable worker = Dilbert (p0 = Dilbert) | use | 10: worker = Dilbert (p0 = Dilbert) |
| 8: SSA variable worker = Wally (p0 = Wally) | [dataflow] | 10: SSA variable worker = Wally (p0 = Wally) |
| 8: SSA variable worker = Wally (p0 = Wally) | use | 10: worker = Wally (p0 = Wally) |
| 8: worker = Dilbert (p0 = Dilbert) | [dataflow] | 8: SSA variable worker = Dilbert (p0 = Dilbert) |
| 8: worker = Wally (p0 = Wally) | [dataflow] | 8: SSA variable worker = Wally (p0 = Wally) |
| 10: worker = Dilbert (p0 = Dilbert) | parameter | 5: worker = Dilbert (p1 = Dilbert) |
| 10: worker = Wally (p0 = Wally) | parameter | 5: worker = Wally (p1 = Wally) |
| 12: SSA variable worker = Dilbert (p0 = Dilbert) | use | 13: worker = Dilbert (p0 = Dilbert) |
| 12: worker = Dilbert (p0 = Dilbert) | [dataflow] | 12: SSA variable worker = Dilbert (p0 = Dilbert) |
| 17: ENGINEER = Dilbert | [dataflow] | 17: SSA variable worker = Dilbert |
| 17: ENGINEER = Wally | [dataflow] | 17: SSA variable worker = Wally |
| 17: SSA variable worker = Dilbert | [dataflow] | 18: SSA variable worker = Dilbert |
| 17: SSA variable worker = Dilbert | use | 18: worker = Dilbert |
| 17: SSA variable worker = Wally | [dataflow] | 18: SSA variable worker = Wally |
| 17: SSA variable worker = Wally | use | 18: worker = Wally |
| 22: ENGINEER = Dilbert | [dataflow] | 22: SSA variable worker = Dilbert |
| 22: ENGINEER = Wally | [dataflow] | 22: SSA variable worker = Wally |
| 22: SSA variable worker = Dilbert | use | 23: worker = Dilbert |
| 23: SSA variable worker = Dilbert | [dataflow] | 24: SSA variable worker = Dilbert |
| 23: SSA variable worker = Dilbert | use | 24: worker = Dilbert |
| 23: lunch() = Dilbert | [dataflow] | 23: SSA variable worker = Dilbert |
| 23: worker = Dilbert | call | 23: lunch() = Dilbert |
| 23: worker = Dilbert | parameter | 12: worker = Dilbert (p0 = Dilbert) |
| 28: ENGINEER = Dilbert | [dataflow] | 28: SSA variable worker = Dilbert |
| 28: ENGINEER = Wally | [dataflow] | 28: SSA variable worker = Wally |
| 28: SSA variable worker = Dilbert | [dataflow] | 29: SSA variable worker = Dilbert |
| 28: SSA variable worker = Dilbert | use | 29: worker = Dilbert |
| 28: SSA variable worker = Wally | [dataflow] | 29: SSA variable worker = Wally |
| 28: SSA variable worker = Wally | use | 29: worker = Wally |
| 33: ENGINEER = Dilbert | [dataflow] | 33: SSA variable worker = Dilbert |
| 33: ENGINEER = Wally | [dataflow] | 33: SSA variable worker = Wally |
| 33: SSA variable worker = Dilbert | use | 34: worker = Dilbert |
| 33: SSA variable worker = Wally | use | 34: worker = Wally |
| 34: SSA variable task.worker = Dilbert | use | 37: task.worker = Dilbert |
| 34: SSA variable task.worker = Wally | use | 37: task.worker = Wally |
| 34: assign_task().worker = Dilbert | [dataflow] | 34: SSA variable task.worker = Dilbert |
| 34: assign_task().worker = Wally | [dataflow] | 34: SSA variable task.worker = Wally |
| 34: worker = Dilbert | call | 34: assign_task().worker = Dilbert |
| 34: worker = Dilbert | parameter | 8: worker = Dilbert (p0 = Dilbert) |
| 34: worker = Wally | call | 34: assign_task().worker = Wally |
| 34: worker = Wally | parameter | 8: worker = Wally (p0 = Wally) |
| 37: Attribute = Dilbert | call | 37: lunch() = Dilbert |
| 37: Attribute = Dilbert | parameter | 12: worker = Dilbert (p0 = Dilbert) |
| 37: SSA variable worker = Dilbert | [dataflow] | 39: SSA variable worker = Dilbert |
| 37: SSA variable worker = Dilbert | use | 39: worker = Dilbert |
| 37: lunch() = Dilbert | [dataflow] | 37: SSA variable worker = Dilbert |
| 43: ENGINEER = Dilbert | [dataflow] | 43: SSA variable worker = Dilbert |
| 43: ENGINEER = Wally | [dataflow] | 43: SSA variable worker = Wally |
| 48: SSA variable worker = Dilbert (p0 = Dilbert) | use | 53: worker = Dilbert (p0 = Dilbert) |
| 48: SSA variable worker = Wally (p0 = Wally) | use | 53: worker = Wally (p0 = Wally) |
| 48: worker = Dilbert (p0 = Dilbert) | [dataflow] | 48: SSA variable worker = Dilbert (p0 = Dilbert) |
| 48: worker = Wally (p0 = Wally) | [dataflow] | 48: SSA variable worker = Wally (p0 = Wally) |
| 57: ENGINEER = Dilbert | [dataflow] | 57: SSA variable worker = Dilbert |
| 57: ENGINEER = Wally | [dataflow] | 57: SSA variable worker = Wally |
| 57: SSA variable worker = Dilbert | use | 58: worker = Dilbert |
| 57: SSA variable worker = Wally | use | 58: worker = Wally |
| 58: SSA variable worker = Dilbert | [dataflow] | 60: SSA variable worker = Dilbert |
| 58: SSA variable worker = Dilbert | use | 60: worker = Dilbert |
| 58: SSA variable worker = Wally | [dataflow] | 60: SSA variable worker = Wally |
| 58: SSA variable worker = Wally | use | 60: worker = Wally |
| 58: cubical() = Dilbert | [dataflow] | 58: SSA variable worker = Dilbert |
| 58: cubical() = Wally | [dataflow] | 58: SSA variable worker = Wally |
| 58: worker = Dilbert | call | 58: cubical() = Dilbert |
| 58: worker = Dilbert | parameter | 48: worker = Dilbert (p0 = Dilbert) |
| 58: worker = Wally | call | 58: cubical() = Wally |
| 58: worker = Wally | parameter | 48: worker = Wally (p0 = Wally) |
| 64: ENGINEER = Dilbert | [dataflow] | 64: SSA variable worker = Dilbert |
| 64: ENGINEER = Wally | [dataflow] | 64: SSA variable worker = Wally |
| 64: SSA variable worker = Dilbert | use | 65: worker = Dilbert |
| 65: SSA variable worker = Dilbert | use | 66: worker = Dilbert |
| 65: lunch() = Dilbert | [dataflow] | 65: SSA variable worker = Dilbert |
| 65: worker = Dilbert | call | 65: lunch() = Dilbert |
| 65: worker = Dilbert | parameter | 12: worker = Dilbert (p0 = Dilbert) |
| 66: SSA variable worker = Dilbert | [dataflow] | 68: SSA variable worker = Dilbert |
| 66: SSA variable worker = Dilbert | use | 68: worker = Dilbert |
| 66: cubical() = Dilbert | [dataflow] | 66: SSA variable worker = Dilbert |
| 66: worker = Dilbert | call | 66: cubical() = Dilbert |
| 66: worker = Dilbert | parameter | 48: worker = Dilbert (p0 = Dilbert) |

34
python/ql/test/library-tests/taint/example/Edges.ql Normal file
View File

@@ -0,0 +1,34 @@
import python
import semmle.python.security.TaintTracking
import semmle.python.dataflow.Implementation
import DilbertConfig
string shortString(TaintTrackingNode n) {
if n.getContext().isTop() then
result = n.getLocation().getStartLine() + ": " + n.getNode().toString() + n.getPath().extension() + " = " + n.getTaintKind()
else
result = n.getLocation().getStartLine() + ": " + n.getNode().toString() + n.getPath().extension() + " = " + n.getTaintKind() + " (" + n.getContext().toString() + ")"
}
bindingset[s, len]
string ljust(string s, int len) {
result = s +
" ".prefix(len-s.length())
}
bindingset[s, len]
string format(string s, int len) {
exists(string label |
s = "" and label = "[dataflow]"
or
s != "" and label = s
|
result = ljust(label, len)
)
}
from TaintTrackingNode p, TaintTrackingNode s, string label
where any(DilbertConfig config).(TaintTrackingImplementation).flowStep(p, s, label)
select format(shortString(p), 50), format(label, 10), shortString(s)

35
python/ql/test/library-tests/taint/example/ExampleConfig.expected Normal file
View File

@@ -0,0 +1,35 @@
edges
| example.py:17:14:17:21 | Dilbert | example.py:18:13:18:18 | Dilbert |
| example.py:17:14:17:21 | Wally | example.py:18:13:18:18 | Wally |
| example.py:22:14:22:21 | Dilbert | example.py:23:20:23:25 | Dilbert |
| example.py:23:14:23:26 | Dilbert | example.py:24:13:24:18 | Dilbert |
| example.py:23:20:23:25 | Dilbert | example.py:23:14:23:26 | Dilbert |
| example.py:28:14:28:21 | Dilbert | example.py:29:13:29:18 | Dilbert |
| example.py:28:14:28:21 | Wally | example.py:29:13:29:18 | Wally |
| example.py:33:14:33:21 | Dilbert | example.py:34:24:34:29 | Dilbert |
| example.py:34:12:34:30 | .worker = Dilbert | example.py:37:20:37:23 | .worker = Dilbert |
| example.py:34:24:34:29 | Dilbert | example.py:34:12:34:30 | .worker = Dilbert |
| example.py:37:14:37:31 | Dilbert | example.py:39:13:39:18 | Dilbert |
| example.py:37:20:37:23 | .worker = Dilbert | example.py:37:20:37:30 | Dilbert |
| example.py:37:20:37:30 | Dilbert | example.py:37:14:37:31 | Dilbert |
| example.py:57:14:57:21 | Dilbert | example.py:58:22:58:27 | Dilbert |
| example.py:57:14:57:21 | Wally | example.py:58:22:58:27 | Wally |
| example.py:58:14:58:28 | Dilbert | example.py:60:13:60:18 | Dilbert |
| example.py:58:14:58:28 | Wally | example.py:60:13:60:18 | Wally |
| example.py:58:22:58:27 | Dilbert | example.py:58:14:58:28 | Dilbert |
| example.py:58:22:58:27 | Wally | example.py:58:14:58:28 | Wally |
| example.py:64:14:64:21 | Dilbert | example.py:65:20:65:25 | Dilbert |
| example.py:65:14:65:26 | Dilbert | example.py:66:22:66:27 | Dilbert |
| example.py:65:20:65:25 | Dilbert | example.py:65:14:65:26 | Dilbert |
| example.py:66:14:66:28 | Dilbert | example.py:68:13:68:18 | Dilbert |
| example.py:66:22:66:27 | Dilbert | example.py:66:14:66:28 | Dilbert |
#select
| example.py:18:13:18:18 | worker | example.py:17:14:17:21 | Dilbert | example.py:18:13:18:18 | Dilbert | $@ goes to a $@. | example.py:17:14:17:21 | ENGINEER | Dilbert | example.py:18:13:18:18 | worker | meeting |
| example.py:18:13:18:18 | worker | example.py:17:14:17:21 | Wally | example.py:18:13:18:18 | Wally | $@ goes to a $@. | example.py:17:14:17:21 | ENGINEER | Wally | example.py:18:13:18:18 | worker | meeting |
| example.py:24:13:24:18 | worker | example.py:22:14:22:21 | Dilbert | example.py:24:13:24:18 | Dilbert | $@ goes to a $@. | example.py:22:14:22:21 | ENGINEER | Dilbert | example.py:24:13:24:18 | worker | meeting |
| example.py:29:13:29:18 | worker | example.py:28:14:28:21 | Dilbert | example.py:29:13:29:18 | Dilbert | $@ goes to a $@. | example.py:28:14:28:21 | ENGINEER | Dilbert | example.py:29:13:29:18 | worker | meeting |
| example.py:29:13:29:18 | worker | example.py:28:14:28:21 | Wally | example.py:29:13:29:18 | Wally | $@ goes to a $@. | example.py:28:14:28:21 | ENGINEER | Wally | example.py:29:13:29:18 | worker | meeting |
| example.py:39:13:39:18 | worker | example.py:33:14:33:21 | Dilbert | example.py:39:13:39:18 | Dilbert | $@ goes to a $@. | example.py:33:14:33:21 | ENGINEER | Dilbert | example.py:39:13:39:18 | worker | meeting |
| example.py:60:13:60:18 | worker | example.py:57:14:57:21 | Dilbert | example.py:60:13:60:18 | Dilbert | $@ goes to a $@. | example.py:57:14:57:21 | ENGINEER | Dilbert | example.py:60:13:60:18 | worker | meeting |
| example.py:60:13:60:18 | worker | example.py:57:14:57:21 | Wally | example.py:60:13:60:18 | Wally | $@ goes to a $@. | example.py:57:14:57:21 | ENGINEER | Wally | example.py:60:13:60:18 | worker | meeting |
| example.py:68:13:68:18 | worker | example.py:64:14:64:21 | Dilbert | example.py:68:13:68:18 | Dilbert | $@ goes to a $@. | example.py:64:14:64:21 | ENGINEER | Dilbert | example.py:68:13:68:18 | worker | meeting |

15
python/ql/test/library-tests/taint/example/ExampleConfig.ql Normal file
View File

@@ -0,0 +1,15 @@
/**
* @kind path-problem
*
* An example configuration.
* See ExampleConfiguration.expected for the results of running this query.
*/
import python
import DilbertConfig
import semmle.python.security.Paths
from DilbertConfig config, TaintedPathSource src, TaintedPathSink sink
where config.hasFlowPath(src, sink)
select sink.getSink(), src, sink, "$@ goes to a $@.", src.getNode(), src.getTaintKind().toString(), sink.getNode(), "meeting"

99
python/ql/test/library-tests/taint/example/Nodes.expected Normal file
View File

@@ -0,0 +1,99 @@
| example.py:5 | SSA variable worker | no attribute | p1 = Dilbert | Dilbert |
| example.py:5 | SSA variable worker | no attribute | p1 = Wally | Wally |
| example.py:5 | worker | no attribute | p1 = Dilbert | Dilbert |
| example.py:5 | worker | no attribute | p1 = Wally | Wally |
| example.py:6 | SSA variable self | attribute worker | p1 = Dilbert | Dilbert |
| example.py:6 | SSA variable self | attribute worker | p1 = Wally | Wally |
| example.py:6 | worker | no attribute | p1 = Dilbert | Dilbert |
| example.py:6 | worker | no attribute | p1 = Wally | Wally |
| example.py:8 | SSA variable worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:8 | SSA variable worker | no attribute | p0 = Wally | Wally |
| example.py:8 | worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:8 | worker | no attribute | p0 = Wally | Wally |
| example.py:10 | SSA variable worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:10 | SSA variable worker | no attribute | p0 = Wally | Wally |
| example.py:10 | Task() | attribute worker | p0 = Dilbert | Dilbert |
| example.py:10 | Task() | attribute worker | p0 = Wally | Wally |
| example.py:10 | worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:10 | worker | no attribute | p0 = Wally | Wally |
| example.py:12 | SSA variable worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:12 | worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:13 | worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:17 | ENGINEER | no attribute | | Dilbert |
| example.py:17 | ENGINEER | no attribute | | Wally |
| example.py:17 | SSA variable worker | no attribute | | Dilbert |
| example.py:17 | SSA variable worker | no attribute | | Wally |
| example.py:18 | SSA variable worker | no attribute | | Dilbert |
| example.py:18 | SSA variable worker | no attribute | | Wally |
| example.py:18 | worker | no attribute | | Dilbert |
| example.py:18 | worker | no attribute | | Wally |
| example.py:22 | ENGINEER | no attribute | | Dilbert |
| example.py:22 | ENGINEER | no attribute | | Wally |
| example.py:22 | SSA variable worker | no attribute | | Dilbert |
| example.py:22 | SSA variable worker | no attribute | | Wally |
| example.py:23 | SSA variable worker | no attribute | | Dilbert |
| example.py:23 | lunch() | no attribute | | Dilbert |
| example.py:23 | worker | no attribute | | Dilbert |
| example.py:24 | SSA variable worker | no attribute | | Dilbert |
| example.py:24 | worker | no attribute | | Dilbert |
| example.py:28 | ENGINEER | no attribute | | Dilbert |
| example.py:28 | ENGINEER | no attribute | | Wally |
| example.py:28 | SSA variable worker | no attribute | | Dilbert |
| example.py:28 | SSA variable worker | no attribute | | Wally |
| example.py:29 | SSA variable worker | no attribute | | Dilbert |
| example.py:29 | SSA variable worker | no attribute | | Wally |
| example.py:29 | worker | no attribute | | Dilbert |
| example.py:29 | worker | no attribute | | Wally |
| example.py:33 | ENGINEER | no attribute | | Dilbert |
| example.py:33 | ENGINEER | no attribute | | Wally |
| example.py:33 | SSA variable worker | no attribute | | Dilbert |
| example.py:33 | SSA variable worker | no attribute | | Wally |
| example.py:34 | SSA variable task | attribute worker | | Dilbert |
| example.py:34 | SSA variable task | attribute worker | | Wally |
| example.py:34 | assign_task() | attribute worker | | Dilbert |
| example.py:34 | assign_task() | attribute worker | | Wally |
| example.py:34 | worker | no attribute | | Dilbert |
| example.py:34 | worker | no attribute | | Wally |
| example.py:37 | Attribute | no attribute | | Dilbert |
| example.py:37 | SSA variable worker | no attribute | | Dilbert |
| example.py:37 | lunch() | no attribute | | Dilbert |
| example.py:37 | task | attribute worker | | Dilbert |
| example.py:37 | task | attribute worker | | Wally |
| example.py:39 | SSA variable worker | no attribute | | Dilbert |
| example.py:39 | worker | no attribute | | Dilbert |
| example.py:43 | ENGINEER | no attribute | | Dilbert |
| example.py:43 | ENGINEER | no attribute | | Wally |
| example.py:43 | SSA variable worker | no attribute | | Dilbert |
| example.py:43 | SSA variable worker | no attribute | | Wally |
| example.py:48 | SSA variable worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:48 | SSA variable worker | no attribute | p0 = Wally | Wally |
| example.py:48 | worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:48 | worker | no attribute | p0 = Wally | Wally |
| example.py:53 | worker | no attribute | p0 = Dilbert | Dilbert |
| example.py:53 | worker | no attribute | p0 = Wally | Wally |
| example.py:57 | ENGINEER | no attribute | | Dilbert |
| example.py:57 | ENGINEER | no attribute | | Wally |
| example.py:57 | SSA variable worker | no attribute | | Dilbert |
| example.py:57 | SSA variable worker | no attribute | | Wally |
| example.py:58 | SSA variable worker | no attribute | | Dilbert |
| example.py:58 | SSA variable worker | no attribute | | Wally |
| example.py:58 | cubical() | no attribute | | Dilbert |
| example.py:58 | cubical() | no attribute | | Wally |
| example.py:58 | worker | no attribute | | Dilbert |
| example.py:58 | worker | no attribute | | Wally |
| example.py:60 | SSA variable worker | no attribute | | Dilbert |
| example.py:60 | SSA variable worker | no attribute | | Wally |
| example.py:60 | worker | no attribute | | Dilbert |
| example.py:60 | worker | no attribute | | Wally |
| example.py:64 | ENGINEER | no attribute | | Dilbert |
| example.py:64 | ENGINEER | no attribute | | Wally |
| example.py:64 | SSA variable worker | no attribute | | Dilbert |
| example.py:64 | SSA variable worker | no attribute | | Wally |
| example.py:65 | SSA variable worker | no attribute | | Dilbert |
| example.py:65 | lunch() | no attribute | | Dilbert |
| example.py:65 | worker | no attribute | | Dilbert |
| example.py:66 | SSA variable worker | no attribute | | Dilbert |
| example.py:66 | cubical() | no attribute | | Dilbert |
| example.py:66 | worker | no attribute | | Dilbert |
| example.py:68 | SSA variable worker | no attribute | | Dilbert |
| example.py:68 | worker | no attribute | | Dilbert |

10
python/ql/test/library-tests/taint/example/Nodes.ql Normal file
View File

@@ -0,0 +1,10 @@
import python
import semmle.python.security.TaintTracking
import semmle.python.dataflow.Implementation
import DilbertConfig
from TaintTrackingNode n
where n.getConfiguration() instanceof DilbertConfig
select n.getLocation().toString(), n.getNode().toString(), n.getPath().toString(), n.getContext().toString(), n.getTaintKind()

69
python/ql/test/library-tests/taint/example/example.py Normal file
View File

@@ -0,0 +1,69 @@
# A class to demonstrate tracking of tainted attributes.
class Task(object):
def __init__(self, worker):
self.worker = worker
def assign_task(worker):
# The Task object will have its .worker attribute with whatever taint `worker`
return Task(worker)
def lunch(worker):
return worker
# The engineers go to a meeting
def example1():
worker = ENGINEER
meeting(worker)
# The engineers go to a meeting, but might need to skip lunch
def example2():
worker = ENGINEER
worker = lunch(worker)
meeting(worker)
# Everyone goes to a meeting (but that's OK for the managers)
def example3():
worker = ENGINEER
meeting(worker)
#Tracking taint of an attribute.
def example4():
worker = ENGINEER
task = assign_task(worker)
#Here 'task' has its .worker attribute "tainted"
#Task team lunch
worker = lunch(task.worker)
#And meeting
meeting(worker)
#A fire -- A barrier to all kinds of taint.
def example5():
worker = ENGINEER
worker = fire(worker)
meeting(worker)
#Some context sensitive flow
def cubical(worker):
''' The flow here is context sensitive.
In example6 the worker can be any engineer,
but in example7 is cannot be Wally.
'''
return worker
# Workers go back to their cubicals
def example6():
worker = ENGINEER
worker = cubical(worker)
#And meeting
meeting(worker)
# Workers have lunch, then go back to their cubicals
def example7():
worker = ENGINEER
worker = lunch(worker)
worker = cubical(worker)
#And meeting
meeting(worker)

1
python/ql/test/library-tests/taint/exception_traceback/TestNode.expected
View File

@@ -1,3 +1,4 @@
WARNING: Predicate getNode has been deprecated and may be removed in future (TestNode.ql:8,43-50)
| test.py:10:11:10:47 | test.py:10 | MyException() | exception.kind |
| test.py:15:25:15:25 | test.py:15 | e | exception.kind |
| test.py:16:13:16:34 | test.py:16 | Attribute() | exception.info |

6
python/ql/test/library-tests/taint/exception_traceback/TestStep.ql
View File

@@ -4,11 +4,11 @@ import semmle.python.security.Exceptions
import semmle.python.web.HttpResponse
from TaintedNode n, TaintedNode s
where
where
s = n.getASuccessor() and
not n.getLocation().getFile().inStdlib() and
not s.getLocation().getFile().inStdlib()
select
n.getTrackedValue(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext(),
"Taint " + n.getTaintKind(), n.getLocation().toString(), n.getNode().toString(), n.getContext(),
" --> ",
s.getTrackedValue(), s.getLocation().toString(), s.getNode().getNode().toString(), s.getContext()
"Taint " + s.getTaintKind(), s.getLocation().toString(), s.getNode().toString(), s.getContext()

11
python/ql/test/library-tests/taint/extensions/TestNode.expected
View File

@@ -1,8 +1,9 @@
| Taint simple.test | visitor.py:10 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:13 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:18 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:19 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:21 | arg | visitor.py:26 |
WARNING: Predicate getNode has been deprecated and may be removed in future (TestNode.ql:7,77-84)
| Taint simple.test | visitor.py:10 | arg | p2 = simple.test |
| Taint simple.test | visitor.py:13 | arg | p2 = simple.test |
| Taint simple.test | visitor.py:18 | arg | |
| Taint simple.test | visitor.py:19 | arg | |
| Taint simple.test | visitor.py:21 | arg | |
| Taint simple.test | visitor.py:26 | Attribute() | |
| Taint simple.test | visitor.py:26 | SOURCE | |
| Taint simple.test | visitor.py:27 | x | |

2
python/ql/test/library-tests/taint/extensions/TestNode.ql
View File

@@ -4,5 +4,5 @@ import ExtensionsLib
from TaintedNode n
select n.getTrackedValue(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext()
select "Taint " + n.getTaintKind(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext()

14
python/ql/test/library-tests/taint/extensions/TestStep.expected
View File

@@ -1,7 +1,9 @@
| Taint simple.test | visitor.py:10 | arg | visitor.py:26 | --> | Taint simple.test | visitor.py:13 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:18 | arg | visitor.py:26 | --> | Taint simple.test | visitor.py:19 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:19 | arg | visitor.py:26 | --> | Taint simple.test | visitor.py:26 | Attribute() | |
WARNING: Predicate getNode has been deprecated and may be removed in future (TestStep.ql:9,74-81)
WARNING: Predicate getNode has been deprecated and may be removed in future (TestStep.ql:11,74-81)
| Taint simple.test | visitor.py:10 | arg | p2 = simple.test | --> | Taint simple.test | visitor.py:13 | arg | p2 = simple.test |
| Taint simple.test | visitor.py:18 | arg | | --> | Taint simple.test | visitor.py:19 | arg | |
| Taint simple.test | visitor.py:19 | arg | | --> | Taint simple.test | visitor.py:26 | Attribute() | |
| Taint simple.test | visitor.py:26 | Attribute() | | --> | Taint simple.test | visitor.py:27 | x | |
| Taint simple.test | visitor.py:26 | SOURCE | | --> | Taint simple.test | visitor.py:10 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:26 | SOURCE | | --> | Taint simple.test | visitor.py:18 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:26 | SOURCE | | --> | Taint simple.test | visitor.py:21 | arg | visitor.py:26 |
| Taint simple.test | visitor.py:26 | SOURCE | | --> | Taint simple.test | visitor.py:10 | arg | p2 = simple.test |
| Taint simple.test | visitor.py:26 | SOURCE | | --> | Taint simple.test | visitor.py:18 | arg | |
| Taint simple.test | visitor.py:26 | SOURCE | | --> | Taint simple.test | visitor.py:21 | arg | |

4
python/ql/test/library-tests/taint/extensions/TestStep.ql
View File

@@ -6,6 +6,6 @@ import ExtensionsLib
from TaintedNode n, TaintedNode s
where s = n.getASuccessor()
select
n.getTrackedValue(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext(),
"Taint " + n.getTaintKind(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext(),
" --> ",
s.getTrackedValue(), s.getLocation().toString(), s.getNode().getNode().toString(), s.getContext()
"Taint " + s.getTaintKind(), s.getLocation().toString(), s.getNode().getNode().toString(), s.getContext()

61
python/ql/test/library-tests/taint/general/Contexts.expected
View File

@@ -1,31 +1,30 @@
| carrier.py:17 | Function __init__ |
| carrier.py:25 | Function __init__ |
| carrier.py:25 | Function hub |
| carrier.py:29 | Function hub |
| carrier.py:33 | Function __init__ |
| deep.py:6 from deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | Function f1 |
| deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | Function f2 |
| deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | Function f3 |
| deep.py:15 from deep.py:18 from deep.py:20 | Function f4 |
| deep.py:18 from deep.py:20 | Function f5 |
| deep.py:20 | Function f6 |
| rockpaperscissors.py:13 | Function rock |
| rockpaperscissors.py:16 | Function paper |
| rockpaperscissors.py:21 | Function scissors |
| rockpaperscissors.py:26 | Function scissors |
| rockpaperscissors.py:31 | Function paper |
| rockpaperscissors.py:32 | Function paper |
| sanitizer.py:10 | Function isEscapedSql |
| sanitizer.py:17 | Function isValidCommand |
| test.py:21 | Function sink |
| test.py:25 | Function sink |
| test.py:47 from test.py:55 | Function sink |
| test.py:51 from test.py:63 | Function sink |
| test.py:51 from test.py:70 | Function sink |
| test.py:55 | Function sink2 |
| test.py:63 | Function sink3 |
| test.py:70 | Function sink3 |
| test.py:77 | Function hub |
| test.py:116 | Function hub |
| test.py:117 | Function x_sink |
| test.py:121 | Function hub |
WARNING: Type CallContext has been deprecated and may be removed in future (Contexts.ql:6,6-17)
WARNING: Type CallContext has been deprecated and may be removed in future (Contexts.ql:7,14-25)
| carrier.py:4 | p1 = explicit.carrier | Function __init__ |
| carrier.py:4 | p1 = simple.test | Function __init__ |
| carrier.py:10 | p0.attr = simple.test | Function get_attr |
| carrier.py:13 | p0 = explicit.carrier | Function hub |
| carrier.py:13 | p0.attr = simple.test | Function hub |
| deep.py:2 | p0 = simple.test | Function f1 |
| deep.py:5 | p0 = simple.test | Function f2 |
| deep.py:8 | p0 = simple.test | Function f3 |
| deep.py:11 | p0 = simple.test | Function f4 |
| deep.py:14 | p0 = simple.test | Function f5 |
| deep.py:17 | p0 = simple.test | Function f6 |
| rockpaperscissors.py:3 | p0 = scissors | Function rock |
| rockpaperscissors.py:6 | p0 = paper | Function paper |
| rockpaperscissors.py:6 | p0 = rock | Function paper |
| rockpaperscissors.py:6 | p0 = scissors | Function paper |
| rockpaperscissors.py:9 | p0 = paper | Function scissors |
| rockpaperscissors.py:9 | p0 = scissors | Function scissors |
| sanitizer.py:3 | p0 = Command injection | Function isEscapedSql |
| sanitizer.py:3 | p0 = SQL injection | Function isEscapedSql |
| sanitizer.py:5 | p0 = Command injection | Function isValidCommand |
| sanitizer.py:5 | p0 = SQL injection | Function isValidCommand |
| test.py:12 | p0 = simple.test | Function sink |
| test.py:46 | p0 = simple.test | Function sink2 |
| test.py:49 | p1 = simple.test | Function sink3 |
| test.py:72 | p0 = basic.custom | Function hub |
| test.py:72 | p0 = simple.test | Function hub |
| test.py:72 | p0.x = simple.test | Function hub |
| test.py:105 | p0.x = simple.test | Function x_sink |

7
python/ql/test/library-tests/taint/general/Contexts.ql
View File

@@ -1,9 +1,10 @@
import python
import semmle.python.security.TaintTest
import semmle.python.dataflow.Implementation
import TaintLib
from CallContext context, Scope s
where exists(CallContext caller | caller.getCallee(_) = context) and context.appliesToScope(s)
select context, s.toString()
where exists(CallContext caller | caller.getCallee(_) = context) and
context.appliesToScope(s)
select s.getLocation().toString(), context, s.toString()

8
python/ql/test/library-tests/taint/general/ModuleAttribute.expected
View File

@@ -1,4 +1,4 @@
| Module deep | x | Taint simple.test | | deep.py:20 |
| Module module | dangerous | Taint simple.test | | module.py:3 |
| Module test | module | Attribute 'dangerous' taint simple.test | | test.py:85 |
| Module test | unsafe | Taint simple.test | | test.py:155 |
| Module deep | x | simple.test | | deep.py:20 |
| Module module | dangerous | simple.test | | module.py:3 |
| Module test | module | .dangerous = simple.test | | test.py:85 |
| Module test | unsafe | simple.test | | test.py:156 |

9
python/ql/test/library-tests/taint/general/ModuleAttribute.ql
View File

@@ -1,10 +1,9 @@
import python
import semmle.python.security.TaintTest
import semmle.python.dataflow.Implementation
import TaintLib
from ModuleValue m, string name, TaintedNode origin
from ModuleValue m, string name, TaintedNode origin, TaintTrackingImplementation impl
where impl.moduleAttributeTainted(m, name, origin)
where TaintFlowTest::module_attribute_tainted(m, name, origin)
select m.toString(), name, origin.getTrackedValue(), origin.getContext(), origin.getLocation().toString()
select m.toString(), name, origin.toString(), origin.getContext(), origin.getLocation().toString()

1
python/ql/test/library-tests/taint/general/ParamSource.expected
View File

@@ -1,4 +1,3 @@
| test | carrier.py:4 | 18 | Attribute | test |
| test | test.py:12 | 13 | arg | test |
| test | test.py:46 | 13 | arg | test |
| test | test.py:49 | 13 | arg | test |

10
python/ql/test/library-tests/taint/general/TaintLib.qll
View File

@@ -50,6 +50,13 @@ class SimpleSanitizer extends Sanitizer {
taint instanceof SimpleTest
}
override predicate sanitizingDefinition(TaintKind taint, EssaDefinition def) {
exists(CallNode call |
def.(ArgumentRefinement).getInput().getAUse() = call.getAnArg() and
call.getFunction().(NameNode).getId() = "SANITIZE"
) and
taint instanceof SimpleTest
}
}
class BasicCustomTaint extends TaintKind {
@@ -385,6 +392,3 @@ class TaintIterableSource extends TaintSource {
}
}

24
python/ql/test/library-tests/taint/general/TaintSanity.ql
View File

@@ -1,26 +1,26 @@
import python
import semmle.python.security.TaintTest
import semmle.python.dataflow.TaintTracking
import semmle.python.dataflow.Implementation
import TaintLib
from TaintFlowTest::TrackedValue taint, CallContext c, ControlFlowNode n, string what
from TaintKind taint, TaintTrackingContext c, DataFlow::Node n, string what, TaintTrackingImplementation impl
where
not exists(TaintedNode t | t.getTrackedValue() = taint and t.getNode() = n and t.getContext() = c) and
not exists(TaintedNode t | t.getTaintKind() = taint and t.getNode() = n and t.getContext() = c) and
(
TaintFlowTest::step(_, taint, c, n) and what = "missing node at end of step"
impl.flowStep(_, n, c, _, taint, _) and what = "missing node at end of step"
or
n.(TaintSource).isSourceOf(taint.(TaintFlowTest::TrackedTaint).getKind(), c) and what = "missing node for source"
impl.flowSource(n, c, _, taint) and what = "missing node for source"
)
or
exists(TaintedNode t | t.getTrackedValue() = taint and t.getNode() = n and t.getContext() = c
exists(TaintedNode t | t.getTaintKind() = taint and t.getNode() = n and t.getContext() = c
|
not TaintFlowTest::step(_, taint, c, n) and
not n.(TaintSource).isSourceOf(taint.(TaintFlowTest::TrackedTaint).getKind(), c) and what = "TaintedNode with no reason"
not impl.flowStep(_, n, c, _, taint, _) and
not impl.flowSource(n, c, _, taint) and what = "TaintedNode with no reason"
or
TaintFlowTest::step(t, taint, c, n) and what = "step ends where it starts"
impl.flowStep(t, n, c, _, taint, _) and what = "step ends where it starts"
or
TaintFlowTest::step(t, _, _, _) and not TaintFlowTest::step(_, taint, c, n) and
not n.(TaintSource).isSourceOf(taint.(TaintFlowTest::TrackedTaint).getKind(), c) and what = "No predecessor and not a source"
impl.flowStep(t, _, _, _, _, _) and not impl.flowStep(_, n, c, _, taint, _) and
not impl.flowSource(n, c, _, taint) and what = "No predecessor and not a source"
)
select n.getLocation(), taint, c, n.toString(), what

238
python/ql/test/library-tests/taint/general/TestDefn.expected
View File

@@ -1,191 +1,95 @@
| carrier.py:4 | ParameterDefinition | carrier.py:4 | Taint explicit.carrier | arg |
| carrier.py:4 | ParameterDefinition | carrier.py:4 | Taint simple.test | arg |
| carrier.py:5 | AttributeAssignment 'attr'(self_0) | carrier.py:5 | Attribute 'attr' taint explicit.carrier | self |
| carrier.py:5 | AttributeAssignment 'attr'(self_0) | carrier.py:5 | Attribute 'attr' taint simple.test | self |
| carrier.py:13 | ParameterDefinition | carrier.py:13 | Attribute 'attr' taint simple.test | arg |
| carrier.py:10 | ParameterDefinition | carrier.py:10 | Taint .attr = simple.test | self |
| carrier.py:13 | ParameterDefinition | carrier.py:13 | Taint .attr = simple.test | arg |
| carrier.py:13 | ParameterDefinition | carrier.py:13 | Taint explicit.carrier | arg |
| carrier.py:17 | ImplicitCarrier() | carrier.py:17 | Attribute 'attr' taint simple.test | ImplicitCarrier() |
| carrier.py:21 | TAINT_CARRIER_SOURCE | carrier.py:21 | Taint explicit.carrier | TAINT_CARRIER_SOURCE |
| carrier.py:22 | MethodCallsiteRefinement(c_0) | carrier.py:21 | Taint explicit.carrier | TAINT_CARRIER_SOURCE |
| carrier.py:25 | hub() | carrier.py:25 | Attribute 'attr' taint simple.test | hub() |
| carrier.py:29 | hub() | carrier.py:29 | Taint explicit.carrier | hub() |
| carrier.py:30 | MethodCallsiteRefinement(c_0) | carrier.py:29 | Taint explicit.carrier | hub() |
| carrier.py:33 | ImplicitCarrier() | carrier.py:33 | Attribute 'attr' taint explicit.carrier | ImplicitCarrier() |
| carrier.py:34 | Attribute | carrier.py:34 | Taint explicit.carrier | Attribute |
| carrier.py:35 | MethodCallsiteRefinement(x_0) | carrier.py:34 | Taint explicit.carrier | Attribute |
| carrier.py:17 | ImplicitCarrier() | carrier.py:17 | Taint .attr = simple.test | c |
| carrier.py:21 | TAINT_CARRIER_SOURCE | carrier.py:21 | Taint explicit.carrier | c |
| carrier.py:25 | hub() | carrier.py:25 | Taint .attr = simple.test | c |
| carrier.py:29 | hub() | carrier.py:29 | Taint explicit.carrier | c |
| carrier.py:33 | ImplicitCarrier() | carrier.py:33 | Taint .attr = explicit.carrier | c |
| carrier.py:34 | Attribute | carrier.py:34 | Taint explicit.carrier | x |
| deep.py:2 | ParameterDefinition | deep.py:2 | Taint simple.test | arg |
| deep.py:5 | ParameterDefinition | deep.py:5 | Taint simple.test | arg |
| deep.py:6 | ArgumentRefinement(arg_0) | deep.py:5 | Taint simple.test | arg |
| deep.py:8 | ParameterDefinition | deep.py:8 | Taint simple.test | arg |
| deep.py:9 | ArgumentRefinement(arg_0) | deep.py:8 | Taint simple.test | arg |
| deep.py:11 | ParameterDefinition | deep.py:11 | Taint simple.test | arg |
| deep.py:12 | ArgumentRefinement(arg_0) | deep.py:11 | Taint simple.test | arg |
| deep.py:14 | ParameterDefinition | deep.py:14 | Taint simple.test | arg |
| deep.py:15 | ArgumentRefinement(arg_0) | deep.py:14 | Taint simple.test | arg |
| deep.py:17 | ParameterDefinition | deep.py:17 | Taint simple.test | arg |
| deep.py:18 | ArgumentRefinement(arg_0) | deep.py:17 | Taint simple.test | arg |
| deep.py:20 | f6() | deep.py:20 | Taint simple.test | f6() |
| module.py:3 | SOURCE | module.py:3 | Taint simple.test | SOURCE |
| deep.py:20 | f6() | deep.py:20 | Taint simple.test | x |
| module.py:3 | SOURCE | module.py:3 | Taint simple.test | dangerous |
| rockpaperscissors.py:3 | ParameterDefinition | rockpaperscissors.py:3 | Taint scissors | arg |
| rockpaperscissors.py:6 | ParameterDefinition | rockpaperscissors.py:6 | Taint paper | arg |
| rockpaperscissors.py:6 | ParameterDefinition | rockpaperscissors.py:6 | Taint rock | arg |
| rockpaperscissors.py:6 | ParameterDefinition | rockpaperscissors.py:6 | Taint scissors | arg |
| rockpaperscissors.py:9 | ParameterDefinition | rockpaperscissors.py:9 | Taint paper | arg |
| rockpaperscissors.py:9 | ParameterDefinition | rockpaperscissors.py:9 | Taint scissors | arg |
| rockpaperscissors.py:19 | ROCK | rockpaperscissors.py:19 | Taint rock | ROCK |
| rockpaperscissors.py:20 | Attribute() | rockpaperscissors.py:20 | Taint scissors | Attribute() |
| rockpaperscissors.py:20 | MethodCallsiteRefinement(x_0) | rockpaperscissors.py:19 | Taint rock | ROCK |
| rockpaperscissors.py:21 | ArgumentRefinement(y_0) | rockpaperscissors.py:20 | Taint scissors | Attribute() |
| rockpaperscissors.py:24 | ROCK | rockpaperscissors.py:24 | Taint rock | ROCK |
| rockpaperscissors.py:25 | Attribute() | rockpaperscissors.py:25 | Taint paper | Attribute() |
| rockpaperscissors.py:25 | MethodCallsiteRefinement(x_0) | rockpaperscissors.py:24 | Taint rock | ROCK |
| rockpaperscissors.py:26 | ArgumentRefinement(y_0) | rockpaperscissors.py:25 | Taint paper | Attribute() |
| rockpaperscissors.py:29 | SCISSORS | rockpaperscissors.py:29 | Taint scissors | SCISSORS |
| rockpaperscissors.py:30 | Attribute() | rockpaperscissors.py:30 | Taint paper | Attribute() |
| rockpaperscissors.py:30 | MethodCallsiteRefinement(x_0) | rockpaperscissors.py:29 | Taint scissors | SCISSORS |
| rockpaperscissors.py:31 | ArgumentRefinement(x_1) | rockpaperscissors.py:29 | Taint scissors | SCISSORS |
| rockpaperscissors.py:32 | ArgumentRefinement(y_0) | rockpaperscissors.py:30 | Taint paper | Attribute() |
| rockpaperscissors.py:19 | ROCK | rockpaperscissors.py:19 | Taint rock | x |
| rockpaperscissors.py:20 | Attribute() | rockpaperscissors.py:20 | Taint scissors | y |
| rockpaperscissors.py:24 | ROCK | rockpaperscissors.py:24 | Taint rock | x |
| rockpaperscissors.py:25 | Attribute() | rockpaperscissors.py:25 | Taint paper | y |
| rockpaperscissors.py:29 | SCISSORS | rockpaperscissors.py:29 | Taint scissors | x |
| rockpaperscissors.py:30 | Attribute() | rockpaperscissors.py:30 | Taint paper | y |
| sanitizer.py:3 | ParameterDefinition | sanitizer.py:3 | Taint Command injection | arg |
| sanitizer.py:3 | ParameterDefinition | sanitizer.py:3 | Taint SQL injection | arg |
| sanitizer.py:5 | ParameterDefinition | sanitizer.py:5 | Taint Command injection | arg |
| sanitizer.py:5 | ParameterDefinition | sanitizer.py:5 | Taint SQL injection | arg |
| sanitizer.py:8 | phi(x_2, x_4) | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:8 | phi(x_2, x_4) | sanitizer.py:9 | Taint SQL injection | user_input() |
| sanitizer.py:9 | user_input() | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:9 | user_input() | sanitizer.py:9 | Taint SQL injection | user_input() |
| sanitizer.py:11 | ArgumentRefinement(x_1) | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:11 | Pi(x_0) [true] | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:13 | ArgumentRefinement(x_3) | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:13 | ArgumentRefinement(x_3) | sanitizer.py:9 | Taint SQL injection | user_input() |
| sanitizer.py:13 | Pi(x_0) [false] | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:13 | Pi(x_0) [false] | sanitizer.py:9 | Taint SQL injection | user_input() |
| sanitizer.py:15 | phi(x_2, x_4) | sanitizer.py:16 | Taint Command injection | user_input() |
| sanitizer.py:15 | phi(x_2, x_4) | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:16 | user_input() | sanitizer.py:16 | Taint Command injection | user_input() |
| sanitizer.py:16 | user_input() | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:18 | ArgumentRefinement(x_1) | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:18 | Pi(x_0) [true] | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:20 | ArgumentRefinement(x_3) | sanitizer.py:16 | Taint Command injection | user_input() |
| sanitizer.py:20 | ArgumentRefinement(x_3) | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:20 | Pi(x_0) [false] | sanitizer.py:16 | Taint Command injection | user_input() |
| sanitizer.py:20 | Pi(x_0) [false] | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:23 | phi(x_2, x_4) | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:23 | phi(x_2, x_4) | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:24 | user_input() | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:24 | user_input() | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:26 | ArgumentRefinement(x_1) | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:26 | ArgumentRefinement(x_1) | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:26 | Pi(x_0) [true] | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:26 | Pi(x_0) [true] | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:28 | ArgumentRefinement(x_3) | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:28 | ArgumentRefinement(x_3) | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:28 | Pi(x_0) [false] | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:28 | Pi(x_0) [false] | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:30 | phi(x_2, x_4) | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:30 | phi(x_2, x_4) | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:31 | user_input() | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:31 | user_input() | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:33 | ArgumentRefinement(x_1) | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:33 | ArgumentRefinement(x_1) | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:33 | Pi(x_0) [true] | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:33 | Pi(x_0) [true] | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:35 | ArgumentRefinement(x_3) | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:35 | ArgumentRefinement(x_3) | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:35 | Pi(x_0) [false] | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:35 | Pi(x_0) [false] | sanitizer.py:31 | Taint SQL injection | user_input() |
| test.py:6 | SOURCE | test.py:6 | Taint simple.test | SOURCE |
| test.py:7 | ArgumentRefinement(s_0) | test.py:6 | Taint simple.test | SOURCE |
| sanitizer.py:9 | user_input() | sanitizer.py:9 | Taint Command injection | x |
| sanitizer.py:9 | user_input() | sanitizer.py:9 | Taint SQL injection | x |
| sanitizer.py:16 | user_input() | sanitizer.py:16 | Taint Command injection | x |
| sanitizer.py:16 | user_input() | sanitizer.py:16 | Taint SQL injection | x |
| sanitizer.py:24 | user_input() | sanitizer.py:24 | Taint Command injection | x |
| sanitizer.py:24 | user_input() | sanitizer.py:24 | Taint SQL injection | x |
| sanitizer.py:31 | user_input() | sanitizer.py:31 | Taint Command injection | x |
| sanitizer.py:31 | user_input() | sanitizer.py:31 | Taint SQL injection | x |
| test.py:6 | SOURCE | test.py:6 | Taint simple.test | s |
| test.py:12 | ParameterDefinition | test.py:12 | Taint simple.test | arg |
| test.py:13 | ArgumentRefinement(arg_0) | test.py:12 | Taint simple.test | arg |
| test.py:16 | source() | test.py:16 | Taint simple.test | source() |
| test.py:17 | ArgumentRefinement(t_0) | test.py:16 | Taint simple.test | source() |
| test.py:20 | SOURCE | test.py:20 | Taint simple.test | SOURCE |
| test.py:21 | ArgumentRefinement(t_0) | test.py:20 | Taint simple.test | SOURCE |
| test.py:24 | source() | test.py:24 | Taint simple.test | source() |
| test.py:25 | ArgumentRefinement(t_0) | test.py:24 | Taint simple.test | source() |
| test.py:31 | SOURCE | test.py:31 | Taint simple.test | SOURCE |
| test.py:37 | SOURCE | test.py:37 | Taint simple.test | SOURCE |
| test.py:41 | ArgumentRefinement(t_0) | test.py:37 | Taint simple.test | SOURCE |
| test.py:16 | source() | test.py:16 | Taint simple.test | t |
| test.py:20 | SOURCE | test.py:20 | Taint simple.test | t |
| test.py:24 | source() | test.py:24 | Taint simple.test | t |
| test.py:31 | SOURCE | test.py:31 | Taint simple.test | t |
| test.py:37 | SOURCE | test.py:37 | Taint simple.test | t |
| test.py:46 | ParameterDefinition | test.py:46 | Taint simple.test | arg |
| test.py:47 | ArgumentRefinement(arg_0) | test.py:46 | Taint simple.test | arg |
| test.py:49 | ParameterDefinition | test.py:49 | Taint simple.test | arg |
| test.py:49 | phi(arg_0, arg_1) | test.py:49 | Taint simple.test | arg |
| test.py:51 | ArgumentRefinement(arg_0) | test.py:49 | Taint simple.test | arg |
| test.py:54 | source2() | test.py:54 | Taint simple.test | source2() |
| test.py:55 | ArgumentRefinement(t_0) | test.py:54 | Taint simple.test | source2() |
| test.py:62 | SOURCE | test.py:62 | Taint simple.test | SOURCE |
| test.py:63 | phi(t_0, t_1) | test.py:62 | Taint simple.test | SOURCE |
| test.py:67 | SOURCE | test.py:67 | Taint simple.test | SOURCE |
| test.py:70 | phi(t_0, t_1) | test.py:67 | Taint simple.test | SOURCE |
| test.py:72 | ParameterDefinition | test.py:72 | Attribute 'x' taint simple.test | arg |
| test.py:54 | source2() | test.py:54 | Taint simple.test | t |
| test.py:62 | SOURCE | test.py:62 | Taint simple.test | t |
| test.py:67 | SOURCE | test.py:67 | Taint simple.test | t |
| test.py:72 | ParameterDefinition | test.py:72 | Taint .x = simple.test | arg |
| test.py:72 | ParameterDefinition | test.py:72 | Taint basic.custom | arg |
| test.py:72 | ParameterDefinition | test.py:72 | Taint simple.test | arg |
| test.py:76 | SOURCE | test.py:76 | Taint simple.test | SOURCE |
| test.py:77 | hub() | test.py:77 | Taint simple.test | hub() |
| test.py:78 | ArgumentRefinement(t_1) | test.py:77 | Taint simple.test | hub() |
| test.py:85 | ImportExpr | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:87 | ScopeEntryDefinition | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:88 | Attribute | test.py:88 | Taint simple.test | Attribute |
| test.py:89 | ArgumentRefinement(t_0) | test.py:88 | Taint simple.test | Attribute |
| test.py:91 | ScopeEntryDefinition | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:95 | ScopeEntryDefinition | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:99 | ScopeEntryDefinition | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:100 | Attribute() | test.py:100 | Taint simple.test | Attribute() |
| test.py:101 | ArgumentRefinement(t_0) | test.py:100 | Taint simple.test | Attribute() |
| test.py:105 | ParameterDefinition | test.py:105 | Attribute 'x' taint simple.test | arg |
| test.py:108 | ScopeEntryDefinition | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:110 | AttributeAssignment 'x'(t_0) | test.py:110 | Attribute 'x' taint simple.test | t |
| test.py:113 | ScopeEntryDefinition | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:115 | AttributeAssignment 'x'(t_0) | test.py:115 | Attribute 'x' taint simple.test | t |
| test.py:116 | hub() | test.py:116 | Attribute 'x' taint simple.test | hub() |
| test.py:117 | ArgumentRefinement(t_2) | test.py:116 | Attribute 'x' taint simple.test | hub() |
| test.py:120 | CUSTOM_SOURCE | test.py:120 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:121 | hub() | test.py:121 | Taint basic.custom | hub() |
| test.py:122 | ArgumentRefinement(t_1) | test.py:121 | Taint basic.custom | hub() |
| test.py:126 | CUSTOM_SOURCE | test.py:126 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:128 | SOURCE | test.py:128 | Taint simple.test | SOURCE |
| test.py:130 | ArgumentRefinement(t_0) | test.py:126 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:132 | ArgumentRefinement(t_2) | test.py:128 | Taint simple.test | SOURCE |
| test.py:136 | CUSTOM_SOURCE | test.py:136 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:138 | SOURCE | test.py:138 | Taint simple.test | SOURCE |
| test.py:140 | ArgumentRefinement(t_2) | test.py:138 | Taint simple.test | SOURCE |
| test.py:142 | ArgumentRefinement(t_0) | test.py:136 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:146 | CUSTOM_SOURCE | test.py:146 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:148 | SOURCE | test.py:148 | Taint simple.test | SOURCE |
| test.py:149 | TAINT_FROM_ARG() | test.py:149 | Taint basic.custom | TAINT_FROM_ARG() |
| test.py:151 | ArgumentRefinement(t_1) | test.py:149 | Taint basic.custom | TAINT_FROM_ARG() |
| test.py:155 | ImportMember | test.py:155 | Taint simple.test | ImportMember |
| test.py:156 | ArgumentRefinement(unsafe_0) | test.py:155 | Taint simple.test | ImportMember |
| test.py:159 | with | test.py:159 | Taint simple.test | SOURCE |
| test.py:160 | ArgumentRefinement(t_0) | test.py:159 | Taint simple.test | SOURCE |
| test.py:163 | SOURCE | test.py:163 | Taint simple.test | SOURCE |
| test.py:168 | List | test.py:168 | Taint [simple.test] | List |
| test.py:169 | Dict | test.py:169 | Taint {simple.test} | Dict |
| test.py:170 | ArgumentRefinement(l_0) | test.py:168 | Taint [simple.test] | List |
| test.py:171 | ArgumentRefinement(d_0) | test.py:169 | Taint {simple.test} | Dict |
| test.py:174 | ArgumentRefinement(l_1) | test.py:168 | Taint [simple.test] | List |
| test.py:174 | list() | test.py:174 | Taint [simple.test] | list() |
| test.py:175 | ArgumentRefinement(d_1) | test.py:169 | Taint {simple.test} | Dict |
| test.py:175 | dict() | test.py:175 | Taint {simple.test} | dict() |
| test.py:178 | SOURCE | test.py:178 | Taint simple.test | SOURCE |
| test.py:180 | ArgumentRefinement(t_1) | test.py:178 | Taint simple.test | SOURCE |
| test.py:180 | Pi(t_0) [true] | test.py:178 | Taint simple.test | SOURCE |
| test.py:183 | SingleSuccessorGuard(t_2) [false] | test.py:178 | Taint simple.test | SOURCE |
| test.py:186 | ArgumentRefinement(t_3) | test.py:178 | Taint simple.test | SOURCE |
| test.py:189 | FALSEY | test.py:189 | Taint falsey | FALSEY |
| test.py:191 | Pi(t_0) [true] | test.py:189 | Taint falsey | FALSEY |
| test.py:194 | phi(t_2, t_4) | test.py:195 | Taint simple.test | SOURCE |
| test.py:195 | SOURCE | test.py:195 | Taint simple.test | SOURCE |
| test.py:197 | ArgumentRefinement(t_1) | test.py:195 | Taint simple.test | SOURCE |
| test.py:197 | Pi(t_0) [true] | test.py:195 | Taint simple.test | SOURCE |
| test.py:199 | ArgumentRefinement(t_3) | test.py:195 | Taint simple.test | SOURCE |
| test.py:199 | Pi(t_0) [false] | test.py:195 | Taint simple.test | SOURCE |
| test.py:202 | ITERABLE_SOURCE | test.py:202 | Taint iterable.simple | ITERABLE_SOURCE |
| test.py:203 | For | test.py:203 | Taint simple.test | For |
| test.py:203 | phi(i_0, i_2) | test.py:203 | Taint simple.test | For |
| test.py:208 | List | test.py:208 | Taint [simple.test] | List |
| test.py:209 | For | test.py:209 | Taint simple.test | For |
| test.py:209 | phi(i_0, i_2) | test.py:209 | Taint simple.test | For |
| test.py:213 | For | test.py:213 | Taint simple.test | For |
| test.py:213 | phi(x_2, x_3) | test.py:213 | Taint simple.test | For |
| test.py:214 | ArgumentRefinement(x_1) | test.py:213 | Taint simple.test | For |
| test.py:76 | SOURCE | test.py:76 | Taint simple.test | t |
| test.py:77 | hub() | test.py:77 | Taint simple.test | t |
| test.py:85 | ImportExpr | test.py:85 | Taint .dangerous = simple.test | module |
| test.py:87 | ScopeEntryDefinition | test.py:87 | Taint .dangerous = simple.test | Function test13 |
| test.py:88 | Attribute | test.py:88 | Taint simple.test | t |
| test.py:91 | ScopeEntryDefinition | test.py:91 | Taint .dangerous = simple.test | Function test14 |
| test.py:95 | ScopeEntryDefinition | test.py:95 | Taint .dangerous = simple.test | Function test15 |
| test.py:99 | ScopeEntryDefinition | test.py:99 | Taint .dangerous = simple.test | Function test16 |
| test.py:100 | Attribute() | test.py:100 | Taint simple.test | t |
| test.py:105 | ParameterDefinition | test.py:105 | Taint .x = simple.test | arg |
| test.py:108 | ScopeEntryDefinition | test.py:108 | Taint .dangerous = simple.test | Function test17 |
| test.py:113 | ScopeEntryDefinition | test.py:113 | Taint .dangerous = simple.test | Function test18 |
| test.py:116 | hub() | test.py:116 | Taint .x = simple.test | t |
| test.py:120 | CUSTOM_SOURCE | test.py:120 | Taint basic.custom | t |
| test.py:121 | hub() | test.py:121 | Taint basic.custom | t |
| test.py:126 | CUSTOM_SOURCE | test.py:126 | Taint basic.custom | t |
| test.py:128 | SOURCE | test.py:128 | Taint simple.test | t |
| test.py:136 | CUSTOM_SOURCE | test.py:136 | Taint basic.custom | t |
| test.py:138 | SOURCE | test.py:138 | Taint simple.test | t |
| test.py:146 | CUSTOM_SOURCE | test.py:146 | Taint basic.custom | t |
| test.py:148 | SOURCE | test.py:148 | Taint simple.test | t |
| test.py:149 | TAINT_FROM_ARG() | test.py:149 | Taint basic.custom | t |
| test.py:155 | ImportMember | test.py:155 | Taint simple.test | unsafe |
| test.py:159 | with | test.py:159 | Taint simple.test | t |
| test.py:163 | SOURCE | test.py:163 | Taint simple.test | s |
| test.py:168 | List | test.py:168 | Taint sequence of simple.test | l |
| test.py:169 | Dict | test.py:169 | Taint dict of simple.test | d |
| test.py:174 | list() | test.py:174 | Taint sequence of simple.test | l2 |
| test.py:175 | dict() | test.py:175 | Taint dict of simple.test | d2 |
| test.py:178 | SOURCE | test.py:178 | Taint simple.test | t |
| test.py:189 | FALSEY | test.py:189 | Taint falsey | t |
| test.py:195 | SOURCE | test.py:195 | Taint simple.test | t |
| test.py:202 | ITERABLE_SOURCE | test.py:202 | Taint iterable.simple | t |
| test.py:203 | For | test.py:203 | Taint simple.test | i |
| test.py:208 | List | test.py:208 | Taint sequence of simple.test | seq |
| test.py:209 | For | test.py:209 | Taint simple.test | i |
| test.py:213 | For | test.py:213 | Taint simple.test | x |

6
python/ql/test/library-tests/taint/general/TestDefn.ql
View File

@@ -3,7 +3,7 @@ import semmle.python.security.TaintTest
import TaintLib
from EssaDefinition defn, TaintedNode n
where TaintFlowTest::tainted_def(defn, _, n)
from EssaNodeDefinition defn, TaintedNode n
where n.getNode().asVariable() = defn.getVariable()
select
defn.getLocation().toString(), defn.getRepresentation(), n.getLocation().toString(), n.getTrackedValue(), n.getNode().getNode().toString()
defn.getLocation().toString(), defn.getRepresentation(), n.getLocation().toString(), "Taint " + n.toString(), defn.getDefiningNode().getNode().toString()

246
python/ql/test/library-tests/taint/general/TestNode.expected
View File

@@ -1,246 +0,0 @@
| Attribute 'attr' taint explicit.carrier | carrier.py:5 | self | carrier.py:33 |
| Attribute 'attr' taint explicit.carrier | carrier.py:33 | ImplicitCarrier() | |
| Attribute 'attr' taint explicit.carrier | carrier.py:34 | c | |
| Attribute 'attr' taint simple.test | carrier.py:5 | self | carrier.py:17 |
| Attribute 'attr' taint simple.test | carrier.py:5 | self | carrier.py:25 |
| Attribute 'attr' taint simple.test | carrier.py:13 | arg | carrier.py:25 |
| Attribute 'attr' taint simple.test | carrier.py:14 | arg | carrier.py:25 |
| Attribute 'attr' taint simple.test | carrier.py:17 | ImplicitCarrier() | |
| Attribute 'attr' taint simple.test | carrier.py:18 | c | |
| Attribute 'attr' taint simple.test | carrier.py:25 | ImplicitCarrier() | |
| Attribute 'attr' taint simple.test | carrier.py:25 | hub() | |
| Attribute 'attr' taint simple.test | carrier.py:26 | c | |
| Attribute 'dangerous' taint simple.test | test.py:85 | ImportExpr | |
| Attribute 'dangerous' taint simple.test | test.py:88 | module | |
| Attribute 'dangerous' taint simple.test | test.py:92 | module | |
| Attribute 'dangerous' taint simple.test | test.py:96 | module | |
| Attribute 'dangerous' taint simple.test | test.py:100 | module | |
| Attribute 'dangerous' taint simple.test | test.py:110 | module | |
| Attribute 'dangerous' taint simple.test | test.py:115 | module | |
| Attribute 'dangerous' taint simple.test | test.py:155 | ImportExpr | |
| Attribute 'x' taint simple.test | test.py:72 | arg | test.py:116 |
| Attribute 'x' taint simple.test | test.py:73 | arg | test.py:116 |
| Attribute 'x' taint simple.test | test.py:105 | arg | test.py:117 |
| Attribute 'x' taint simple.test | test.py:106 | arg | test.py:117 |
| Attribute 'x' taint simple.test | test.py:110 | t | |
| Attribute 'x' taint simple.test | test.py:111 | t | |
| Attribute 'x' taint simple.test | test.py:115 | t | |
| Attribute 'x' taint simple.test | test.py:116 | hub() | |
| Attribute 'x' taint simple.test | test.py:116 | t | |
| Attribute 'x' taint simple.test | test.py:117 | t | |
| Taint Command injection | sanitizer.py:3 | arg | sanitizer.py:10 |
| Taint Command injection | sanitizer.py:5 | arg | sanitizer.py:17 |
| Taint Command injection | sanitizer.py:9 | user_input() | |
| Taint Command injection | sanitizer.py:10 | x | |
| Taint Command injection | sanitizer.py:11 | x | |
| Taint Command injection | sanitizer.py:13 | x | |
| Taint Command injection | sanitizer.py:16 | user_input() | |
| Taint Command injection | sanitizer.py:17 | x | |
| Taint Command injection | sanitizer.py:20 | x | |
| Taint Command injection | sanitizer.py:24 | user_input() | |
| Taint Command injection | sanitizer.py:25 | x | |
| Taint Command injection | sanitizer.py:26 | x | |
| Taint Command injection | sanitizer.py:28 | x | |
| Taint Command injection | sanitizer.py:31 | user_input() | |
| Taint Command injection | sanitizer.py:32 | x | |
| Taint Command injection | sanitizer.py:33 | x | |
| Taint Command injection | sanitizer.py:35 | x | |
| Taint SQL injection | sanitizer.py:3 | arg | sanitizer.py:10 |
| Taint SQL injection | sanitizer.py:5 | arg | sanitizer.py:17 |
| Taint SQL injection | sanitizer.py:9 | user_input() | |
| Taint SQL injection | sanitizer.py:10 | x | |
| Taint SQL injection | sanitizer.py:13 | x | |
| Taint SQL injection | sanitizer.py:16 | user_input() | |
| Taint SQL injection | sanitizer.py:17 | x | |
| Taint SQL injection | sanitizer.py:18 | x | |
| Taint SQL injection | sanitizer.py:20 | x | |
| Taint SQL injection | sanitizer.py:24 | user_input() | |
| Taint SQL injection | sanitizer.py:25 | x | |
| Taint SQL injection | sanitizer.py:26 | x | |
| Taint SQL injection | sanitizer.py:28 | x | |
| Taint SQL injection | sanitizer.py:31 | user_input() | |
| Taint SQL injection | sanitizer.py:32 | x | |
| Taint SQL injection | sanitizer.py:33 | x | |
| Taint SQL injection | sanitizer.py:35 | x | |
| Taint [simple.test] | test.py:168 | List | |
| Taint [simple.test] | test.py:170 | l | |
| Taint [simple.test] | test.py:172 | x | |
| Taint [simple.test] | test.py:174 | l | |
| Taint [simple.test] | test.py:174 | list() | |
| Taint [simple.test] | test.py:208 | List | |
| Taint [simple.test] | test.py:209 | seq | |
| Taint [simple.test] | test.py:213 | flow_in_generator() | |
| Taint basic.custom | test.py:72 | arg | test.py:121 |
| Taint basic.custom | test.py:73 | arg | test.py:121 |
| Taint basic.custom | test.py:120 | CUSTOM_SOURCE | |
| Taint basic.custom | test.py:121 | TAINT_FROM_ARG() | |
| Taint basic.custom | test.py:121 | hub() | |
| Taint basic.custom | test.py:121 | t | |
| Taint basic.custom | test.py:122 | t | |
| Taint basic.custom | test.py:126 | CUSTOM_SOURCE | |
| Taint basic.custom | test.py:130 | t | |
| Taint basic.custom | test.py:136 | CUSTOM_SOURCE | |
| Taint basic.custom | test.py:142 | t | |
| Taint basic.custom | test.py:146 | CUSTOM_SOURCE | |
| Taint basic.custom | test.py:149 | TAINT_FROM_ARG() | |
| Taint basic.custom | test.py:149 | t | |
| Taint basic.custom | test.py:151 | t | |
| Taint explicit.carrier | carrier.py:4 | arg | carrier.py:33 |
| Taint explicit.carrier | carrier.py:5 | arg | carrier.py:33 |
| Taint explicit.carrier | carrier.py:13 | arg | carrier.py:29 |
| Taint explicit.carrier | carrier.py:14 | arg | carrier.py:29 |
| Taint explicit.carrier | carrier.py:21 | TAINT_CARRIER_SOURCE | |
| Taint explicit.carrier | carrier.py:22 | c | |
| Taint explicit.carrier | carrier.py:29 | TAINT_CARRIER_SOURCE | |
| Taint explicit.carrier | carrier.py:29 | hub() | |
| Taint explicit.carrier | carrier.py:30 | c | |
| Taint explicit.carrier | carrier.py:33 | TAINT_CARRIER_SOURCE | |
| Taint explicit.carrier | carrier.py:34 | Attribute | |
| Taint explicit.carrier | carrier.py:35 | x | |
| Taint falsey | test.py:189 | FALSEY | |
| Taint falsey | test.py:190 | t | |
| Taint iterable.simple | test.py:202 | ITERABLE_SOURCE | |
| Taint iterable.simple | test.py:203 | t | |
| Taint paper | rockpaperscissors.py:6 | arg | rockpaperscissors.py:32 |
| Taint paper | rockpaperscissors.py:9 | arg | rockpaperscissors.py:26 |
| Taint paper | rockpaperscissors.py:25 | Attribute() | |
| Taint paper | rockpaperscissors.py:26 | y | |
| Taint paper | rockpaperscissors.py:30 | Attribute() | |
| Taint paper | rockpaperscissors.py:32 | y | |
| Taint rock | rockpaperscissors.py:6 | arg | rockpaperscissors.py:16 |
| Taint rock | rockpaperscissors.py:16 | ROCK | |
| Taint rock | rockpaperscissors.py:19 | ROCK | |
| Taint rock | rockpaperscissors.py:20 | x | |
| Taint rock | rockpaperscissors.py:24 | ROCK | |
| Taint rock | rockpaperscissors.py:25 | x | |
| Taint scissors | rockpaperscissors.py:3 | arg | rockpaperscissors.py:13 |
| Taint scissors | rockpaperscissors.py:6 | arg | rockpaperscissors.py:31 |
| Taint scissors | rockpaperscissors.py:9 | arg | rockpaperscissors.py:21 |
| Taint scissors | rockpaperscissors.py:13 | SCISSORS | |
| Taint scissors | rockpaperscissors.py:20 | Attribute() | |
| Taint scissors | rockpaperscissors.py:21 | y | |
| Taint scissors | rockpaperscissors.py:25 | Attribute() | |
| Taint scissors | rockpaperscissors.py:29 | SCISSORS | |
| Taint scissors | rockpaperscissors.py:30 | x | |
| Taint scissors | rockpaperscissors.py:31 | x | |
| Taint simple.test | carrier.py:4 | arg | carrier.py:17 |
| Taint simple.test | carrier.py:4 | arg | carrier.py:25 |
| Taint simple.test | carrier.py:5 | arg | carrier.py:17 |
| Taint simple.test | carrier.py:5 | arg | carrier.py:25 |
| Taint simple.test | carrier.py:17 | SOURCE | |
| Taint simple.test | carrier.py:18 | Attribute | |
| Taint simple.test | carrier.py:22 | Attribute() | |
| Taint simple.test | carrier.py:25 | SOURCE | |
| Taint simple.test | carrier.py:30 | Attribute() | |
| Taint simple.test | carrier.py:35 | Attribute() | |
| Taint simple.test | deep.py:2 | arg | deep.py:6 from deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:3 | arg | deep.py:6 from deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:5 | arg | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:6 | arg | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:6 | f1() | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:8 | arg | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:9 | arg | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:9 | f2() | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:11 | arg | deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:12 | arg | deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:12 | f3() | deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:14 | arg | deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:15 | arg | deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:15 | f4() | deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:17 | arg | deep.py:20 |
| Taint simple.test | deep.py:18 | arg | deep.py:20 |
| Taint simple.test | deep.py:18 | f5() | deep.py:20 |
| Taint simple.test | deep.py:20 | SOURCE | |
| Taint simple.test | deep.py:20 | f6() | |
| Taint simple.test | deep.py:22 | x | |
| Taint simple.test | module.py:3 | SOURCE | |
| Taint simple.test | module.py:7 | SOURCE | |
| Taint simple.test | module.py:10 | SOURCE | |
| Taint simple.test | test.py:3 | SOURCE | |
| Taint simple.test | test.py:6 | SOURCE | |
| Taint simple.test | test.py:7 | s | |
| Taint simple.test | test.py:10 | SOURCE | |
| Taint simple.test | test.py:12 | arg | test.py:21 |
| Taint simple.test | test.py:12 | arg | test.py:25 |
| Taint simple.test | test.py:12 | arg | test.py:47 from test.py:55 |
| Taint simple.test | test.py:12 | arg | test.py:51 from test.py:63 |
| Taint simple.test | test.py:12 | arg | test.py:51 from test.py:70 |
| Taint simple.test | test.py:13 | arg | test.py:21 |
| Taint simple.test | test.py:13 | arg | test.py:25 |
| Taint simple.test | test.py:13 | arg | test.py:47 from test.py:55 |
| Taint simple.test | test.py:13 | arg | test.py:51 from test.py:63 |
| Taint simple.test | test.py:13 | arg | test.py:51 from test.py:70 |
| Taint simple.test | test.py:16 | source() | |
| Taint simple.test | test.py:17 | t | |
| Taint simple.test | test.py:20 | SOURCE | |
| Taint simple.test | test.py:21 | t | |
| Taint simple.test | test.py:24 | source() | |
| Taint simple.test | test.py:25 | t | |
| Taint simple.test | test.py:31 | SOURCE | |
| Taint simple.test | test.py:37 | SOURCE | |
| Taint simple.test | test.py:41 | t | |
| Taint simple.test | test.py:44 | source() | |
| Taint simple.test | test.py:46 | arg | test.py:55 |
| Taint simple.test | test.py:47 | arg | test.py:55 |
| Taint simple.test | test.py:49 | arg | test.py:63 |
| Taint simple.test | test.py:49 | arg | test.py:70 |
| Taint simple.test | test.py:51 | arg | test.py:63 |
| Taint simple.test | test.py:51 | arg | test.py:70 |
| Taint simple.test | test.py:54 | source2() | |
| Taint simple.test | test.py:55 | t | |
| Taint simple.test | test.py:62 | SOURCE | |
| Taint simple.test | test.py:63 | t | |
| Taint simple.test | test.py:67 | SOURCE | |
| Taint simple.test | test.py:70 | t | |
| Taint simple.test | test.py:72 | arg | test.py:77 |
| Taint simple.test | test.py:73 | arg | test.py:77 |
| Taint simple.test | test.py:76 | SOURCE | |
| Taint simple.test | test.py:77 | hub() | |
| Taint simple.test | test.py:77 | t | |
| Taint simple.test | test.py:78 | t | |
| Taint simple.test | test.py:88 | Attribute | |
| Taint simple.test | test.py:89 | t | |
| Taint simple.test | test.py:100 | Attribute() | |
| Taint simple.test | test.py:101 | t | |
| Taint simple.test | test.py:106 | Attribute | test.py:117 |
| Taint simple.test | test.py:110 | Attribute | |
| Taint simple.test | test.py:111 | Attribute | |
| Taint simple.test | test.py:115 | Attribute | |
| Taint simple.test | test.py:128 | SOURCE | |
| Taint simple.test | test.py:132 | t | |
| Taint simple.test | test.py:138 | SOURCE | |
| Taint simple.test | test.py:140 | t | |
| Taint simple.test | test.py:148 | SOURCE | |
| Taint simple.test | test.py:149 | t | |
| Taint simple.test | test.py:155 | ImportMember | |
| Taint simple.test | test.py:156 | unsafe | |
| Taint simple.test | test.py:159 | SOURCE | |
| Taint simple.test | test.py:160 | t | |
| Taint simple.test | test.py:163 | SOURCE | |
| Taint simple.test | test.py:164 | s | |
| Taint simple.test | test.py:168 | SOURCE | |
| Taint simple.test | test.py:169 | SOURCE | |
| Taint simple.test | test.py:172 | Subscript | |
| Taint simple.test | test.py:173 | Subscript | |
| Taint simple.test | test.py:178 | SOURCE | |
| Taint simple.test | test.py:179 | t | |
| Taint simple.test | test.py:180 | t | |
| Taint simple.test | test.py:183 | t | |
| Taint simple.test | test.py:186 | t | |
| Taint simple.test | test.py:195 | SOURCE | |
| Taint simple.test | test.py:196 | t | |
| Taint simple.test | test.py:197 | t | |
| Taint simple.test | test.py:199 | t | |
| Taint simple.test | test.py:203 | For | |
| Taint simple.test | test.py:204 | i | |
| Taint simple.test | test.py:205 | i | |
| Taint simple.test | test.py:208 | SOURCE | |
| Taint simple.test | test.py:209 | For | |
| Taint simple.test | test.py:210 | i | |
| Taint simple.test | test.py:213 | For | |
| Taint simple.test | test.py:214 | x | |
| Taint {simple.test} | test.py:169 | Dict | |
| Taint {simple.test} | test.py:171 | d | |
| Taint {simple.test} | test.py:173 | y | |
| Taint {simple.test} | test.py:175 | d | |
| Taint {simple.test} | test.py:175 | dict() | |

8
python/ql/test/library-tests/taint/general/TestNode.ql
View File

@@ -1,8 +0,0 @@
import python
import semmle.python.security.TaintTracking
import TaintLib
from TaintedNode n
select n.getTrackedValue(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext()

1
python/ql/test/library-tests/taint/general/TestSink.expected
View File

@@ -14,6 +14,7 @@
| rock | rockpaperscissors.py:24 | 26 | y | paper |
| scissors | rockpaperscissors.py:13 | 13 | SCISSORS | scissors |
| simple.test | carrier.py:17 | 18 | Attribute | simple.test |
| simple.test | carrier.py:25 | 26 | Attribute() | simple.test |
| simple.test | module.py:3 | 89 | t | simple.test |
| simple.test | module.py:3 | 106 | Attribute | simple.test |
| simple.test | module.py:3 | 111 | Attribute | simple.test |

400
python/ql/test/library-tests/taint/general/TestStep.expected
View File

@@ -1,199 +1,201 @@
| Attribute 'attr' taint explicit.carrier | carrier.py:5 | self | carrier.py:33 | --> | Attribute 'attr' taint explicit.carrier | carrier.py:33 | ImplicitCarrier() | |
| Attribute 'attr' taint explicit.carrier | carrier.py:33 | ImplicitCarrier() | | --> | Attribute 'attr' taint explicit.carrier | carrier.py:34 | c | |
| Attribute 'attr' taint explicit.carrier | carrier.py:34 | c | | --> | Taint explicit.carrier | carrier.py:34 | Attribute | |
| Attribute 'attr' taint simple.test | carrier.py:5 | self | carrier.py:17 | --> | Attribute 'attr' taint simple.test | carrier.py:17 | ImplicitCarrier() | |
| Attribute 'attr' taint simple.test | carrier.py:5 | self | carrier.py:25 | --> | Attribute 'attr' taint simple.test | carrier.py:25 | ImplicitCarrier() | |
| Attribute 'attr' taint simple.test | carrier.py:13 | arg | carrier.py:25 | --> | Attribute 'attr' taint simple.test | carrier.py:14 | arg | carrier.py:25 |
| Attribute 'attr' taint simple.test | carrier.py:14 | arg | carrier.py:25 | --> | Attribute 'attr' taint simple.test | carrier.py:25 | hub() | |
| Attribute 'attr' taint simple.test | carrier.py:17 | ImplicitCarrier() | | --> | Attribute 'attr' taint simple.test | carrier.py:18 | c | |
| Attribute 'attr' taint simple.test | carrier.py:18 | c | | --> | Taint simple.test | carrier.py:18 | Attribute | |
| Attribute 'attr' taint simple.test | carrier.py:25 | ImplicitCarrier() | | --> | Attribute 'attr' taint simple.test | carrier.py:13 | arg | carrier.py:25 |
| Attribute 'attr' taint simple.test | carrier.py:25 | hub() | | --> | Attribute 'attr' taint simple.test | carrier.py:26 | c | |
| Attribute 'dangerous' taint simple.test | test.py:85 | ImportExpr | | --> | Attribute 'dangerous' taint simple.test | test.py:88 | module | |
| Attribute 'dangerous' taint simple.test | test.py:85 | ImportExpr | | --> | Attribute 'dangerous' taint simple.test | test.py:92 | module | |
| Attribute 'dangerous' taint simple.test | test.py:85 | ImportExpr | | --> | Attribute 'dangerous' taint simple.test | test.py:96 | module | |
| Attribute 'dangerous' taint simple.test | test.py:85 | ImportExpr | | --> | Attribute 'dangerous' taint simple.test | test.py:100 | module | |
| Attribute 'dangerous' taint simple.test | test.py:85 | ImportExpr | | --> | Attribute 'dangerous' taint simple.test | test.py:110 | module | |
| Attribute 'dangerous' taint simple.test | test.py:85 | ImportExpr | | --> | Attribute 'dangerous' taint simple.test | test.py:115 | module | |
| Attribute 'dangerous' taint simple.test | test.py:88 | module | | --> | Taint simple.test | test.py:88 | Attribute | |
| Attribute 'dangerous' taint simple.test | test.py:110 | module | | --> | Taint simple.test | test.py:110 | Attribute | |
| Attribute 'dangerous' taint simple.test | test.py:115 | module | | --> | Taint simple.test | test.py:115 | Attribute | |
| Attribute 'x' taint simple.test | test.py:72 | arg | test.py:116 | --> | Attribute 'x' taint simple.test | test.py:73 | arg | test.py:116 |
| Attribute 'x' taint simple.test | test.py:73 | arg | test.py:116 | --> | Attribute 'x' taint simple.test | test.py:116 | hub() | |
| Attribute 'x' taint simple.test | test.py:105 | arg | test.py:117 | --> | Attribute 'x' taint simple.test | test.py:106 | arg | test.py:117 |
| Attribute 'x' taint simple.test | test.py:106 | arg | test.py:117 | --> | Taint simple.test | test.py:106 | Attribute | test.py:117 |
| Attribute 'x' taint simple.test | test.py:110 | t | | --> | Attribute 'x' taint simple.test | test.py:111 | t | |
| Attribute 'x' taint simple.test | test.py:111 | t | | --> | Taint simple.test | test.py:111 | Attribute | |
| Attribute 'x' taint simple.test | test.py:115 | t | | --> | Attribute 'x' taint simple.test | test.py:116 | t | |
| Attribute 'x' taint simple.test | test.py:116 | hub() | | --> | Attribute 'x' taint simple.test | test.py:117 | t | |
| Attribute 'x' taint simple.test | test.py:116 | t | | --> | Attribute 'x' taint simple.test | test.py:72 | arg | test.py:116 |
| Attribute 'x' taint simple.test | test.py:117 | t | | --> | Attribute 'x' taint simple.test | test.py:105 | arg | test.py:117 |
| Taint Command injection | sanitizer.py:9 | user_input() | | --> | Taint Command injection | sanitizer.py:10 | x | |
| Taint Command injection | sanitizer.py:9 | user_input() | | --> | Taint Command injection | sanitizer.py:11 | x | |
| Taint Command injection | sanitizer.py:9 | user_input() | | --> | Taint Command injection | sanitizer.py:13 | x | |
| Taint Command injection | sanitizer.py:10 | x | | --> | Taint Command injection | sanitizer.py:3 | arg | sanitizer.py:10 |
| Taint Command injection | sanitizer.py:16 | user_input() | | --> | Taint Command injection | sanitizer.py:17 | x | |
| Taint Command injection | sanitizer.py:16 | user_input() | | --> | Taint Command injection | sanitizer.py:20 | x | |
| Taint Command injection | sanitizer.py:17 | x | | --> | Taint Command injection | sanitizer.py:5 | arg | sanitizer.py:17 |
| Taint Command injection | sanitizer.py:24 | user_input() | | --> | Taint Command injection | sanitizer.py:25 | x | |
| Taint Command injection | sanitizer.py:24 | user_input() | | --> | Taint Command injection | sanitizer.py:26 | x | |
| Taint Command injection | sanitizer.py:24 | user_input() | | --> | Taint Command injection | sanitizer.py:28 | x | |
| Taint Command injection | sanitizer.py:31 | user_input() | | --> | Taint Command injection | sanitizer.py:32 | x | |
| Taint Command injection | sanitizer.py:31 | user_input() | | --> | Taint Command injection | sanitizer.py:33 | x | |
| Taint Command injection | sanitizer.py:31 | user_input() | | --> | Taint Command injection | sanitizer.py:35 | x | |
| Taint SQL injection | sanitizer.py:9 | user_input() | | --> | Taint SQL injection | sanitizer.py:10 | x | |
| Taint SQL injection | sanitizer.py:9 | user_input() | | --> | Taint SQL injection | sanitizer.py:13 | x | |
| Taint SQL injection | sanitizer.py:10 | x | | --> | Taint SQL injection | sanitizer.py:3 | arg | sanitizer.py:10 |
| Taint SQL injection | sanitizer.py:16 | user_input() | | --> | Taint SQL injection | sanitizer.py:17 | x | |
| Taint SQL injection | sanitizer.py:16 | user_input() | | --> | Taint SQL injection | sanitizer.py:18 | x | |
| Taint SQL injection | sanitizer.py:16 | user_input() | | --> | Taint SQL injection | sanitizer.py:20 | x | |
| Taint SQL injection | sanitizer.py:17 | x | | --> | Taint SQL injection | sanitizer.py:5 | arg | sanitizer.py:17 |
| Taint SQL injection | sanitizer.py:24 | user_input() | | --> | Taint SQL injection | sanitizer.py:25 | x | |
| Taint SQL injection | sanitizer.py:24 | user_input() | | --> | Taint SQL injection | sanitizer.py:26 | x | |
| Taint SQL injection | sanitizer.py:24 | user_input() | | --> | Taint SQL injection | sanitizer.py:28 | x | |
| Taint SQL injection | sanitizer.py:31 | user_input() | | --> | Taint SQL injection | sanitizer.py:32 | x | |
| Taint SQL injection | sanitizer.py:31 | user_input() | | --> | Taint SQL injection | sanitizer.py:33 | x | |
| Taint SQL injection | sanitizer.py:31 | user_input() | | --> | Taint SQL injection | sanitizer.py:35 | x | |
| Taint [simple.test] | test.py:168 | List | | --> | Taint [simple.test] | test.py:170 | l | |
| Taint [simple.test] | test.py:168 | List | | --> | Taint [simple.test] | test.py:174 | l | |
| Taint [simple.test] | test.py:170 | l | | --> | Taint [simple.test] | test.py:172 | x | |
| Taint [simple.test] | test.py:172 | x | | --> | Taint simple.test | test.py:172 | Subscript | |
| Taint [simple.test] | test.py:174 | l | | --> | Taint [simple.test] | test.py:174 | list() | |
| Taint [simple.test] | test.py:208 | List | | --> | Taint [simple.test] | test.py:209 | seq | |
| Taint [simple.test] | test.py:209 | seq | | --> | Taint simple.test | test.py:209 | For | |
| Taint [simple.test] | test.py:213 | flow_in_generator() | | --> | Taint simple.test | test.py:213 | For | |
| Taint basic.custom | test.py:72 | arg | test.py:121 | --> | Taint basic.custom | test.py:73 | arg | test.py:121 |
| Taint basic.custom | test.py:73 | arg | test.py:121 | --> | Taint basic.custom | test.py:121 | hub() | |
| Taint basic.custom | test.py:120 | CUSTOM_SOURCE | | --> | Taint basic.custom | test.py:121 | t | |
| Taint basic.custom | test.py:121 | TAINT_FROM_ARG() | | --> | Taint basic.custom | test.py:72 | arg | test.py:121 |
| Taint basic.custom | test.py:121 | hub() | | --> | Taint basic.custom | test.py:122 | t | |
| Taint basic.custom | test.py:121 | t | | --> | Taint basic.custom | test.py:121 | TAINT_FROM_ARG() | |
| Taint basic.custom | test.py:126 | CUSTOM_SOURCE | | --> | Taint basic.custom | test.py:130 | t | |
| Taint basic.custom | test.py:136 | CUSTOM_SOURCE | | --> | Taint basic.custom | test.py:142 | t | |
| Taint basic.custom | test.py:146 | CUSTOM_SOURCE | | --> | Taint basic.custom | test.py:149 | t | |
| Taint basic.custom | test.py:149 | TAINT_FROM_ARG() | | --> | Taint basic.custom | test.py:151 | t | |
| Taint basic.custom | test.py:149 | t | | --> | Taint basic.custom | test.py:149 | TAINT_FROM_ARG() | |
| Taint explicit.carrier | carrier.py:4 | arg | carrier.py:33 | --> | Taint explicit.carrier | carrier.py:5 | arg | carrier.py:33 |
| Taint explicit.carrier | carrier.py:5 | arg | carrier.py:33 | --> | Attribute 'attr' taint explicit.carrier | carrier.py:5 | self | carrier.py:33 |
| Taint explicit.carrier | carrier.py:13 | arg | carrier.py:29 | --> | Taint explicit.carrier | carrier.py:14 | arg | carrier.py:29 |
| Taint explicit.carrier | carrier.py:14 | arg | carrier.py:29 | --> | Taint explicit.carrier | carrier.py:29 | hub() | |
| Taint explicit.carrier | carrier.py:21 | TAINT_CARRIER_SOURCE | | --> | Taint explicit.carrier | carrier.py:22 | c | |
| Taint explicit.carrier | carrier.py:22 | c | | --> | Taint simple.test | carrier.py:22 | Attribute() | |
| Taint explicit.carrier | carrier.py:29 | TAINT_CARRIER_SOURCE | | --> | Taint explicit.carrier | carrier.py:13 | arg | carrier.py:29 |
| Taint explicit.carrier | carrier.py:29 | hub() | | --> | Taint explicit.carrier | carrier.py:30 | c | |
| Taint explicit.carrier | carrier.py:30 | c | | --> | Taint simple.test | carrier.py:30 | Attribute() | |
| Taint explicit.carrier | carrier.py:33 | TAINT_CARRIER_SOURCE | | --> | Taint explicit.carrier | carrier.py:4 | arg | carrier.py:33 |
| Taint explicit.carrier | carrier.py:34 | Attribute | | --> | Taint explicit.carrier | carrier.py:35 | x | |
| Taint explicit.carrier | carrier.py:35 | x | | --> | Taint simple.test | carrier.py:35 | Attribute() | |
| Taint falsey | test.py:189 | FALSEY | | --> | Taint falsey | test.py:190 | t | |
| Taint iterable.simple | test.py:202 | ITERABLE_SOURCE | | --> | Taint iterable.simple | test.py:203 | t | |
| Taint iterable.simple | test.py:203 | t | | --> | Taint simple.test | test.py:203 | For | |
| Taint paper | rockpaperscissors.py:25 | Attribute() | | --> | Taint paper | rockpaperscissors.py:26 | y | |
| Taint paper | rockpaperscissors.py:26 | y | | --> | Taint paper | rockpaperscissors.py:9 | arg | rockpaperscissors.py:26 |
| Taint paper | rockpaperscissors.py:30 | Attribute() | | --> | Taint paper | rockpaperscissors.py:32 | y | |
| Taint paper | rockpaperscissors.py:32 | y | | --> | Taint paper | rockpaperscissors.py:6 | arg | rockpaperscissors.py:32 |
| Taint rock | rockpaperscissors.py:16 | ROCK | | --> | Taint rock | rockpaperscissors.py:6 | arg | rockpaperscissors.py:16 |
| Taint rock | rockpaperscissors.py:19 | ROCK | | --> | Taint rock | rockpaperscissors.py:20 | x | |
| Taint rock | rockpaperscissors.py:20 | x | | --> | Taint scissors | rockpaperscissors.py:20 | Attribute() | |
| Taint rock | rockpaperscissors.py:24 | ROCK | | --> | Taint rock | rockpaperscissors.py:25 | x | |
| Taint rock | rockpaperscissors.py:25 | x | | --> | Taint scissors | rockpaperscissors.py:25 | Attribute() | |
| Taint scissors | rockpaperscissors.py:13 | SCISSORS | | --> | Taint scissors | rockpaperscissors.py:3 | arg | rockpaperscissors.py:13 |
| Taint scissors | rockpaperscissors.py:20 | Attribute() | | --> | Taint scissors | rockpaperscissors.py:21 | y | |
| Taint scissors | rockpaperscissors.py:21 | y | | --> | Taint scissors | rockpaperscissors.py:9 | arg | rockpaperscissors.py:21 |
| Taint scissors | rockpaperscissors.py:25 | Attribute() | | --> | Taint paper | rockpaperscissors.py:25 | Attribute() | |
| Taint scissors | rockpaperscissors.py:29 | SCISSORS | | --> | Taint scissors | rockpaperscissors.py:30 | x | |
| Taint scissors | rockpaperscissors.py:29 | SCISSORS | | --> | Taint scissors | rockpaperscissors.py:31 | x | |
| Taint scissors | rockpaperscissors.py:30 | x | | --> | Taint paper | rockpaperscissors.py:30 | Attribute() | |
| Taint scissors | rockpaperscissors.py:31 | x | | --> | Taint scissors | rockpaperscissors.py:6 | arg | rockpaperscissors.py:31 |
| Taint simple.test | carrier.py:4 | arg | carrier.py:17 | --> | Taint simple.test | carrier.py:5 | arg | carrier.py:17 |
| Taint simple.test | carrier.py:4 | arg | carrier.py:25 | --> | Taint simple.test | carrier.py:5 | arg | carrier.py:25 |
| Taint simple.test | carrier.py:5 | arg | carrier.py:17 | --> | Attribute 'attr' taint simple.test | carrier.py:5 | self | carrier.py:17 |
| Taint simple.test | carrier.py:5 | arg | carrier.py:25 | --> | Attribute 'attr' taint simple.test | carrier.py:5 | self | carrier.py:25 |
| Taint simple.test | carrier.py:17 | SOURCE | | --> | Taint simple.test | carrier.py:4 | arg | carrier.py:17 |
| Taint simple.test | carrier.py:25 | SOURCE | | --> | Taint simple.test | carrier.py:4 | arg | carrier.py:25 |
| Taint simple.test | deep.py:2 | arg | deep.py:6 from deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:3 | arg | deep.py:6 from deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:3 | arg | deep.py:6 from deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:6 | f1() | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:5 | arg | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:6 | arg | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:6 | arg | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:2 | arg | deep.py:6 from deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:6 | f1() | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:9 | f2() | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:8 | arg | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:9 | arg | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:9 | arg | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:5 | arg | deep.py:9 from deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:9 | f2() | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:12 | f3() | deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:11 | arg | deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:12 | arg | deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:12 | arg | deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:8 | arg | deep.py:12 from deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:12 | f3() | deep.py:15 from deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:15 | f4() | deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:14 | arg | deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:15 | arg | deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:15 | arg | deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:11 | arg | deep.py:15 from deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:15 | f4() | deep.py:18 from deep.py:20 | --> | Taint simple.test | deep.py:18 | f5() | deep.py:20 |
| Taint simple.test | deep.py:17 | arg | deep.py:20 | --> | Taint simple.test | deep.py:18 | arg | deep.py:20 |
| Taint simple.test | deep.py:18 | arg | deep.py:20 | --> | Taint simple.test | deep.py:14 | arg | deep.py:18 from deep.py:20 |
| Taint simple.test | deep.py:18 | f5() | deep.py:20 | --> | Taint simple.test | deep.py:20 | f6() | |
| Taint simple.test | deep.py:20 | SOURCE | | --> | Taint simple.test | deep.py:17 | arg | deep.py:20 |
| Taint simple.test | deep.py:20 | f6() | | --> | Taint simple.test | deep.py:22 | x | |
| Taint simple.test | module.py:3 | SOURCE | | --> | Attribute 'dangerous' taint simple.test | test.py:85 | ImportExpr | |
| Taint simple.test | module.py:3 | SOURCE | | --> | Attribute 'dangerous' taint simple.test | test.py:155 | ImportExpr | |
| Taint simple.test | module.py:3 | SOURCE | | --> | Taint simple.test | test.py:155 | ImportMember | |
| Taint simple.test | module.py:7 | SOURCE | | --> | Taint simple.test | test.py:100 | Attribute() | |
| Taint simple.test | test.py:6 | SOURCE | | --> | Taint simple.test | test.py:7 | s | |
| Taint simple.test | test.py:10 | SOURCE | | --> | Taint simple.test | test.py:16 | source() | |
| Taint simple.test | test.py:10 | SOURCE | | --> | Taint simple.test | test.py:24 | source() | |
| Taint simple.test | test.py:10 | SOURCE | | --> | Taint simple.test | test.py:44 | source() | |
| Taint simple.test | test.py:12 | arg | test.py:21 | --> | Taint simple.test | test.py:13 | arg | test.py:21 |
| Taint simple.test | test.py:12 | arg | test.py:25 | --> | Taint simple.test | test.py:13 | arg | test.py:25 |
| Taint simple.test | test.py:12 | arg | test.py:47 from test.py:55 | --> | Taint simple.test | test.py:13 | arg | test.py:47 from test.py:55 |
| Taint simple.test | test.py:12 | arg | test.py:51 from test.py:63 | --> | Taint simple.test | test.py:13 | arg | test.py:51 from test.py:63 |
| Taint simple.test | test.py:12 | arg | test.py:51 from test.py:70 | --> | Taint simple.test | test.py:13 | arg | test.py:51 from test.py:70 |
| Taint simple.test | test.py:16 | source() | | --> | Taint simple.test | test.py:17 | t | |
| Taint simple.test | test.py:20 | SOURCE | | --> | Taint simple.test | test.py:21 | t | |
| Taint simple.test | test.py:21 | t | | --> | Taint simple.test | test.py:12 | arg | test.py:21 |
| Taint simple.test | test.py:24 | source() | | --> | Taint simple.test | test.py:25 | t | |
| Taint simple.test | test.py:25 | t | | --> | Taint simple.test | test.py:12 | arg | test.py:25 |
| Taint simple.test | test.py:37 | SOURCE | | --> | Taint simple.test | test.py:41 | t | |
| Taint simple.test | test.py:44 | source() | | --> | Taint simple.test | test.py:54 | source2() | |
| Taint simple.test | test.py:46 | arg | test.py:55 | --> | Taint simple.test | test.py:47 | arg | test.py:55 |
| Taint simple.test | test.py:47 | arg | test.py:55 | --> | Taint simple.test | test.py:12 | arg | test.py:47 from test.py:55 |
| Taint simple.test | test.py:49 | arg | test.py:63 | --> | Taint simple.test | test.py:51 | arg | test.py:63 |
| Taint simple.test | test.py:49 | arg | test.py:70 | --> | Taint simple.test | test.py:51 | arg | test.py:70 |
| Taint simple.test | test.py:51 | arg | test.py:63 | --> | Taint simple.test | test.py:12 | arg | test.py:51 from test.py:63 |
| Taint simple.test | test.py:51 | arg | test.py:70 | --> | Taint simple.test | test.py:12 | arg | test.py:51 from test.py:70 |
| Taint simple.test | test.py:54 | source2() | | --> | Taint simple.test | test.py:55 | t | |
| Taint simple.test | test.py:55 | t | | --> | Taint simple.test | test.py:46 | arg | test.py:55 |
| Taint simple.test | test.py:62 | SOURCE | | --> | Taint simple.test | test.py:63 | t | |
| Taint simple.test | test.py:63 | t | | --> | Taint simple.test | test.py:49 | arg | test.py:63 |
| Taint simple.test | test.py:67 | SOURCE | | --> | Taint simple.test | test.py:70 | t | |
| Taint simple.test | test.py:70 | t | | --> | Taint simple.test | test.py:49 | arg | test.py:70 |
| Taint simple.test | test.py:72 | arg | test.py:77 | --> | Taint simple.test | test.py:73 | arg | test.py:77 |
| Taint simple.test | test.py:73 | arg | test.py:77 | --> | Taint simple.test | test.py:77 | hub() | |
| Taint simple.test | test.py:76 | SOURCE | | --> | Taint simple.test | test.py:77 | t | |
| Taint simple.test | test.py:77 | hub() | | --> | Taint simple.test | test.py:78 | t | |
| Taint simple.test | test.py:77 | t | | --> | Taint simple.test | test.py:72 | arg | test.py:77 |
| Taint simple.test | test.py:88 | Attribute | | --> | Taint simple.test | test.py:89 | t | |
| Taint simple.test | test.py:100 | Attribute() | | --> | Taint simple.test | test.py:101 | t | |
| Taint simple.test | test.py:110 | Attribute | | --> | Attribute 'x' taint simple.test | test.py:110 | t | |
| Taint simple.test | test.py:115 | Attribute | | --> | Attribute 'x' taint simple.test | test.py:115 | t | |
| Taint simple.test | test.py:128 | SOURCE | | --> | Taint simple.test | test.py:132 | t | |
| Taint simple.test | test.py:138 | SOURCE | | --> | Taint simple.test | test.py:140 | t | |
| Taint simple.test | test.py:148 | SOURCE | | --> | Taint simple.test | test.py:149 | t | |
| Taint simple.test | test.py:155 | ImportMember | | --> | Taint simple.test | test.py:156 | unsafe | |
| Taint simple.test | test.py:159 | SOURCE | | --> | Taint simple.test | test.py:160 | t | |
| Taint simple.test | test.py:163 | SOURCE | | --> | Taint simple.test | test.py:164 | s | |
| Taint simple.test | test.py:168 | SOURCE | | --> | Taint [simple.test] | test.py:168 | List | |
| Taint simple.test | test.py:169 | SOURCE | | --> | Taint {simple.test} | test.py:169 | Dict | |
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:179 | t | |
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:180 | t | |
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:183 | t | |
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:186 | t | |
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:196 | t | |
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:197 | t | |
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:199 | t | |
| Taint simple.test | test.py:203 | For | | --> | Taint simple.test | test.py:204 | i | |
| Taint simple.test | test.py:203 | For | | --> | Taint simple.test | test.py:205 | i | |
| Taint simple.test | test.py:208 | SOURCE | | --> | Taint [simple.test] | test.py:208 | List | |
| Taint simple.test | test.py:209 | For | | --> | Taint simple.test | test.py:210 | i | |
| Taint simple.test | test.py:210 | i | | --> | Taint [simple.test] | test.py:213 | flow_in_generator() | |
| Taint simple.test | test.py:213 | For | | --> | Taint simple.test | test.py:214 | x | |
| Taint {simple.test} | test.py:169 | Dict | | --> | Taint {simple.test} | test.py:171 | d | |
| Taint {simple.test} | test.py:169 | Dict | | --> | Taint {simple.test} | test.py:175 | d | |
| Taint {simple.test} | test.py:171 | d | | --> | Taint {simple.test} | test.py:173 | y | |
| Taint {simple.test} | test.py:173 | y | | --> | Taint simple.test | test.py:173 | Subscript | |
| Taint {simple.test} | test.py:175 | d | | --> | Taint {simple.test} | test.py:175 | dict() | |
| .attr = explicit.carrier | carrier.py:33 | ImplicitCarrier() | | --> | .attr = explicit.carrier | carrier.py:34 | c | |
| .attr = explicit.carrier | carrier.py:34 | c | | --> | explicit.carrier | carrier.py:34 | Attribute | |
| .attr = simple.test | carrier.py:10 | self | p0.attr = simple.test | --> | .attr = simple.test | carrier.py:11 | self | p0.attr = simple.test |
| .attr = simple.test | carrier.py:11 | self | p0.attr = simple.test | --> | simple.test | carrier.py:11 | Attribute | p0.attr = simple.test |
| .attr = simple.test | carrier.py:13 | arg | p0.attr = simple.test | --> | .attr = simple.test | carrier.py:14 | arg | p0.attr = simple.test |
| .attr = simple.test | carrier.py:17 | ImplicitCarrier() | | --> | .attr = simple.test | carrier.py:18 | c | |
| .attr = simple.test | carrier.py:18 | c | | --> | simple.test | carrier.py:18 | Attribute | |
| .attr = simple.test | carrier.py:25 | ImplicitCarrier() | | --> | .attr = simple.test | carrier.py:13 | arg | p0.attr = simple.test |
| .attr = simple.test | carrier.py:25 | ImplicitCarrier() | | --> | .attr = simple.test | carrier.py:25 | hub() | |
| .attr = simple.test | carrier.py:25 | hub() | | --> | .attr = simple.test | carrier.py:26 | c | |
| .attr = simple.test | carrier.py:26 | c | | --> | .attr = simple.test | carrier.py:10 | self | p0.attr = simple.test |
| .attr = simple.test | carrier.py:26 | c | | --> | simple.test | carrier.py:26 | Attribute() | |
| .dangerous = simple.test | test.py:85 | ImportExpr | | --> | .dangerous = simple.test | test.py:88 | module | |
| .dangerous = simple.test | test.py:85 | ImportExpr | | --> | .dangerous = simple.test | test.py:92 | module | |
| .dangerous = simple.test | test.py:85 | ImportExpr | | --> | .dangerous = simple.test | test.py:96 | module | |
| .dangerous = simple.test | test.py:85 | ImportExpr | | --> | .dangerous = simple.test | test.py:100 | module | |
| .dangerous = simple.test | test.py:85 | ImportExpr | | --> | .dangerous = simple.test | test.py:110 | module | |
| .dangerous = simple.test | test.py:85 | ImportExpr | | --> | .dangerous = simple.test | test.py:115 | module | |
| .dangerous = simple.test | test.py:88 | module | | --> | simple.test | test.py:88 | Attribute | |
| .dangerous = simple.test | test.py:110 | module | | --> | simple.test | test.py:110 | Attribute | |
| .dangerous = simple.test | test.py:115 | module | | --> | simple.test | test.py:115 | Attribute | |
| .x = simple.test | test.py:72 | arg | p0.x = simple.test | --> | .x = simple.test | test.py:73 | arg | p0.x = simple.test |
| .x = simple.test | test.py:105 | arg | p0.x = simple.test | --> | .x = simple.test | test.py:106 | arg | p0.x = simple.test |
| .x = simple.test | test.py:106 | arg | p0.x = simple.test | --> | simple.test | test.py:106 | Attribute | p0.x = simple.test |
| .x = simple.test | test.py:111 | t | | --> | simple.test | test.py:111 | Attribute | |
| .x = simple.test | test.py:116 | hub() | | --> | .x = simple.test | test.py:117 | t | |
| .x = simple.test | test.py:116 | t | | --> | .x = simple.test | test.py:72 | arg | p0.x = simple.test |
| .x = simple.test | test.py:116 | t | | --> | .x = simple.test | test.py:116 | hub() | |
| .x = simple.test | test.py:117 | t | | --> | .x = simple.test | test.py:105 | arg | p0.x = simple.test |
| Command injection | sanitizer.py:9 | user_input() | | --> | Command injection | sanitizer.py:10 | x | |
| Command injection | sanitizer.py:9 | user_input() | | --> | Command injection | sanitizer.py:11 | x | |
| Command injection | sanitizer.py:9 | user_input() | | --> | Command injection | sanitizer.py:13 | x | |
| Command injection | sanitizer.py:10 | x | | --> | Command injection | sanitizer.py:3 | arg | p0 = Command injection |
| Command injection | sanitizer.py:16 | user_input() | | --> | Command injection | sanitizer.py:17 | x | |
| Command injection | sanitizer.py:16 | user_input() | | --> | Command injection | sanitizer.py:20 | x | |
| Command injection | sanitizer.py:17 | x | | --> | Command injection | sanitizer.py:5 | arg | p0 = Command injection |
| Command injection | sanitizer.py:24 | user_input() | | --> | Command injection | sanitizer.py:25 | x | |
| Command injection | sanitizer.py:24 | user_input() | | --> | Command injection | sanitizer.py:26 | x | |
| Command injection | sanitizer.py:24 | user_input() | | --> | Command injection | sanitizer.py:28 | x | |
| Command injection | sanitizer.py:31 | user_input() | | --> | Command injection | sanitizer.py:32 | x | |
| Command injection | sanitizer.py:31 | user_input() | | --> | Command injection | sanitizer.py:33 | x | |
| Command injection | sanitizer.py:31 | user_input() | | --> | Command injection | sanitizer.py:35 | x | |
| SQL injection | sanitizer.py:9 | user_input() | | --> | SQL injection | sanitizer.py:10 | x | |
| SQL injection | sanitizer.py:9 | user_input() | | --> | SQL injection | sanitizer.py:13 | x | |
| SQL injection | sanitizer.py:10 | x | | --> | SQL injection | sanitizer.py:3 | arg | p0 = SQL injection |
| SQL injection | sanitizer.py:16 | user_input() | | --> | SQL injection | sanitizer.py:17 | x | |
| SQL injection | sanitizer.py:16 | user_input() | | --> | SQL injection | sanitizer.py:18 | x | |
| SQL injection | sanitizer.py:16 | user_input() | | --> | SQL injection | sanitizer.py:20 | x | |
| SQL injection | sanitizer.py:17 | x | | --> | SQL injection | sanitizer.py:5 | arg | p0 = SQL injection |
| SQL injection | sanitizer.py:24 | user_input() | | --> | SQL injection | sanitizer.py:25 | x | |
| SQL injection | sanitizer.py:24 | user_input() | | --> | SQL injection | sanitizer.py:26 | x | |
| SQL injection | sanitizer.py:24 | user_input() | | --> | SQL injection | sanitizer.py:28 | x | |
| SQL injection | sanitizer.py:31 | user_input() | | --> | SQL injection | sanitizer.py:32 | x | |
| SQL injection | sanitizer.py:31 | user_input() | | --> | SQL injection | sanitizer.py:33 | x | |
| SQL injection | sanitizer.py:31 | user_input() | | --> | SQL injection | sanitizer.py:35 | x | |
| basic.custom | test.py:72 | arg | p0 = basic.custom | --> | basic.custom | test.py:73 | arg | p0 = basic.custom |
| basic.custom | test.py:120 | CUSTOM_SOURCE | | --> | basic.custom | test.py:121 | t | |
| basic.custom | test.py:121 | TAINT_FROM_ARG() | | --> | basic.custom | test.py:72 | arg | p0 = basic.custom |
| basic.custom | test.py:121 | TAINT_FROM_ARG() | | --> | basic.custom | test.py:121 | hub() | |
| basic.custom | test.py:121 | hub() | | --> | basic.custom | test.py:122 | t | |
| basic.custom | test.py:121 | t | | --> | basic.custom | test.py:121 | TAINT_FROM_ARG() | |
| basic.custom | test.py:126 | CUSTOM_SOURCE | | --> | basic.custom | test.py:130 | t | |
| basic.custom | test.py:136 | CUSTOM_SOURCE | | --> | basic.custom | test.py:142 | t | |
| basic.custom | test.py:146 | CUSTOM_SOURCE | | --> | basic.custom | test.py:149 | t | |
| basic.custom | test.py:149 | TAINT_FROM_ARG() | | --> | basic.custom | test.py:151 | t | |
| basic.custom | test.py:149 | t | | --> | basic.custom | test.py:149 | TAINT_FROM_ARG() | |
| dict of simple.test | test.py:169 | Dict | | --> | dict of simple.test | test.py:171 | d | |
| dict of simple.test | test.py:169 | Dict | | --> | dict of simple.test | test.py:175 | d | |
| dict of simple.test | test.py:171 | SSA variable y | | --> | dict of simple.test | test.py:173 | y | |
| dict of simple.test | test.py:171 | d | | --> | dict of simple.test | test.py:171 | SSA variable y | |
| dict of simple.test | test.py:173 | y | | --> | simple.test | test.py:173 | Subscript | |
| dict of simple.test | test.py:175 | d | | --> | dict of simple.test | test.py:175 | dict() | |
| explicit.carrier | carrier.py:4 | arg | p1 = explicit.carrier | --> | explicit.carrier | carrier.py:5 | arg | p1 = explicit.carrier |
| explicit.carrier | carrier.py:13 | arg | p0 = explicit.carrier | --> | explicit.carrier | carrier.py:14 | arg | p0 = explicit.carrier |
| explicit.carrier | carrier.py:21 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:22 | c | |
| explicit.carrier | carrier.py:22 | c | | --> | simple.test | carrier.py:22 | Attribute() | |
| explicit.carrier | carrier.py:29 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:13 | arg | p0 = explicit.carrier |
| explicit.carrier | carrier.py:29 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:29 | hub() | |
| explicit.carrier | carrier.py:29 | hub() | | --> | explicit.carrier | carrier.py:30 | c | |
| explicit.carrier | carrier.py:30 | c | | --> | simple.test | carrier.py:30 | Attribute() | |
| explicit.carrier | carrier.py:33 | TAINT_CARRIER_SOURCE | | --> | .attr = explicit.carrier | carrier.py:33 | ImplicitCarrier() | |
| explicit.carrier | carrier.py:33 | TAINT_CARRIER_SOURCE | | --> | explicit.carrier | carrier.py:4 | arg | p1 = explicit.carrier |
| explicit.carrier | carrier.py:34 | Attribute | | --> | explicit.carrier | carrier.py:35 | x | |
| explicit.carrier | carrier.py:35 | x | | --> | simple.test | carrier.py:35 | Attribute() | |
| falsey | test.py:189 | FALSEY | | --> | falsey | test.py:190 | t | |
| iterable.simple | test.py:202 | ITERABLE_SOURCE | | --> | iterable.simple | test.py:203 | t | |
| iterable.simple | test.py:203 | t | | --> | simple.test | test.py:203 | For | |
| iterable.simple | test.py:213 | flow_in_generator() | | --> | simple.test | test.py:213 | For | |
| paper | rockpaperscissors.py:25 | Attribute() | | --> | paper | rockpaperscissors.py:26 | y | |
| paper | rockpaperscissors.py:26 | y | | --> | paper | rockpaperscissors.py:9 | arg | p0 = paper |
| paper | rockpaperscissors.py:30 | Attribute() | | --> | paper | rockpaperscissors.py:32 | y | |
| paper | rockpaperscissors.py:32 | y | | --> | paper | rockpaperscissors.py:6 | arg | p0 = paper |
| rock | rockpaperscissors.py:16 | ROCK | | --> | rock | rockpaperscissors.py:6 | arg | p0 = rock |
| rock | rockpaperscissors.py:19 | ROCK | | --> | rock | rockpaperscissors.py:20 | x | |
| rock | rockpaperscissors.py:20 | x | | --> | scissors | rockpaperscissors.py:20 | Attribute() | |
| rock | rockpaperscissors.py:24 | ROCK | | --> | rock | rockpaperscissors.py:25 | x | |
| rock | rockpaperscissors.py:25 | x | | --> | scissors | rockpaperscissors.py:25 | Attribute() | |
| scissors | rockpaperscissors.py:13 | SCISSORS | | --> | scissors | rockpaperscissors.py:3 | arg | p0 = scissors |
| scissors | rockpaperscissors.py:20 | Attribute() | | --> | scissors | rockpaperscissors.py:21 | y | |
| scissors | rockpaperscissors.py:21 | y | | --> | scissors | rockpaperscissors.py:9 | arg | p0 = scissors |
| scissors | rockpaperscissors.py:25 | Attribute() | | --> | paper | rockpaperscissors.py:25 | Attribute() | |
| scissors | rockpaperscissors.py:29 | SCISSORS | | --> | scissors | rockpaperscissors.py:30 | x | |
| scissors | rockpaperscissors.py:29 | SCISSORS | | --> | scissors | rockpaperscissors.py:31 | x | |
| scissors | rockpaperscissors.py:30 | x | | --> | paper | rockpaperscissors.py:30 | Attribute() | |
| scissors | rockpaperscissors.py:31 | x | | --> | scissors | rockpaperscissors.py:6 | arg | p0 = scissors |
| sequence of simple.test | test.py:168 | List | | --> | sequence of simple.test | test.py:170 | l | |
| sequence of simple.test | test.py:168 | List | | --> | sequence of simple.test | test.py:174 | l | |
| sequence of simple.test | test.py:170 | SSA variable x | | --> | sequence of simple.test | test.py:172 | x | |
| sequence of simple.test | test.py:170 | l | | --> | sequence of simple.test | test.py:170 | SSA variable x | |
| sequence of simple.test | test.py:172 | x | | --> | simple.test | test.py:172 | Subscript | |
| sequence of simple.test | test.py:174 | l | | --> | sequence of simple.test | test.py:174 | list() | |
| sequence of simple.test | test.py:208 | List | | --> | sequence of simple.test | test.py:209 | seq | |
| sequence of simple.test | test.py:209 | seq | | --> | simple.test | test.py:209 | For | |
| sequence of simple.test | test.py:213 | flow_in_generator() | | --> | simple.test | test.py:213 | For | |
| simple.test | carrier.py:4 | arg | p1 = simple.test | --> | simple.test | carrier.py:5 | arg | p1 = simple.test |
| simple.test | carrier.py:17 | SOURCE | | --> | .attr = simple.test | carrier.py:17 | ImplicitCarrier() | |
| simple.test | carrier.py:17 | SOURCE | | --> | simple.test | carrier.py:4 | arg | p1 = simple.test |
| simple.test | carrier.py:25 | SOURCE | | --> | .attr = simple.test | carrier.py:25 | ImplicitCarrier() | |
| simple.test | carrier.py:25 | SOURCE | | --> | simple.test | carrier.py:4 | arg | p1 = simple.test |
| simple.test | deep.py:2 | arg | p0 = simple.test | --> | simple.test | deep.py:3 | arg | p0 = simple.test |
| simple.test | deep.py:5 | arg | p0 = simple.test | --> | simple.test | deep.py:6 | arg | p0 = simple.test |
| simple.test | deep.py:6 | arg | p0 = simple.test | --> | simple.test | deep.py:2 | arg | p0 = simple.test |
| simple.test | deep.py:6 | arg | p0 = simple.test | --> | simple.test | deep.py:6 | f1() | p0 = simple.test |
| simple.test | deep.py:8 | arg | p0 = simple.test | --> | simple.test | deep.py:9 | arg | p0 = simple.test |
| simple.test | deep.py:9 | arg | p0 = simple.test | --> | simple.test | deep.py:5 | arg | p0 = simple.test |
| simple.test | deep.py:9 | arg | p0 = simple.test | --> | simple.test | deep.py:9 | f2() | p0 = simple.test |
| simple.test | deep.py:11 | arg | p0 = simple.test | --> | simple.test | deep.py:12 | arg | p0 = simple.test |
| simple.test | deep.py:12 | arg | p0 = simple.test | --> | simple.test | deep.py:8 | arg | p0 = simple.test |
| simple.test | deep.py:12 | arg | p0 = simple.test | --> | simple.test | deep.py:12 | f3() | p0 = simple.test |
| simple.test | deep.py:14 | arg | p0 = simple.test | --> | simple.test | deep.py:15 | arg | p0 = simple.test |
| simple.test | deep.py:15 | arg | p0 = simple.test | --> | simple.test | deep.py:11 | arg | p0 = simple.test |
| simple.test | deep.py:15 | arg | p0 = simple.test | --> | simple.test | deep.py:15 | f4() | p0 = simple.test |
| simple.test | deep.py:17 | arg | p0 = simple.test | --> | simple.test | deep.py:18 | arg | p0 = simple.test |
| simple.test | deep.py:18 | arg | p0 = simple.test | --> | simple.test | deep.py:14 | arg | p0 = simple.test |
| simple.test | deep.py:18 | arg | p0 = simple.test | --> | simple.test | deep.py:18 | f5() | p0 = simple.test |
| simple.test | deep.py:20 | SOURCE | | --> | simple.test | deep.py:17 | arg | p0 = simple.test |
| simple.test | deep.py:20 | SOURCE | | --> | simple.test | deep.py:20 | f6() | |
| simple.test | deep.py:20 | f6() | | --> | simple.test | deep.py:22 | x | |
| simple.test | module.py:3 | SOURCE | | --> | .dangerous = simple.test | test.py:85 | ImportExpr | |
| simple.test | module.py:3 | SOURCE | | --> | .dangerous = simple.test | test.py:88 | module | |
| simple.test | module.py:3 | SOURCE | | --> | .dangerous = simple.test | test.py:92 | module | |
| simple.test | module.py:3 | SOURCE | | --> | .dangerous = simple.test | test.py:96 | module | |
| simple.test | module.py:3 | SOURCE | | --> | .dangerous = simple.test | test.py:100 | module | |
| simple.test | module.py:3 | SOURCE | | --> | .dangerous = simple.test | test.py:110 | module | |
| simple.test | module.py:3 | SOURCE | | --> | .dangerous = simple.test | test.py:115 | module | |
| simple.test | module.py:3 | SOURCE | | --> | .dangerous = simple.test | test.py:155 | ImportExpr | |
| simple.test | module.py:3 | SOURCE | | --> | simple.test | test.py:155 | ImportMember | |
| simple.test | module.py:7 | SOURCE | | --> | simple.test | test.py:100 | Attribute() | |
| simple.test | test.py:6 | SOURCE | | --> | simple.test | test.py:7 | s | |
| simple.test | test.py:10 | SOURCE | | --> | simple.test | test.py:16 | source() | |
| simple.test | test.py:10 | SOURCE | | --> | simple.test | test.py:24 | source() | |
| simple.test | test.py:10 | SOURCE | | --> | simple.test | test.py:44 | source() | |
| simple.test | test.py:12 | arg | p0 = simple.test | --> | simple.test | test.py:13 | arg | p0 = simple.test |
| simple.test | test.py:16 | source() | | --> | simple.test | test.py:17 | t | |
| simple.test | test.py:20 | SOURCE | | --> | simple.test | test.py:21 | t | |
| simple.test | test.py:21 | t | | --> | simple.test | test.py:12 | arg | p0 = simple.test |
| simple.test | test.py:24 | source() | | --> | simple.test | test.py:25 | t | |
| simple.test | test.py:25 | t | | --> | simple.test | test.py:12 | arg | p0 = simple.test |
| simple.test | test.py:37 | SOURCE | | --> | simple.test | test.py:41 | t | |
| simple.test | test.py:44 | source() | | --> | simple.test | test.py:54 | source2() | |
| simple.test | test.py:46 | arg | p0 = simple.test | --> | simple.test | test.py:47 | arg | p0 = simple.test |
| simple.test | test.py:47 | arg | p0 = simple.test | --> | simple.test | test.py:12 | arg | p0 = simple.test |
| simple.test | test.py:49 | arg | p1 = simple.test | --> | simple.test | test.py:51 | arg | p1 = simple.test |
| simple.test | test.py:51 | arg | p1 = simple.test | --> | simple.test | test.py:12 | arg | p0 = simple.test |
| simple.test | test.py:54 | source2() | | --> | simple.test | test.py:55 | t | |
| simple.test | test.py:55 | t | | --> | simple.test | test.py:46 | arg | p0 = simple.test |
| simple.test | test.py:62 | SOURCE | | --> | simple.test | test.py:63 | t | |
| simple.test | test.py:63 | t | | --> | simple.test | test.py:49 | arg | p1 = simple.test |
| simple.test | test.py:67 | SOURCE | | --> | simple.test | test.py:70 | t | |
| simple.test | test.py:70 | t | | --> | simple.test | test.py:49 | arg | p1 = simple.test |
| simple.test | test.py:72 | arg | p0 = simple.test | --> | simple.test | test.py:73 | arg | p0 = simple.test |
| simple.test | test.py:76 | SOURCE | | --> | simple.test | test.py:77 | t | |
| simple.test | test.py:77 | hub() | | --> | simple.test | test.py:78 | t | |
| simple.test | test.py:77 | t | | --> | simple.test | test.py:72 | arg | p0 = simple.test |
| simple.test | test.py:77 | t | | --> | simple.test | test.py:77 | hub() | |
| simple.test | test.py:88 | Attribute | | --> | simple.test | test.py:89 | t | |
| simple.test | test.py:100 | Attribute() | | --> | simple.test | test.py:101 | t | |
| simple.test | test.py:110 | Attribute | | --> | .x = simple.test | test.py:111 | t | |
| simple.test | test.py:115 | Attribute | | --> | .x = simple.test | test.py:116 | t | |
| simple.test | test.py:128 | SOURCE | | --> | simple.test | test.py:132 | t | |
| simple.test | test.py:138 | SOURCE | | --> | simple.test | test.py:140 | t | |
| simple.test | test.py:148 | SOURCE | | --> | simple.test | test.py:149 | t | |
| simple.test | test.py:155 | ImportMember | | --> | simple.test | test.py:156 | unsafe | |
| simple.test | test.py:159 | SOURCE | | --> | simple.test | test.py:160 | t | |
| simple.test | test.py:163 | SOURCE | | --> | simple.test | test.py:164 | s | |
| simple.test | test.py:168 | SOURCE | | --> | sequence of simple.test | test.py:168 | List | |
| simple.test | test.py:169 | SOURCE | | --> | dict of simple.test | test.py:169 | Dict | |
| simple.test | test.py:178 | SOURCE | | --> | simple.test | test.py:179 | t | |
| simple.test | test.py:178 | SOURCE | | --> | simple.test | test.py:180 | t | |
| simple.test | test.py:178 | SOURCE | | --> | simple.test | test.py:183 | t | |
| simple.test | test.py:178 | SOURCE | | --> | simple.test | test.py:186 | t | |
| simple.test | test.py:195 | SOURCE | | --> | simple.test | test.py:196 | t | |
| simple.test | test.py:195 | SOURCE | | --> | simple.test | test.py:197 | t | |
| simple.test | test.py:195 | SOURCE | | --> | simple.test | test.py:199 | t | |
| simple.test | test.py:203 | For | | --> | simple.test | test.py:204 | i | |
| simple.test | test.py:203 | For | | --> | simple.test | test.py:205 | i | |
| simple.test | test.py:208 | SOURCE | | --> | sequence of simple.test | test.py:208 | List | |
| simple.test | test.py:209 | For | | --> | simple.test | test.py:210 | i | |
| simple.test | test.py:210 | i | | --> | iterable.simple | test.py:213 | flow_in_generator() | |
| simple.test | test.py:210 | i | | --> | sequence of simple.test | test.py:213 | flow_in_generator() | |
| simple.test | test.py:213 | For | | --> | simple.test | test.py:214 | x | |

11
python/ql/test/library-tests/taint/general/TestStep.ql
View File

@@ -4,8 +4,9 @@ import TaintLib
from TaintedNode n, TaintedNode s
where s = n.getASuccessor()
select
n.getTrackedValue(), n.getLocation().toString(), n.getNode().getNode().toString(), n.getContext(),
" --> ",
s.getTrackedValue(), s.getLocation().toString(), s.getNode().getNode().toString(), s.getContext()
where
s = n.getASuccessor()
select
n.toString(), n.getLocation().toString(), n.getNode().toString(), n.getContext(),
"-->",
s.toString(), s.getLocation().toString(), s.getNode().toString(), s.getContext()

388
python/ql/test/library-tests/taint/general/TestVar.expected
View File

@@ -1,193 +1,195 @@
| carrier.py:4 | arg_0 | carrier.py:4 | Taint explicit.carrier | arg |
| carrier.py:4 | arg_0 | carrier.py:4 | Taint simple.test | arg |
| carrier.py:5 | self_1 | carrier.py:5 | Attribute 'attr' taint explicit.carrier | self |
| carrier.py:5 | self_1 | carrier.py:5 | Attribute 'attr' taint simple.test | self |
| carrier.py:13 | arg_0 | carrier.py:13 | Attribute 'attr' taint simple.test | arg |
| carrier.py:13 | arg_0 | carrier.py:13 | Taint explicit.carrier | arg |
| carrier.py:17 | c_0 | carrier.py:17 | Attribute 'attr' taint simple.test | ImplicitCarrier() |
| carrier.py:21 | c_0 | carrier.py:21 | Taint explicit.carrier | TAINT_CARRIER_SOURCE |
| carrier.py:22 | c_1 | carrier.py:21 | Taint explicit.carrier | TAINT_CARRIER_SOURCE |
| carrier.py:25 | c_0 | carrier.py:25 | Attribute 'attr' taint simple.test | hub() |
| carrier.py:29 | c_0 | carrier.py:29 | Taint explicit.carrier | hub() |
| carrier.py:30 | c_1 | carrier.py:29 | Taint explicit.carrier | hub() |
| carrier.py:33 | c_0 | carrier.py:33 | Attribute 'attr' taint explicit.carrier | ImplicitCarrier() |
| carrier.py:34 | x_0 | carrier.py:34 | Taint explicit.carrier | Attribute |
| carrier.py:35 | x_1 | carrier.py:34 | Taint explicit.carrier | Attribute |
| deep.py:2 | arg_0 | deep.py:2 | Taint simple.test | arg |
| deep.py:5 | arg_0 | deep.py:5 | Taint simple.test | arg |
| deep.py:6 | arg_1 | deep.py:5 | Taint simple.test | arg |
| deep.py:8 | arg_0 | deep.py:8 | Taint simple.test | arg |
| deep.py:9 | arg_1 | deep.py:8 | Taint simple.test | arg |
| deep.py:11 | arg_0 | deep.py:11 | Taint simple.test | arg |
| deep.py:12 | arg_1 | deep.py:11 | Taint simple.test | arg |
| deep.py:14 | arg_0 | deep.py:14 | Taint simple.test | arg |
| deep.py:15 | arg_1 | deep.py:14 | Taint simple.test | arg |
| deep.py:17 | arg_0 | deep.py:17 | Taint simple.test | arg |
| deep.py:18 | arg_1 | deep.py:17 | Taint simple.test | arg |
| deep.py:20 | x_1 | deep.py:20 | Taint simple.test | f6() |
| module.py:3 | dangerous_0 | module.py:3 | Taint simple.test | SOURCE |
| rockpaperscissors.py:3 | arg_0 | rockpaperscissors.py:3 | Taint scissors | arg |
| rockpaperscissors.py:6 | arg_0 | rockpaperscissors.py:6 | Taint paper | arg |
| rockpaperscissors.py:6 | arg_0 | rockpaperscissors.py:6 | Taint rock | arg |
| rockpaperscissors.py:6 | arg_0 | rockpaperscissors.py:6 | Taint scissors | arg |
| rockpaperscissors.py:9 | arg_0 | rockpaperscissors.py:9 | Taint paper | arg |
| rockpaperscissors.py:9 | arg_0 | rockpaperscissors.py:9 | Taint scissors | arg |
| rockpaperscissors.py:19 | x_0 | rockpaperscissors.py:19 | Taint rock | ROCK |
| rockpaperscissors.py:20 | x_1 | rockpaperscissors.py:19 | Taint rock | ROCK |
| rockpaperscissors.py:20 | y_0 | rockpaperscissors.py:20 | Taint scissors | Attribute() |
| rockpaperscissors.py:21 | y_1 | rockpaperscissors.py:20 | Taint scissors | Attribute() |
| rockpaperscissors.py:24 | x_0 | rockpaperscissors.py:24 | Taint rock | ROCK |
| rockpaperscissors.py:25 | x_1 | rockpaperscissors.py:24 | Taint rock | ROCK |
| rockpaperscissors.py:25 | y_0 | rockpaperscissors.py:25 | Taint paper | Attribute() |
| rockpaperscissors.py:26 | y_1 | rockpaperscissors.py:25 | Taint paper | Attribute() |
| rockpaperscissors.py:29 | x_0 | rockpaperscissors.py:29 | Taint scissors | SCISSORS |
| rockpaperscissors.py:30 | x_1 | rockpaperscissors.py:29 | Taint scissors | SCISSORS |
| rockpaperscissors.py:30 | y_0 | rockpaperscissors.py:30 | Taint paper | Attribute() |
| rockpaperscissors.py:31 | x_2 | rockpaperscissors.py:29 | Taint scissors | SCISSORS |
| rockpaperscissors.py:32 | y_1 | rockpaperscissors.py:30 | Taint paper | Attribute() |
| sanitizer.py:3 | arg_0 | sanitizer.py:3 | Taint Command injection | arg |
| sanitizer.py:3 | arg_0 | sanitizer.py:3 | Taint SQL injection | arg |
| sanitizer.py:5 | arg_0 | sanitizer.py:5 | Taint Command injection | arg |
| sanitizer.py:5 | arg_0 | sanitizer.py:5 | Taint SQL injection | arg |
| sanitizer.py:8 | x_5 | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:8 | x_5 | sanitizer.py:9 | Taint SQL injection | user_input() |
| sanitizer.py:9 | x_0 | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:9 | x_0 | sanitizer.py:9 | Taint SQL injection | user_input() |
| sanitizer.py:11 | x_1 | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:11 | x_2 | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:13 | x_3 | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:13 | x_3 | sanitizer.py:9 | Taint SQL injection | user_input() |
| sanitizer.py:13 | x_4 | sanitizer.py:9 | Taint Command injection | user_input() |
| sanitizer.py:13 | x_4 | sanitizer.py:9 | Taint SQL injection | user_input() |
| sanitizer.py:15 | x_5 | sanitizer.py:16 | Taint Command injection | user_input() |
| sanitizer.py:15 | x_5 | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:16 | x_0 | sanitizer.py:16 | Taint Command injection | user_input() |
| sanitizer.py:16 | x_0 | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:18 | x_1 | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:18 | x_2 | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:20 | x_3 | sanitizer.py:16 | Taint Command injection | user_input() |
| sanitizer.py:20 | x_3 | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:20 | x_4 | sanitizer.py:16 | Taint Command injection | user_input() |
| sanitizer.py:20 | x_4 | sanitizer.py:16 | Taint SQL injection | user_input() |
| sanitizer.py:23 | x_5 | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:23 | x_5 | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:24 | x_0 | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:24 | x_0 | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:26 | x_1 | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:26 | x_1 | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:26 | x_2 | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:26 | x_2 | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:28 | x_3 | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:28 | x_3 | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:28 | x_4 | sanitizer.py:24 | Taint Command injection | user_input() |
| sanitizer.py:28 | x_4 | sanitizer.py:24 | Taint SQL injection | user_input() |
| sanitizer.py:30 | x_5 | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:30 | x_5 | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:31 | x_0 | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:31 | x_0 | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:33 | x_1 | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:33 | x_1 | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:33 | x_2 | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:33 | x_2 | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:35 | x_3 | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:35 | x_3 | sanitizer.py:31 | Taint SQL injection | user_input() |
| sanitizer.py:35 | x_4 | sanitizer.py:31 | Taint Command injection | user_input() |
| sanitizer.py:35 | x_4 | sanitizer.py:31 | Taint SQL injection | user_input() |
| test.py:6 | s_0 | test.py:6 | Taint simple.test | SOURCE |
| test.py:7 | s_1 | test.py:6 | Taint simple.test | SOURCE |
| test.py:12 | arg_0 | test.py:12 | Taint simple.test | arg |
| test.py:13 | arg_1 | test.py:12 | Taint simple.test | arg |
| test.py:16 | t_0 | test.py:16 | Taint simple.test | source() |
| test.py:17 | t_1 | test.py:16 | Taint simple.test | source() |
| test.py:20 | t_0 | test.py:20 | Taint simple.test | SOURCE |
| test.py:21 | t_1 | test.py:20 | Taint simple.test | SOURCE |
| test.py:24 | t_0 | test.py:24 | Taint simple.test | source() |
| test.py:25 | t_1 | test.py:24 | Taint simple.test | source() |
| test.py:31 | t_2 | test.py:31 | Taint simple.test | SOURCE |
| test.py:37 | t_0 | test.py:37 | Taint simple.test | SOURCE |
| test.py:41 | t_1 | test.py:37 | Taint simple.test | SOURCE |
| test.py:46 | arg_0 | test.py:46 | Taint simple.test | arg |
| test.py:47 | arg_1 | test.py:46 | Taint simple.test | arg |
| test.py:49 | arg_0 | test.py:49 | Taint simple.test | arg |
| test.py:49 | arg_2 | test.py:49 | Taint simple.test | arg |
| test.py:51 | arg_1 | test.py:49 | Taint simple.test | arg |
| test.py:54 | t_0 | test.py:54 | Taint simple.test | source2() |
| test.py:55 | t_1 | test.py:54 | Taint simple.test | source2() |
| test.py:62 | t_1 | test.py:62 | Taint simple.test | SOURCE |
| test.py:63 | t_2 | test.py:62 | Taint simple.test | SOURCE |
| test.py:67 | t_0 | test.py:67 | Taint simple.test | SOURCE |
| test.py:70 | t_2 | test.py:67 | Taint simple.test | SOURCE |
| test.py:72 | arg_0 | test.py:72 | Attribute 'x' taint simple.test | arg |
| test.py:72 | arg_0 | test.py:72 | Taint basic.custom | arg |
| test.py:72 | arg_0 | test.py:72 | Taint simple.test | arg |
| test.py:76 | t_0 | test.py:76 | Taint simple.test | SOURCE |
| test.py:77 | t_1 | test.py:77 | Taint simple.test | hub() |
| test.py:78 | t_2 | test.py:77 | Taint simple.test | hub() |
| test.py:85 | module_0 | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:87 | module_1 | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:88 | t_0 | test.py:88 | Taint simple.test | Attribute |
| test.py:89 | t_1 | test.py:88 | Taint simple.test | Attribute |
| test.py:91 | module_2 | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:95 | module_3 | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:99 | module_4 | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:100 | t_0 | test.py:100 | Taint simple.test | Attribute() |
| test.py:101 | t_1 | test.py:100 | Taint simple.test | Attribute() |
| test.py:105 | arg_0 | test.py:105 | Attribute 'x' taint simple.test | arg |
| test.py:108 | module_5 | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:110 | t_1 | test.py:110 | Attribute 'x' taint simple.test | t |
| test.py:113 | module_6 | test.py:85 | Attribute 'dangerous' taint simple.test | ImportExpr |
| test.py:115 | t_1 | test.py:115 | Attribute 'x' taint simple.test | t |
| test.py:116 | t_2 | test.py:116 | Attribute 'x' taint simple.test | hub() |
| test.py:117 | t_3 | test.py:116 | Attribute 'x' taint simple.test | hub() |
| test.py:120 | t_0 | test.py:120 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:121 | t_1 | test.py:121 | Taint basic.custom | hub() |
| test.py:122 | t_2 | test.py:121 | Taint basic.custom | hub() |
| test.py:126 | t_0 | test.py:126 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:128 | t_2 | test.py:128 | Taint simple.test | SOURCE |
| test.py:130 | t_1 | test.py:126 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:132 | t_3 | test.py:128 | Taint simple.test | SOURCE |
| test.py:136 | t_0 | test.py:136 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:138 | t_2 | test.py:138 | Taint simple.test | SOURCE |
| test.py:140 | t_3 | test.py:138 | Taint simple.test | SOURCE |
| test.py:142 | t_1 | test.py:136 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:146 | t_0 | test.py:146 | Taint basic.custom | CUSTOM_SOURCE |
| test.py:148 | t_3 | test.py:148 | Taint simple.test | SOURCE |
| test.py:149 | t_1 | test.py:149 | Taint basic.custom | TAINT_FROM_ARG() |
| test.py:151 | t_2 | test.py:149 | Taint basic.custom | TAINT_FROM_ARG() |
| test.py:155 | unsafe_0 | test.py:155 | Taint simple.test | ImportMember |
| test.py:156 | unsafe_1 | test.py:155 | Taint simple.test | ImportMember |
| test.py:159 | t_0 | test.py:159 | Taint simple.test | SOURCE |
| test.py:160 | t_1 | test.py:159 | Taint simple.test | SOURCE |
| test.py:163 | s_0 | test.py:163 | Taint simple.test | SOURCE |
| test.py:168 | l_0 | test.py:168 | Taint [simple.test] | List |
| test.py:169 | d_0 | test.py:169 | Taint {simple.test} | Dict |
| test.py:170 | l_1 | test.py:168 | Taint [simple.test] | List |
| test.py:170 | x_1 | test.py:170 | Taint [simple.test] | l |
| test.py:171 | d_1 | test.py:169 | Taint {simple.test} | Dict |
| test.py:171 | y_1 | test.py:171 | Taint {simple.test} | d |
| test.py:174 | l2_0 | test.py:174 | Taint [simple.test] | list() |
| test.py:174 | l_2 | test.py:168 | Taint [simple.test] | List |
| test.py:175 | d2_0 | test.py:175 | Taint {simple.test} | dict() |
| test.py:175 | d_2 | test.py:169 | Taint {simple.test} | Dict |
| test.py:178 | t_0 | test.py:178 | Taint simple.test | SOURCE |
| test.py:180 | t_1 | test.py:178 | Taint simple.test | SOURCE |
| test.py:180 | t_2 | test.py:178 | Taint simple.test | SOURCE |
| test.py:183 | t_3 | test.py:178 | Taint simple.test | SOURCE |
| test.py:186 | t_4 | test.py:178 | Taint simple.test | SOURCE |
| test.py:189 | t_0 | test.py:189 | Taint falsey | FALSEY |
| test.py:191 | t_1 | test.py:189 | Taint falsey | FALSEY |
| test.py:194 | t_5 | test.py:195 | Taint simple.test | SOURCE |
| test.py:195 | t_0 | test.py:195 | Taint simple.test | SOURCE |
| test.py:197 | t_1 | test.py:195 | Taint simple.test | SOURCE |
| test.py:197 | t_2 | test.py:195 | Taint simple.test | SOURCE |
| test.py:199 | t_3 | test.py:195 | Taint simple.test | SOURCE |
| test.py:199 | t_4 | test.py:195 | Taint simple.test | SOURCE |
| test.py:202 | t_0 | test.py:202 | Taint iterable.simple | ITERABLE_SOURCE |
| test.py:203 | i_1 | test.py:203 | Taint simple.test | For |
| test.py:203 | i_2 | test.py:203 | Taint simple.test | For |
| test.py:208 | seq_0 | test.py:208 | Taint [simple.test] | List |
| test.py:209 | i_1 | test.py:209 | Taint simple.test | For |
| test.py:209 | i_2 | test.py:209 | Taint simple.test | For |
| test.py:213 | x_0 | test.py:213 | Taint simple.test | For |
| test.py:213 | x_1 | test.py:213 | Taint simple.test | For |
| test.py:214 | x_2 | test.py:213 | Taint simple.test | For |
| carrier.py:4 | arg_0 | carrier.py:4 | Taint explicit.carrier |
| carrier.py:4 | arg_0 | carrier.py:4 | Taint simple.test |
| carrier.py:5 | self_1 | carrier.py:5 | Taint .attr = explicit.carrier |
| carrier.py:5 | self_1 | carrier.py:5 | Taint .attr = simple.test |
| carrier.py:10 | self_0 | carrier.py:10 | Taint .attr = simple.test |
| carrier.py:13 | arg_0 | carrier.py:13 | Taint .attr = simple.test |
| carrier.py:13 | arg_0 | carrier.py:13 | Taint explicit.carrier |
| carrier.py:17 | c_0 | carrier.py:17 | Taint .attr = simple.test |
| carrier.py:21 | c_0 | carrier.py:21 | Taint explicit.carrier |
| carrier.py:22 | c_1 | carrier.py:22 | Taint explicit.carrier |
| carrier.py:25 | c_0 | carrier.py:25 | Taint .attr = simple.test |
| carrier.py:26 | c_1 | carrier.py:26 | Taint .attr = simple.test |
| carrier.py:29 | c_0 | carrier.py:29 | Taint explicit.carrier |
| carrier.py:30 | c_1 | carrier.py:30 | Taint explicit.carrier |
| carrier.py:33 | c_0 | carrier.py:33 | Taint .attr = explicit.carrier |
| carrier.py:34 | x_0 | carrier.py:34 | Taint explicit.carrier |
| carrier.py:35 | x_1 | carrier.py:35 | Taint explicit.carrier |
| deep.py:2 | arg_0 | deep.py:2 | Taint simple.test |
| deep.py:5 | arg_0 | deep.py:5 | Taint simple.test |
| deep.py:6 | arg_1 | deep.py:6 | Taint simple.test |
| deep.py:8 | arg_0 | deep.py:8 | Taint simple.test |
| deep.py:9 | arg_1 | deep.py:9 | Taint simple.test |
| deep.py:11 | arg_0 | deep.py:11 | Taint simple.test |
| deep.py:12 | arg_1 | deep.py:12 | Taint simple.test |
| deep.py:14 | arg_0 | deep.py:14 | Taint simple.test |
| deep.py:15 | arg_1 | deep.py:15 | Taint simple.test |
| deep.py:17 | arg_0 | deep.py:17 | Taint simple.test |
| deep.py:18 | arg_1 | deep.py:18 | Taint simple.test |
| deep.py:20 | x_1 | deep.py:20 | Taint simple.test |
| module.py:3 | dangerous_0 | module.py:3 | Taint simple.test |
| rockpaperscissors.py:3 | arg_0 | rockpaperscissors.py:3 | Taint scissors |
| rockpaperscissors.py:6 | arg_0 | rockpaperscissors.py:6 | Taint paper |
| rockpaperscissors.py:6 | arg_0 | rockpaperscissors.py:6 | Taint rock |
| rockpaperscissors.py:6 | arg_0 | rockpaperscissors.py:6 | Taint scissors |
| rockpaperscissors.py:9 | arg_0 | rockpaperscissors.py:9 | Taint paper |
| rockpaperscissors.py:9 | arg_0 | rockpaperscissors.py:9 | Taint scissors |
| rockpaperscissors.py:19 | x_0 | rockpaperscissors.py:19 | Taint rock |
| rockpaperscissors.py:20 | x_1 | rockpaperscissors.py:20 | Taint rock |
| rockpaperscissors.py:20 | y_0 | rockpaperscissors.py:20 | Taint scissors |
| rockpaperscissors.py:21 | y_1 | rockpaperscissors.py:21 | Taint scissors |
| rockpaperscissors.py:24 | x_0 | rockpaperscissors.py:24 | Taint rock |
| rockpaperscissors.py:25 | x_1 | rockpaperscissors.py:25 | Taint rock |
| rockpaperscissors.py:25 | y_0 | rockpaperscissors.py:25 | Taint paper |
| rockpaperscissors.py:26 | y_1 | rockpaperscissors.py:26 | Taint paper |
| rockpaperscissors.py:29 | x_0 | rockpaperscissors.py:29 | Taint scissors |
| rockpaperscissors.py:30 | x_1 | rockpaperscissors.py:30 | Taint scissors |
| rockpaperscissors.py:30 | y_0 | rockpaperscissors.py:30 | Taint paper |
| rockpaperscissors.py:31 | x_2 | rockpaperscissors.py:31 | Taint scissors |
| rockpaperscissors.py:32 | y_1 | rockpaperscissors.py:32 | Taint paper |
| sanitizer.py:3 | arg_0 | sanitizer.py:3 | Taint Command injection |
| sanitizer.py:3 | arg_0 | sanitizer.py:3 | Taint SQL injection |
| sanitizer.py:5 | arg_0 | sanitizer.py:5 | Taint Command injection |
| sanitizer.py:5 | arg_0 | sanitizer.py:5 | Taint SQL injection |
| sanitizer.py:8 | x_5 | sanitizer.py:8 | Taint Command injection |
| sanitizer.py:8 | x_5 | sanitizer.py:8 | Taint SQL injection |
| sanitizer.py:9 | x_0 | sanitizer.py:9 | Taint Command injection |
| sanitizer.py:9 | x_0 | sanitizer.py:9 | Taint SQL injection |
| sanitizer.py:11 | x_1 | sanitizer.py:11 | Taint Command injection |
| sanitizer.py:11 | x_2 | sanitizer.py:11 | Taint Command injection |
| sanitizer.py:13 | x_3 | sanitizer.py:13 | Taint Command injection |
| sanitizer.py:13 | x_3 | sanitizer.py:13 | Taint SQL injection |
| sanitizer.py:13 | x_4 | sanitizer.py:13 | Taint Command injection |
| sanitizer.py:13 | x_4 | sanitizer.py:13 | Taint SQL injection |
| sanitizer.py:15 | x_5 | sanitizer.py:15 | Taint Command injection |
| sanitizer.py:15 | x_5 | sanitizer.py:15 | Taint SQL injection |
| sanitizer.py:16 | x_0 | sanitizer.py:16 | Taint Command injection |
| sanitizer.py:16 | x_0 | sanitizer.py:16 | Taint SQL injection |
| sanitizer.py:18 | x_1 | sanitizer.py:18 | Taint SQL injection |
| sanitizer.py:18 | x_2 | sanitizer.py:18 | Taint SQL injection |
| sanitizer.py:20 | x_3 | sanitizer.py:20 | Taint Command injection |
| sanitizer.py:20 | x_3 | sanitizer.py:20 | Taint SQL injection |
| sanitizer.py:20 | x_4 | sanitizer.py:20 | Taint Command injection |
| sanitizer.py:20 | x_4 | sanitizer.py:20 | Taint SQL injection |
| sanitizer.py:23 | x_5 | sanitizer.py:23 | Taint Command injection |
| sanitizer.py:23 | x_5 | sanitizer.py:23 | Taint SQL injection |
| sanitizer.py:24 | x_0 | sanitizer.py:24 | Taint Command injection |
| sanitizer.py:24 | x_0 | sanitizer.py:24 | Taint SQL injection |
| sanitizer.py:26 | x_1 | sanitizer.py:26 | Taint Command injection |
| sanitizer.py:26 | x_1 | sanitizer.py:26 | Taint SQL injection |
| sanitizer.py:26 | x_2 | sanitizer.py:26 | Taint Command injection |
| sanitizer.py:26 | x_2 | sanitizer.py:26 | Taint SQL injection |
| sanitizer.py:28 | x_3 | sanitizer.py:28 | Taint Command injection |
| sanitizer.py:28 | x_3 | sanitizer.py:28 | Taint SQL injection |
| sanitizer.py:28 | x_4 | sanitizer.py:28 | Taint Command injection |
| sanitizer.py:28 | x_4 | sanitizer.py:28 | Taint SQL injection |
| sanitizer.py:30 | x_5 | sanitizer.py:30 | Taint Command injection |
| sanitizer.py:30 | x_5 | sanitizer.py:30 | Taint SQL injection |
| sanitizer.py:31 | x_0 | sanitizer.py:31 | Taint Command injection |
| sanitizer.py:31 | x_0 | sanitizer.py:31 | Taint SQL injection |
| sanitizer.py:33 | x_1 | sanitizer.py:33 | Taint Command injection |
| sanitizer.py:33 | x_1 | sanitizer.py:33 | Taint SQL injection |
| sanitizer.py:33 | x_2 | sanitizer.py:33 | Taint Command injection |
| sanitizer.py:33 | x_2 | sanitizer.py:33 | Taint SQL injection |
| sanitizer.py:35 | x_3 | sanitizer.py:35 | Taint Command injection |
| sanitizer.py:35 | x_3 | sanitizer.py:35 | Taint SQL injection |
| sanitizer.py:35 | x_4 | sanitizer.py:35 | Taint Command injection |
| sanitizer.py:35 | x_4 | sanitizer.py:35 | Taint SQL injection |
| test.py:6 | s_0 | test.py:6 | Taint simple.test |
| test.py:7 | s_1 | test.py:7 | Taint simple.test |
| test.py:12 | arg_0 | test.py:12 | Taint simple.test |
| test.py:13 | arg_1 | test.py:13 | Taint simple.test |
| test.py:16 | t_0 | test.py:16 | Taint simple.test |
| test.py:17 | t_1 | test.py:17 | Taint simple.test |
| test.py:20 | t_0 | test.py:20 | Taint simple.test |
| test.py:21 | t_1 | test.py:21 | Taint simple.test |
| test.py:24 | t_0 | test.py:24 | Taint simple.test |
| test.py:25 | t_1 | test.py:25 | Taint simple.test |
| test.py:31 | t_2 | test.py:31 | Taint simple.test |
| test.py:37 | t_0 | test.py:37 | Taint simple.test |
| test.py:41 | t_1 | test.py:41 | Taint simple.test |
| test.py:46 | arg_0 | test.py:46 | Taint simple.test |
| test.py:47 | arg_1 | test.py:47 | Taint simple.test |
| test.py:49 | arg_0 | test.py:49 | Taint simple.test |
| test.py:49 | arg_2 | test.py:49 | Taint simple.test |
| test.py:51 | arg_1 | test.py:51 | Taint simple.test |
| test.py:54 | t_0 | test.py:54 | Taint simple.test |
| test.py:55 | t_1 | test.py:55 | Taint simple.test |
| test.py:62 | t_1 | test.py:62 | Taint simple.test |
| test.py:63 | t_2 | test.py:63 | Taint simple.test |
| test.py:67 | t_0 | test.py:67 | Taint simple.test |
| test.py:70 | t_2 | test.py:70 | Taint simple.test |
| test.py:72 | arg_0 | test.py:72 | Taint .x = simple.test |
| test.py:72 | arg_0 | test.py:72 | Taint basic.custom |
| test.py:72 | arg_0 | test.py:72 | Taint simple.test |
| test.py:76 | t_0 | test.py:76 | Taint simple.test |
| test.py:77 | t_1 | test.py:77 | Taint simple.test |
| test.py:78 | t_2 | test.py:78 | Taint simple.test |
| test.py:85 | module_0 | test.py:85 | Taint .dangerous = simple.test |
| test.py:87 | module_1 | test.py:87 | Taint .dangerous = simple.test |
| test.py:88 | t_0 | test.py:88 | Taint simple.test |
| test.py:89 | t_1 | test.py:89 | Taint simple.test |
| test.py:91 | module_2 | test.py:91 | Taint .dangerous = simple.test |
| test.py:95 | module_3 | test.py:95 | Taint .dangerous = simple.test |
| test.py:99 | module_4 | test.py:99 | Taint .dangerous = simple.test |
| test.py:100 | t_0 | test.py:100 | Taint simple.test |
| test.py:101 | t_1 | test.py:101 | Taint simple.test |
| test.py:105 | arg_0 | test.py:105 | Taint .x = simple.test |
| test.py:108 | module_5 | test.py:108 | Taint .dangerous = simple.test |
| test.py:110 | t_1 | test.py:110 | Taint .x = simple.test |
| test.py:113 | module_6 | test.py:113 | Taint .dangerous = simple.test |
| test.py:115 | t_1 | test.py:115 | Taint .x = simple.test |
| test.py:116 | t_2 | test.py:116 | Taint .x = simple.test |
| test.py:117 | t_3 | test.py:117 | Taint .x = simple.test |
| test.py:120 | t_0 | test.py:120 | Taint basic.custom |
| test.py:121 | t_1 | test.py:121 | Taint basic.custom |
| test.py:122 | t_2 | test.py:122 | Taint basic.custom |
| test.py:126 | t_0 | test.py:126 | Taint basic.custom |
| test.py:128 | t_2 | test.py:128 | Taint simple.test |
| test.py:130 | t_1 | test.py:130 | Taint basic.custom |
| test.py:132 | t_3 | test.py:132 | Taint simple.test |
| test.py:136 | t_0 | test.py:136 | Taint basic.custom |
| test.py:138 | t_2 | test.py:138 | Taint simple.test |
| test.py:140 | t_3 | test.py:140 | Taint simple.test |
| test.py:142 | t_1 | test.py:142 | Taint basic.custom |
| test.py:146 | t_0 | test.py:146 | Taint basic.custom |
| test.py:148 | t_3 | test.py:148 | Taint simple.test |
| test.py:149 | t_1 | test.py:149 | Taint basic.custom |
| test.py:151 | t_2 | test.py:151 | Taint basic.custom |
| test.py:155 | unsafe_0 | test.py:155 | Taint simple.test |
| test.py:156 | unsafe_1 | test.py:156 | Taint simple.test |
| test.py:159 | t_0 | test.py:159 | Taint simple.test |
| test.py:160 | t_1 | test.py:160 | Taint simple.test |
| test.py:163 | s_0 | test.py:163 | Taint simple.test |
| test.py:168 | l_0 | test.py:168 | Taint sequence of simple.test |
| test.py:169 | d_0 | test.py:169 | Taint dict of simple.test |
| test.py:170 | l_1 | test.py:170 | Taint sequence of simple.test |
| test.py:170 | x_1 | test.py:170 | Taint sequence of simple.test |
| test.py:171 | d_1 | test.py:171 | Taint dict of simple.test |
| test.py:171 | y_1 | test.py:171 | Taint dict of simple.test |
| test.py:174 | l2_0 | test.py:174 | Taint sequence of simple.test |
| test.py:174 | l_2 | test.py:174 | Taint sequence of simple.test |
| test.py:175 | d2_0 | test.py:175 | Taint dict of simple.test |
| test.py:175 | d_2 | test.py:175 | Taint dict of simple.test |
| test.py:178 | t_0 | test.py:178 | Taint simple.test |
| test.py:180 | t_1 | test.py:180 | Taint simple.test |
| test.py:180 | t_2 | test.py:180 | Taint simple.test |
| test.py:183 | t_3 | test.py:183 | Taint simple.test |
| test.py:186 | t_4 | test.py:186 | Taint simple.test |
| test.py:189 | t_0 | test.py:189 | Taint falsey |
| test.py:191 | t_1 | test.py:191 | Taint falsey |
| test.py:194 | t_5 | test.py:194 | Taint simple.test |
| test.py:195 | t_0 | test.py:195 | Taint simple.test |
| test.py:197 | t_1 | test.py:197 | Taint simple.test |
| test.py:197 | t_2 | test.py:197 | Taint simple.test |
| test.py:199 | t_3 | test.py:199 | Taint simple.test |
| test.py:199 | t_4 | test.py:199 | Taint simple.test |
| test.py:202 | t_0 | test.py:202 | Taint iterable.simple |
| test.py:203 | i_1 | test.py:203 | Taint simple.test |
| test.py:203 | i_2 | test.py:203 | Taint simple.test |
| test.py:208 | seq_0 | test.py:208 | Taint sequence of simple.test |
| test.py:209 | i_1 | test.py:209 | Taint simple.test |
| test.py:209 | i_2 | test.py:209 | Taint simple.test |
| test.py:213 | x_0 | test.py:213 | Taint simple.test |
| test.py:213 | x_1 | test.py:213 | Taint simple.test |
| test.py:214 | x_2 | test.py:214 | Taint simple.test |

4
python/ql/test/library-tests/taint/general/TestVar.ql
View File

@@ -4,6 +4,6 @@ import TaintLib
from EssaVariable var, TaintedNode n
where TaintFlowTest::tainted_var(var, _, n)
where n.getNode().asVariable() = var
select
var.getDefinition().getLocation().toString(), var.getRepresentation(), n.getLocation().toString(), n.getTrackedValue(), n.getNode().getNode().toString()
var.getDefinition().getLocation().toString(), var.getRepresentation(), n.getLocation().toString(), "Taint " + n.toString()

1
python/ql/test/library-tests/taint/invalid/NoSink.expected
View File

@@ -1 +0,0 @@
| No sinks defined | This message wouldn't appear if the query were complete $@ | No sinks defined | nor this |

25
python/ql/test/library-tests/taint/invalid/NoSink.ql
View File

@@ -1,25 +0,0 @@
import python
import semmle.python.security.TaintTracking
/* Sources */
class AnySource extends TaintSource {
AnySource() {
this instanceof ControlFlowNode
}
override predicate isSourceOf(TaintKind kind) { any() }
}
/* Flow */
import semmle.python.security.strings.Untrusted
from TaintSource src, TaintSink sink
where src.flowsToSink(sink)
select sink.toString(), "This message wouldn't appear if the query were complete $@",
src.toString(), "nor this"

1
python/ql/test/library-tests/taint/invalid/NoSource.expected
View File

@@ -1 +0,0 @@
| No sources defined | This message wouldn't appear if the query were complete $@ | No sources defined | nor this |

26
python/ql/test/library-tests/taint/invalid/NoSource.ql
View File

@@ -1,26 +0,0 @@
import python
import semmle.python.security.TaintTracking
/* Flow */
import semmle.python.security.strings.Untrusted
/* Sinks */
class AnySink extends TaintSink{
AnySink() {
this instanceof ControlFlowNode
}
override predicate sinks(TaintKind kind) { any() }
}
from TaintSource src, TaintSink sink
where src.flowsToSink(sink)
select sink.toString(), "This message wouldn't appear if the query were complete $@",
src.toString(), "nor this"

0
python/ql/test/library-tests/taint/invalid/test.py
View File

20
python/ql/test/library-tests/taint/strings/DistinctStringKinds.expected
View File

@@ -1,16 +1,16 @@
| Taint exception.info | test.py:54 | test.py:54:22:54:26 | taint | test.py:59 |
| Taint exception.info | test.py:55 | test.py:55:12:55:22 | func() | test.py:59 |
| Taint exception.info | test.py:55 | test.py:55:17:55:21 | taint | test.py:59 |
| Taint exception.info | test.py:54 | test.py:54:22:54:26 | taint | p1 = exception.info |
| Taint exception.info | test.py:55 | test.py:55:12:55:22 | func() | p1 = exception.info |
| Taint exception.info | test.py:55 | test.py:55:17:55:21 | taint | p1 = exception.info |
| Taint exception.info | test.py:58 | test.py:58:12:58:33 | TAINTED_EXCEPTION_INFO | |
| Taint exception.info | test.py:59 | test.py:59:11:59:41 | cross_over() | |
| Taint exception.info | test.py:59 | test.py:59:37:59:40 | info | |
| Taint exception.info | test.py:61 | test.py:61:19:61:21 | arg | test.py:55 from test.py:59 |
| Taint exception.info | test.py:62 | test.py:62:12:62:14 | arg | test.py:55 from test.py:59 |
| Taint externally controlled string | test.py:54 | test.py:54:22:54:26 | taint | test.py:66 |
| Taint externally controlled string | test.py:55 | test.py:55:12:55:22 | func() | test.py:66 |
| Taint externally controlled string | test.py:55 | test.py:55:17:55:21 | taint | test.py:66 |
| Taint externally controlled string | test.py:61 | test.py:61:19:61:21 | arg | test.py:55 from test.py:66 |
| Taint externally controlled string | test.py:62 | test.py:62:12:62:14 | arg | test.py:55 from test.py:66 |
| Taint exception.info | test.py:61 | test.py:61:19:61:21 | arg | p0 = exception.info |
| Taint exception.info | test.py:62 | test.py:62:12:62:14 | arg | p0 = exception.info |
| Taint externally controlled string | test.py:54 | test.py:54:22:54:26 | taint | p1 = externally controlled string |
| Taint externally controlled string | test.py:55 | test.py:55:12:55:22 | func() | p1 = externally controlled string |
| Taint externally controlled string | test.py:55 | test.py:55:17:55:21 | taint | p1 = externally controlled string |
| Taint externally controlled string | test.py:61 | test.py:61:19:61:21 | arg | p0 = externally controlled string |
| Taint externally controlled string | test.py:62 | test.py:62:12:62:14 | arg | p0 = externally controlled string |
| Taint externally controlled string | test.py:65 | test.py:65:11:65:33 | TAINTED_EXTERNAL_STRING | |
| Taint externally controlled string | test.py:66 | test.py:66:11:66:41 | cross_over() | |
| Taint externally controlled string | test.py:66 | test.py:66:38:66:40 | ext | |

3
python/ql/test/library-tests/taint/strings/DistinctStringKinds.ql
View File

@@ -32,8 +32,7 @@ class ExternalStringSource extends TaintSource {
}
}
from TaintedNode n
where n.getLocation().getFile().getName().matches("%test.py")
select n.getTrackedValue(), n.getLocation().toString(), n.getAstNode(), n.getContext()
select "Taint " + n.getTaintKind(), n.getLocation().toString(), n.getAstNode(), n.getContext()

7
python/ql/test/library-tests/taint/strings/Taint.qll
View File

@@ -11,7 +11,7 @@ class SimpleSource extends TaintSource {
kind instanceof ExternalStringKind
}
string toString() {
override string toString() {
result = "taint source"
}
@@ -25,7 +25,7 @@ class ListSource extends TaintSource {
kind instanceof ExternalStringSequenceKind
}
string toString() {
override string toString() {
result = "list taint source"
}
@@ -39,9 +39,10 @@ class DictSource extends TaintSource {
kind instanceof ExternalStringDictKind
}
string toString() {
override string toString() {
result = "dict taint source"
}
}

2
python/ql/test/library-tests/taint/strings/TestNode.ql
View File

@@ -5,5 +5,5 @@ import Taint
from TaintedNode n
where n.getLocation().getFile().getName().matches("%test.py")
select n.getTrackedValue(), n.getLocation().toString(), n.getAstNode(), n.getContext()
select "Taint " + n.getTaintKind(), n.getLocation().toString(), n.getCfgNode().getNode(), n.getContext()

4
python/ql/test/library-tests/taint/strings/TestStep.ql
View File

@@ -8,6 +8,6 @@ where n.getLocation().getFile().getName().matches("%test.py") and
s.getLocation().getFile().getName().matches("%test.py") and
s = n.getASuccessor()
select
n.getTrackedValue(), n.getLocation().toString(), n.getAstNode(), n.getContext(),
"Taint " + n.getTaintKind(), n.getLocation().toString(), n.getAstNode(), n.getContext(),
" --> ",
s.getTrackedValue(), s.getLocation().toString(), s.getAstNode(), s.getContext()
"Taint " + s.getTaintKind(), s.getLocation().toString(), s.getAstNode(), s.getContext()

1
python/ql/test/library-tests/web/falcon/Sinks.expected
View File

@@ -1 +0,0 @@
| test.py:17 | Attribute() | externally controlled string |

1
python/ql/test/library-tests/web/falcon/Taint.expected
View File

@@ -8,7 +8,6 @@
| test.py:12 | resp | falcon.response |
| test.py:13 | Dict | {json[externally controlled string]} |
| test.py:15 | result | json[externally controlled string] |
| test.py:17 | resp | falcon.response |
| test.py:17 | result | {json[externally controlled string]} |
| test.py:19 | req | falcon.request |
| test.py:19 | resp | falcon.response |

12
python/ql/test/query-tests/Functions/general/ModificationOfParameterWithDefault.expected
View File

@@ -1,5 +1,4 @@
edges
| functions_test.py:36:9:36:9 | empty mutable value | functions_test.py:37:16:37:16 | empty mutable value |
| functions_test.py:39:9:39:9 | empty mutable value | functions_test.py:40:5:40:5 | empty mutable value |
| functions_test.py:238:15:238:15 | empty mutable value | functions_test.py:239:5:239:5 | empty mutable value |
| functions_test.py:290:25:290:25 | empty mutable value | functions_test.py:291:5:291:5 | empty mutable value |
@@ -8,11 +7,8 @@ edges
| functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:298:21:298:21 | empty mutable value |
| functions_test.py:297:25:297:25 | empty mutable value | functions_test.py:290:25:290:25 | empty mutable value |
| functions_test.py:298:21:298:21 | empty mutable value | functions_test.py:293:21:293:21 | empty mutable value |
| functions_test.py:300:26:300:26 | empty mutable value | functions_test.py:301:8:301:8 | empty mutable value |
| functions_test.py:300:26:300:26 | empty mutable value | functions_test.py:303:12:303:12 | empty mutable value |
| functions_test.py:305:21:305:25 | empty mutable value | functions_test.py:306:12:306:16 | empty mutable value |
#select
| functions_test.py:40:5:40:5 | Taint sink | functions_test.py:39:9:39:9 | empty mutable value | functions_test.py:40:5:40:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:39:9:39:9 | mutable default value | Default value |
| functions_test.py:239:5:239:5 | Taint sink | functions_test.py:238:15:238:15 | empty mutable value | functions_test.py:239:5:239:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:238:15:238:15 | mutable default value | Default value |
| functions_test.py:291:5:291:5 | Taint sink | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:291:5:291:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | mutable default value | Default value |
| functions_test.py:294:5:294:5 | Taint sink | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:294:5:294:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | mutable default value | Default value |
| functions_test.py:40:5:40:5 | x | functions_test.py:39:9:39:9 | empty mutable value | functions_test.py:40:5:40:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:39:9:39:9 | x | Default value |
| functions_test.py:239:5:239:5 | x | functions_test.py:238:15:238:15 | empty mutable value | functions_test.py:239:5:239:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:238:15:238:15 | x | Default value |
| functions_test.py:291:5:291:5 | x | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:291:5:291:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | y | Default value |
| functions_test.py:294:5:294:5 | x | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:294:5:294:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | y | Default value |

18
python/ql/test/query-tests/Security/CWE-022/PathInjection.expected
View File

@@ -1,30 +1,18 @@
edges
| ../lib/os/path.py:4:14:4:14 | externally controlled string | ../lib/os/path.py:5:12:5:12 | externally controlled string |
| ../lib/os/path.py:4:14:4:14 | externally controlled string | ../lib/os/path.py:5:12:5:12 | externally controlled string |
| ../lib/os/path.py:4:14:4:14 | externally controlled string | ../lib/os/path.py:5:12:5:12 | externally controlled string |
| path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:9:12:9:39 | externally controlled string |
| path_injection.py:9:12:9:39 | externally controlled string | path_injection.py:10:40:10:43 | externally controlled string |
| path_injection.py:10:40:10:43 | externally controlled string | path_injection.py:10:14:10:44 | externally controlled string |
| path_injection.py:15:12:15:23 | dict of externally controlled string | path_injection.py:15:12:15:39 | externally controlled string |
| path_injection.py:15:12:15:39 | externally controlled string | path_injection.py:16:56:16:59 | externally controlled string |
| path_injection.py:16:13:16:61 | normalized path | path_injection.py:17:14:17:18 | normalized path |
| path_injection.py:16:30:16:60 | externally controlled string | ../lib/os/path.py:4:14:4:14 | externally controlled string |
| path_injection.py:16:30:16:60 | externally controlled string | path_injection.py:16:13:16:61 | normalized path |
| path_injection.py:16:56:16:59 | externally controlled string | path_injection.py:16:30:16:60 | externally controlled string |
| path_injection.py:24:12:24:23 | dict of externally controlled string | path_injection.py:24:12:24:39 | externally controlled string |
| path_injection.py:24:12:24:39 | externally controlled string | path_injection.py:25:56:25:59 | externally controlled string |
| path_injection.py:25:13:25:61 | normalized path | path_injection.py:26:8:26:12 | normalized path |
| path_injection.py:25:13:25:61 | normalized path | path_injection.py:28:14:28:18 | normalized path |
| path_injection.py:25:30:25:60 | externally controlled string | ../lib/os/path.py:4:14:4:14 | externally controlled string |
| path_injection.py:25:30:25:60 | externally controlled string | path_injection.py:25:13:25:61 | normalized path |
| path_injection.py:25:56:25:59 | externally controlled string | path_injection.py:25:30:25:60 | externally controlled string |
| path_injection.py:33:12:33:23 | dict of externally controlled string | path_injection.py:33:12:33:39 | externally controlled string |
| path_injection.py:33:12:33:39 | externally controlled string | path_injection.py:34:56:34:59 | externally controlled string |
| path_injection.py:34:13:34:61 | normalized path | path_injection.py:35:8:35:12 | normalized path |
| path_injection.py:34:30:34:60 | externally controlled string | ../lib/os/path.py:4:14:4:14 | externally controlled string |
| path_injection.py:34:30:34:60 | externally controlled string | path_injection.py:34:13:34:61 | normalized path |
| path_injection.py:34:56:34:59 | externally controlled string | path_injection.py:34:30:34:60 | externally controlled string |
#select
| path_injection.py:10:14:10:44 | argument to open() | path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:10:14:10:44 | externally controlled string | This path depends on $@. | path_injection.py:9:12:9:23 | flask.request.args | a user-provided value |
| path_injection.py:17:14:17:18 | argument to open() | path_injection.py:15:12:15:23 | dict of externally controlled string | path_injection.py:17:14:17:18 | normalized path | This path depends on $@. | path_injection.py:15:12:15:23 | flask.request.args | a user-provided value |
| path_injection.py:28:14:28:18 | argument to open() | path_injection.py:24:12:24:23 | dict of externally controlled string | path_injection.py:28:14:28:18 | normalized path | This path depends on $@. | path_injection.py:24:12:24:23 | flask.request.args | a user-provided value |
| path_injection.py:10:14:10:44 | Attribute() | path_injection.py:9:12:9:23 | dict of externally controlled string | path_injection.py:10:14:10:44 | externally controlled string | This path depends on $@. | path_injection.py:9:12:9:23 | Attribute | a user-provided value |
| path_injection.py:17:14:17:18 | npath | path_injection.py:15:12:15:23 | dict of externally controlled string | path_injection.py:17:14:17:18 | normalized path | This path depends on $@. | path_injection.py:15:12:15:23 | Attribute | a user-provided value |
| path_injection.py:28:14:28:18 | npath | path_injection.py:24:12:24:23 | dict of externally controlled string | path_injection.py:28:14:28:18 | normalized path | This path depends on $@. | path_injection.py:24:12:24:23 | Attribute | a user-provided value |

25
python/ql/test/query-tests/Security/CWE-022/TarSlip.expected
View File

@@ -1,31 +1,14 @@
edges
| tarslip.py:12:7:12:39 | tarfile.open | tarslip.py:13:1:13:3 | tarfile.open |
| tarslip.py:12:7:12:39 | tarfile.open | tarslip.py:14:1:14:3 | tarfile.open |
| tarslip.py:16:7:16:39 | tarfile.open | tarslip.py:17:14:17:16 | tarfile.open |
| tarslip.py:16:7:16:39 | tarfile.open | tarslip.py:18:5:18:7 | tarfile.open |
| tarslip.py:17:1:17:17 | tarfile.entry | tarslip.py:18:17:18:21 | tarfile.entry |
| tarslip.py:17:14:17:16 | tarfile.open | tarslip.py:17:1:17:17 | tarfile.entry |
| tarslip.py:26:7:26:39 | tarfile.open | tarslip.py:27:14:27:16 | tarfile.open |
| tarslip.py:26:7:26:39 | tarfile.open | tarslip.py:30:5:30:7 | tarfile.open |
| tarslip.py:27:1:27:17 | tarfile.entry | tarslip.py:28:22:28:26 | tarfile.entry |
| tarslip.py:27:14:27:16 | tarfile.open | tarslip.py:27:1:27:17 | tarfile.entry |
| tarslip.py:28:22:28:26 | tarfile.entry | tarslip.py:28:22:28:31 | tarfile.entry |
| tarslip.py:33:7:33:39 | tarfile.open | tarslip.py:34:14:34:16 | tarfile.open |
| tarslip.py:33:7:33:39 | tarfile.open | tarslip.py:37:5:37:7 | tarfile.open |
| tarslip.py:34:1:34:17 | tarfile.entry | tarslip.py:35:16:35:20 | tarfile.entry |
| tarslip.py:34:1:34:17 | tarfile.entry | tarslip.py:37:17:37:21 | tarfile.entry |
| tarslip.py:34:14:34:16 | tarfile.open | tarslip.py:34:1:34:17 | tarfile.entry |
| tarslip.py:35:16:35:20 | tarfile.entry | tarslip.py:35:16:35:25 | tarfile.entry |
| tarslip.py:40:7:40:39 | tarfile.open | tarslip.py:41:1:41:3 | tarfile.open |
| tarslip.py:40:7:40:39 | tarfile.open | tarslip.py:41:24:41:26 | tarfile.open |
| tarslip.py:45:17:45:23 | tarfile.open | tarslip.py:46:17:46:23 | tarfile.open |
| tarslip.py:46:5:46:24 | tarfile.entry | tarslip.py:47:20:47:23 | tarfile.entry |
| tarslip.py:46:17:46:23 | tarfile.open | tarslip.py:46:5:46:24 | tarfile.entry |
| tarslip.py:51:7:51:39 | tarfile.open | tarslip.py:52:1:52:3 | tarfile.open |
| tarslip.py:51:7:51:39 | tarfile.open | tarslip.py:52:36:52:38 | tarfile.open |
| tarslip.py:52:36:52:38 | tarfile.open | tarslip.py:45:17:45:23 | tarfile.open |
#select
| tarslip.py:13:1:13:3 | Taint sink | tarslip.py:12:7:12:39 | tarfile.open | tarslip.py:13:1:13:3 | tarfile.open | Extraction of tarfile from $@ | tarslip.py:12:7:12:39 | Taint source | a potentially untrusted source |
| tarslip.py:18:17:18:21 | Taint sink | tarslip.py:16:7:16:39 | tarfile.open | tarslip.py:18:17:18:21 | tarfile.entry | Extraction of tarfile from $@ | tarslip.py:16:7:16:39 | Taint source | a potentially untrusted source |
| tarslip.py:37:17:37:21 | Taint sink | tarslip.py:33:7:33:39 | tarfile.open | tarslip.py:37:17:37:21 | tarfile.entry | Extraction of tarfile from $@ | tarslip.py:33:7:33:39 | Taint source | a potentially untrusted source |
| tarslip.py:41:24:41:26 | Taint sink | tarslip.py:40:7:40:39 | tarfile.open | tarslip.py:41:24:41:26 | tarfile.open | Extraction of tarfile from $@ | tarslip.py:40:7:40:39 | Taint source | a potentially untrusted source |
| tarslip.py:13:1:13:3 | tar | tarslip.py:12:7:12:39 | tarfile.open | tarslip.py:13:1:13:3 | tarfile.open | Extraction of tarfile from $@ | tarslip.py:12:7:12:39 | Attribute() | a potentially untrusted source |
| tarslip.py:18:17:18:21 | entry | tarslip.py:16:7:16:39 | tarfile.open | tarslip.py:18:17:18:21 | tarfile.entry | Extraction of tarfile from $@ | tarslip.py:16:7:16:39 | Attribute() | a potentially untrusted source |
| tarslip.py:37:17:37:21 | entry | tarslip.py:33:7:33:39 | tarfile.open | tarslip.py:37:17:37:21 | tarfile.entry | Extraction of tarfile from $@ | tarslip.py:33:7:33:39 | Attribute() | a potentially untrusted source |
| tarslip.py:41:24:41:26 | tar | tarslip.py:40:7:40:39 | tarfile.open | tarslip.py:41:24:41:26 | tarfile.open | Extraction of tarfile from $@ | tarslip.py:40:7:40:39 | Attribute() | a potentially untrusted source |

9
python/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
View File

@@ -8,12 +8,11 @@ edges
| command_injection.py:24:11:24:22 | dict of externally controlled string | command_injection.py:24:11:24:37 | externally controlled string |
| command_injection.py:24:11:24:37 | externally controlled string | command_injection.py:25:23:25:25 | externally controlled string |
| command_injection.py:25:23:25:25 | externally controlled string | command_injection.py:25:22:25:36 | first item in sequence of externally controlled string |
| command_injection.py:25:23:25:25 | externally controlled string | command_injection.py:25:22:25:36 | sequence of externally controlled string |
| command_injection.py:30:13:30:24 | dict of externally controlled string | command_injection.py:30:13:30:41 | externally controlled string |
| command_injection.py:30:13:30:41 | externally controlled string | command_injection.py:32:22:32:26 | externally controlled string |
| command_injection.py:32:22:32:26 | externally controlled string | command_injection.py:32:14:32:26 | externally controlled string |
#select
| command_injection.py:12:15:12:27 | shell command | command_injection.py:10:13:10:24 | dict of externally controlled string | command_injection.py:12:15:12:27 | externally controlled string | This command depends on $@. | command_injection.py:10:13:10:24 | flask.request.args | a user-provided value |
| command_injection.py:19:22:19:34 | shell command | command_injection.py:17:13:17:24 | dict of externally controlled string | command_injection.py:19:22:19:34 | sequence of externally controlled string | This command depends on $@. | command_injection.py:17:13:17:24 | flask.request.args | a user-provided value |
| command_injection.py:25:22:25:36 | OS command first argument | command_injection.py:24:11:24:22 | dict of externally controlled string | command_injection.py:25:22:25:36 | first item in sequence of externally controlled string | This command depends on $@. | command_injection.py:24:11:24:22 | flask.request.args | a user-provided value |
| command_injection.py:32:14:32:26 | shell command | command_injection.py:30:13:30:24 | dict of externally controlled string | command_injection.py:32:14:32:26 | externally controlled string | This command depends on $@. | command_injection.py:30:13:30:24 | flask.request.args | a user-provided value |
| command_injection.py:12:15:12:27 | BinaryExpr | command_injection.py:10:13:10:24 | dict of externally controlled string | command_injection.py:12:15:12:27 | externally controlled string | This command depends on $@. | command_injection.py:10:13:10:24 | Attribute | a user-provided value |
| command_injection.py:19:22:19:34 | List | command_injection.py:17:13:17:24 | dict of externally controlled string | command_injection.py:19:22:19:34 | sequence of externally controlled string | This command depends on $@. | command_injection.py:17:13:17:24 | Attribute | a user-provided value |
| command_injection.py:25:22:25:36 | List | command_injection.py:24:11:24:22 | dict of externally controlled string | command_injection.py:25:22:25:36 | first item in sequence of externally controlled string | This command depends on $@. | command_injection.py:24:11:24:22 | Attribute | a user-provided value |
| command_injection.py:32:14:32:26 | BinaryExpr | command_injection.py:30:13:30:24 | dict of externally controlled string | command_injection.py:32:14:32:26 | externally controlled string | This command depends on $@. | command_injection.py:30:13:30:24 | Attribute | a user-provided value |

9
python/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected
View File

@@ -1,15 +1,8 @@
edges
| ../lib/flask/__init__.py:14:19:14:20 | externally controlled string | ../lib/flask/__init__.py:15:19:15:20 | externally controlled string |
| ../lib/flask/__init__.py:14:19:14:20 | externally controlled string | ../lib/flask/__init__.py:16:25:16:26 | externally controlled string |
| ../lib/flask/__init__.py:22:12:22:14 | externally controlled string | ../lib/flask/__init__.py:23:26:23:28 | externally controlled string |
| jinja2_escaping.py:14:12:14:23 | dict of externally controlled string | jinja2_escaping.py:14:12:14:39 | externally controlled string |
| jinja2_escaping.py:14:12:14:39 | externally controlled string | jinja2_escaping.py:16:47:16:50 | externally controlled string |
| reflected_xss.py:7:18:7:29 | dict of externally controlled string | reflected_xss.py:7:18:7:45 | externally controlled string |
| reflected_xss.py:7:18:7:45 | externally controlled string | reflected_xss.py:8:44:8:53 | externally controlled string |
| reflected_xss.py:8:26:8:53 | externally controlled string | ../lib/flask/__init__.py:14:19:14:20 | externally controlled string |
| reflected_xss.py:8:44:8:53 | externally controlled string | reflected_xss.py:8:26:8:53 | externally controlled string |
| reflected_xss.py:12:18:12:29 | dict of externally controlled string | reflected_xss.py:12:18:12:45 | externally controlled string |
| reflected_xss.py:12:18:12:45 | externally controlled string | reflected_xss.py:13:51:13:60 | externally controlled string |
| reflected_xss.py:13:51:13:60 | externally controlled string | ../lib/flask/__init__.py:22:12:22:14 | externally controlled string |
#select
| ../lib/flask/__init__.py:16:25:16:26 | flask.response.argument | reflected_xss.py:7:18:7:29 | dict of externally controlled string | ../lib/flask/__init__.py:16:25:16:26 | externally controlled string | Cross-site scripting vulnerability due to $@. | reflected_xss.py:7:18:7:29 | flask.request.args | user-provided value |
| ../lib/flask/__init__.py:16:25:16:26 | rv | reflected_xss.py:7:18:7:29 | dict of externally controlled string | ../lib/flask/__init__.py:16:25:16:26 | externally controlled string | Cross-site scripting vulnerability due to $@. | reflected_xss.py:7:18:7:29 | Attribute | user-provided value |

15
python/ql/test/query-tests/Security/CWE-089/SqlInjection.expected
View File

@@ -1,24 +1,17 @@
edges
| sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:11:8:11:14 | django.request.HttpRequest |
| sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:12:16:12:22 | django.request.HttpRequest |
| sql_injection.py:12:16:12:22 | django.request.HttpRequest | sql_injection.py:12:16:12:27 | django.http.request.QueryDict |
| sql_injection.py:12:16:12:27 | django.http.request.QueryDict | sql_injection.py:12:16:12:39 | externally controlled string |
| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:16:62:16:65 | externally controlled string |
| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:19:63:19:66 | externally controlled string |
| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:22:88:22:91 | externally controlled string |
| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:23:76:23:79 | externally controlled string |
| sql_injection.py:12:16:12:39 | externally controlled string | sql_injection.py:24:78:24:81 | externally controlled string |
| sql_injection.py:13:16:13:34 | django.db.connection.cursor | sql_injection.py:15:9:15:12 | django.db.connection.cursor |
| sql_injection.py:13:16:13:34 | django.db.connection.cursor | sql_injection.py:18:9:18:12 | django.db.connection.cursor |
| sql_injection.py:19:63:19:66 | externally controlled string | sql_injection.py:19:13:19:66 | externally controlled string |
| sql_injection.py:22:9:22:20 | django.db.models.Model.objects | sql_injection.py:22:9:22:93 | django.db.models.Model.objects |
| sql_injection.py:22:88:22:91 | externally controlled string | sql_injection.py:22:38:22:91 | externally controlled string |
| sql_injection.py:23:9:23:20 | django.db.models.Model.objects | sql_injection.py:23:9:23:80 | django.db.models.Model.objects |
| sql_injection.py:23:76:23:79 | externally controlled string | sql_injection.py:23:26:23:79 | externally controlled string |
| sql_injection.py:24:9:24:20 | django.db.models.Model.objects | sql_injection.py:24:9:24:82 | django.db.models.Model.objects |
| sql_injection.py:24:78:24:81 | externally controlled string | sql_injection.py:24:28:24:81 | externally controlled string |
#select
| sql_injection.py:19:13:19:66 | db.connection.execute | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:19:13:19:66 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | Django request source | a user-provided value |
| sql_injection.py:22:38:22:91 | django.db.models.expressions.RawSQL(sink,...) | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:22:38:22:91 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | Django request source | a user-provided value |
| sql_injection.py:23:26:23:79 | django.models.QuerySet.raw(sink,...) | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:23:26:23:79 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | Django request source | a user-provided value |
| sql_injection.py:24:28:24:81 | django.models.QuerySet.extra(sink,...) | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:24:28:24:81 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | Django request source | a user-provided value |
| sql_injection.py:19:13:19:66 | BinaryExpr | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:19:13:19:66 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | request | a user-provided value |
| sql_injection.py:22:38:22:91 | BinaryExpr | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:22:38:22:91 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | request | a user-provided value |
| sql_injection.py:23:26:23:79 | BinaryExpr | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:23:26:23:79 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | request | a user-provided value |
| sql_injection.py:24:28:24:81 | BinaryExpr | sql_injection.py:9:15:9:21 | django.request.HttpRequest | sql_injection.py:24:28:24:81 | externally controlled string | This SQL query depends on $@. | sql_injection.py:9:15:9:21 | request | a user-provided value |

4
python/ql/test/query-tests/Security/CWE-094/CodeInjection.expected
View File

@@ -1,10 +1,8 @@
edges
| code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:5:8:5:14 | django.request.HttpRequest |
| code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:6:22:6:28 | django.request.HttpRequest |
| code_injection.py:6:22:6:28 | django.request.HttpRequest | code_injection.py:6:22:6:33 | django.http.request.QueryDict |
| code_injection.py:6:22:6:33 | django.http.request.QueryDict | code_injection.py:6:22:6:55 | externally controlled string |
| code_injection.py:6:22:6:55 | externally controlled string | code_injection.py:7:34:7:43 | externally controlled string |
| code_injection.py:7:34:7:43 | externally controlled string | ../lib/base64.py:1:18:1:18 | externally controlled string |
| code_injection.py:7:34:7:43 | externally controlled string | code_injection.py:7:14:7:44 | externally controlled string |
#select
| code_injection.py:7:14:7:44 | exec or eval | code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:7:14:7:44 | externally controlled string | $@ flows to here and is interpreted as code. | code_injection.py:4:20:4:26 | Django request source | User-provided value |
| code_injection.py:7:14:7:44 | Attribute() | code_injection.py:4:20:4:26 | django.request.HttpRequest | code_injection.py:7:14:7:44 | externally controlled string | $@ flows to here and is interpreted as code. | code_injection.py:4:20:4:26 | request | User-provided value |

9
python/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
View File

@@ -1,9 +1,6 @@
edges
| test.py:33:15:33:36 | exception info | test.py:34:29:34:31 | exception info |
| test.py:34:29:34:31 | exception info | test.py:36:18:36:20 | exception info |
| test.py:36:18:36:20 | exception info | test.py:37:25:37:27 | exception info |
| test.py:37:12:37:27 | exception info | test.py:34:16:34:32 | exception info |
| test.py:37:25:37:27 | exception info | test.py:37:12:37:27 | exception info |
| test.py:34:29:34:31 | exception info | test.py:34:16:34:32 | exception info |
#select
| test.py:16:16:16:37 | flask.routed.response | test.py:16:16:16:37 | exception info | test.py:16:16:16:37 | exception info | $@ may be exposed to an external user | test.py:16:16:16:37 | exception.info.source | Error information |
| test.py:34:16:34:32 | flask.routed.response | test.py:33:15:33:36 | exception info | test.py:34:16:34:32 | exception info | $@ may be exposed to an external user | test.py:33:15:33:36 | exception.info.source | Error information |
| test.py:16:16:16:37 | Attribute() | test.py:16:16:16:37 | exception info | test.py:16:16:16:37 | exception info | $@ may be exposed to an external user | test.py:16:16:16:37 | Attribute() | Error information |
| test.py:34:16:34:32 | format_error() | test.py:33:15:33:36 | exception info | test.py:34:16:34:32 | exception info | $@ may be exposed to an external user | test.py:33:15:33:36 | Attribute() | Error information |

11
python/ql/test/query-tests/Security/CWE-327/TestNode.expected
View File

@@ -5,14 +5,3 @@
| Taint cryptography.encryptor.RC4 | test_cryptography.py:7:17:7:34 | test_cryptography.py:7 | test_cryptography.py:7:17:7:34 | Attribute() | |
| Taint cryptography.encryptor.RC4 | test_cryptography.py:8:12:8:20 | test_cryptography.py:8 | test_cryptography.py:8:12:8:20 | encryptor | |
| Taint cryptography.encryptor.RC4 | test_cryptography.py:8:42:8:50 | test_cryptography.py:8 | test_cryptography.py:8:42:8:50 | encryptor | |
| Taint sensitive.data.certificate | InsecureProtocol.py:6:1:6:47 | InsecureProtocol.py:6 | InsecureProtocol.py:6:1:6:47 | Attribute() | |
| Taint sensitive.data.certificate | InsecureProtocol.py:7:1:7:47 | InsecureProtocol.py:7 | InsecureProtocol.py:7:1:7:47 | Attribute() | |
| Taint sensitive.data.certificate | InsecureProtocol.py:8:1:8:47 | InsecureProtocol.py:8 | InsecureProtocol.py:8:1:8:47 | Attribute() | |
| Taint sensitive.data.certificate | InsecureProtocol.py:36:1:36:49 | InsecureProtocol.py:36 | InsecureProtocol.py:36:1:36:49 | Attribute() | |
| Taint sensitive.data.certificate | InsecureProtocol.py:41:1:41:17 | InsecureProtocol.py:41 | InsecureProtocol.py:41:1:41:17 | Attribute() | |
| Taint sensitive.data.certificate | InsecureProtocol.py:48:1:48:43 | InsecureProtocol.py:48 | InsecureProtocol.py:48:1:48:43 | Attribute() | |
| Taint sensitive.data.password | test_cryptography.py:5:17:5:30 | test_cryptography.py:5 | test_cryptography.py:5:17:5:30 | get_password() | |
| Taint sensitive.data.password | test_cryptography.py:8:29:8:37 | test_cryptography.py:8 | test_cryptography.py:8:29:8:37 | dangerous | |
| Taint sensitive.data.password | test_cryptography.py:8:42:8:50 | test_cryptography.py:8 | test_cryptography.py:8:42:8:50 | encryptor | |
| Taint sensitive.data.password | test_pycrypto.py:5:17:5:30 | test_pycrypto.py:5 | test_pycrypto.py:5:17:5:30 | get_password() | |
| Taint sensitive.data.password | test_pycrypto.py:7:27:7:35 | test_pycrypto.py:7 | test_pycrypto.py:7:27:7:35 | dangerous | |

2
python/ql/test/query-tests/Security/CWE-327/TestNode.ql
View File

@@ -7,4 +7,4 @@ import semmle.python.security.Crypto
from TaintedNode n, AstNode src
where src = n.getAstNode() and src.getLocation().getFile().getName().matches("%test%")
select n.getTrackedValue(), n.getLocation(), src, n.getContext()
select "Taint " + n.getTaintKind(), n.getLocation(), src, n.getContext()

8
python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
View File

@@ -5,7 +5,7 @@ edges
| test.py:11:15:11:41 | externally controlled string | test.py:14:19:14:25 | externally controlled string |
| test.py:11:15:11:41 | externally controlled string | test.py:16:16:16:22 | externally controlled string |
#select
| test.py:12:18:12:24 | unpickling untrusted data | test.py:11:15:11:26 | dict of externally controlled string | test.py:12:18:12:24 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | flask.request.args | untrusted input |
| test.py:13:15:13:21 | yaml.load vulnerability | test.py:11:15:11:26 | dict of externally controlled string | test.py:13:15:13:21 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | flask.request.args | untrusted input |
| test.py:14:19:14:25 | unmarshaling vulnerability | test.py:11:15:11:26 | dict of externally controlled string | test.py:14:19:14:25 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | flask.request.args | untrusted input |
| test.py:16:16:16:22 | unpickling untrusted data | test.py:11:15:11:26 | dict of externally controlled string | test.py:16:16:16:22 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | flask.request.args | untrusted input |
| test.py:12:18:12:24 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:12:18:12:24 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |
| test.py:13:15:13:21 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:13:15:13:21 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |
| test.py:14:19:14:25 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:14:19:14:25 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |
| test.py:16:16:16:22 | payload | test.py:11:15:11:26 | dict of externally controlled string | test.py:16:16:16:22 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | Attribute | untrusted input |

4
python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected
View File

@@ -1,7 +1,5 @@
edges
| test.py:7:22:7:33 | dict of externally controlled string | test.py:7:22:7:51 | externally controlled string |
| test.py:7:22:7:51 | externally controlled string | test.py:8:21:8:26 | externally controlled string |
| test.py:15:17:15:28 | dict of externally controlled string | test.py:15:17:15:42 | externally controlled string |
| test.py:15:17:15:42 | externally controlled string | test.py:17:13:17:21 | externally controlled string |
#select
| test.py:8:21:8:26 | flask.redirect | test.py:7:22:7:33 | dict of externally controlled string | test.py:8:21:8:26 | externally controlled string | Untrusted URL redirection due to $@. | test.py:7:22:7:33 | flask.request.args | a user-provided value |
| test.py:8:21:8:26 | target | test.py:7:22:7:33 | dict of externally controlled string | test.py:8:21:8:26 | externally controlled string | Untrusted URL redirection due to $@. | test.py:7:22:7:33 | Attribute | a user-provided value |