hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Copy template injection to standard pack + add jinja sinks

Browse Source
This commit is contained in:
Joe Farebrother
2024-11-05 17:06:53 +00:00
parent 1266b244f5
commit 8647073433
6 changed files with 106 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/src/experimental/Security/CWE-074/TemplateConstructionConcept.qll
View File

@@ -134,7 +134,12 @@ class Jinja2TemplateConstruction extends TemplateConstruction::Range, API::CallN
/** A call to `jinja2.from_string`. */
class Jinja2FromStringConstruction extends TemplateConstruction::Range, API::CallNode {
Jinja2FromStringConstruction() {
this = API::moduleImport("jinja2").getMember("from_string").getACall()
this =
API::moduleImport("jinja2")
.getMember("Environment")
.getReturn()
.getMember("from_string")
.getACall()
}
override DataFlow::Node getSourceArg() { result = this.getArg(0) }

4
python/ql/src/experimental/Security/CWE-074/TemplateInjectionCustomizations.qll
View File

@@ -6,7 +6,7 @@
private import python
private import semmle.python.dataflow.new.DataFlow
private import semmle.python.Concepts
private import semmle.python.Concepts as C
private import semmle.python.dataflow.new.RemoteFlowSources
private import semmle.python.dataflow.new.BarrierGuards
private import TemplateConstructionConcept
@@ -40,7 +40,7 @@ module TemplateInjection {
/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
private class ActiveThreatModelSourceAsSource extends Source, C::ActiveThreatModelSource { }
/**
* A SQL statement of a SQL construction, considered as a flow sink.