mirror of
https://github.com/github/codeql.git
synced 2025-12-19 10:23:15 +01:00
Revert "Python: Re-introduce syntactic handling of str/bytes/unicode"
This reverts commit c4987e94e0.
Hoping that our new handling of builtins would solve this problem... but
it did not :|
This commit is contained in:
@@ -77,11 +77,7 @@ predicate subscriptStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
|
||||
predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
|
||||
// transforming something tainted into a string will make the string tainted
|
||||
exists(DataFlow::CallCfgNode call | call = nodeTo |
|
||||
(
|
||||
call = API::builtin(["str", "bytes", "unicode"]).getACall()
|
||||
or
|
||||
call.getFunction().asCfgNode().(NameNode).getId() in ["str", "bytes", "unicode"]
|
||||
) and
|
||||
call = API::builtin(["str", "bytes", "unicode"]).getACall() and
|
||||
nodeFrom in [call.getArg(0), call.getArgByName("object")]
|
||||
)
|
||||
or
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
argumentToEnsureNotTaintedNotMarkedAsSpurious
|
||||
untaintedArgumentToEnsureTaintedNotMarkedAsMissing
|
||||
| test_string.py:35:9:35:19 | test_string.py:35 | ERROR, you should add `# $ MISSING: tainted` annotation | unicode(..) |
|
||||
failures
|
||||
| test_string.py:35:22:35:32 | Comment # $ tainted | Missing result:tainted= |
|
||||
|
||||
Reference in New Issue
Block a user