diff --git a/python/ql/src/experimental/semmle/python/security/ZipSlip.qll b/python/ql/src/experimental/semmle/python/security/ZipSlip.qll index 307c7ef1df0..31efe7fce0b 100644 --- a/python/ql/src/experimental/semmle/python/security/ZipSlip.qll +++ b/python/ql/src/experimental/semmle/python/security/ZipSlip.qll @@ -6,7 +6,11 @@ import semmle.python.dataflow.new.TaintTracking class ZipSlipConfig extends TaintTracking::Configuration { ZipSlipConfig() { this = "ZipSlipConfig" } - override predicate isSource(DataFlow::Node source) { source = any(CopyFile copyfile).getAPathArgument() } - - override predicate isSink(DataFlow::Node sink) { sink = any(ZipFile zipfile).getAnInput() } + override predicate isSource(DataFlow::Node source) { + source = API::moduleImport("zipfile").getMember("ZipFile").getACall() + } + + override predicate isSink(DataFlow::Node sink) { + sink = any(CopyFile copyfile).getAPathArgument() + } }