hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add modeling of idna PyPI package

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-05-10 10:57:33 +02:00
parent 7ed20a8b2c
commit 8afdf26540
9 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/change-notes/2021-05-10-idna-add-modeling.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* Added modeling of the PyPI package `idna`, for encoding/decoding Internationalised Domain Names in Applications.

1
python/ql/src/semmle/python/Frameworks.qll
View File

@@ -10,6 +10,7 @@ private import semmle.python.frameworks.Dill
private import semmle.python.frameworks.Django
private import semmle.python.frameworks.Fabric
private import semmle.python.frameworks.Flask
private import semmle.python.frameworks.Idna
private import semmle.python.frameworks.Invoke
private import semmle.python.frameworks.MysqlConnectorPython
private import semmle.python.frameworks.MySQLdb

40
python/ql/src/semmle/python/frameworks/Idna.qll Normal file
View File

@@ -0,0 +1,40 @@
/**
* Provides classes modeling security-relevant aspects of the `idna` PyPI package.
* See https://pypi.org/project/idna/.
*/
private import python
private import semmle.python.dataflow.new.DataFlow
private import semmle.python.dataflow.new.TaintTracking
private import semmle.python.Concepts
private import semmle.python.ApiGraphs
/**
* Provides models for the `idna` PyPI package.
* See https://pypi.org/project/idna/.
*/
private module IdnaModel {
/** A call to `idna.encode`. */
private class IdnaEncodeCall extends Encoding::Range, DataFlow::CallCfgNode {
IdnaEncodeCall() { this = API::moduleImport("idna").getMember("encode").getACall() }
override DataFlow::Node getAnInput() { result = [this.getArg(0), this.getArgByName("s")] }
override DataFlow::Node getOutput() { result = this }
override string getFormat() { result = "IDNA" }
}
/** A call to `idna.decode`. */
private class IdnaDecodeCall extends Decoding::Range, DataFlow::CallCfgNode {
IdnaDecodeCall() { this = API::moduleImport("idna").getMember("decode").getACall() }
override DataFlow::Node getAnInput() { result = [this.getArg(0), this.getArgByName("s")] }
override DataFlow::Node getOutput() { result = this }
override string getFormat() { result = "IDNA" }
override predicate mayExecuteInput() { none() }
}
}

0
python/ql/test/library-tests/frameworks/idna/ConceptsTest.expected Normal file
View File

2
python/ql/test/library-tests/frameworks/idna/ConceptsTest.ql Normal file
View File

@@ -0,0 +1,2 @@
import python
import experimental.meta.ConceptsTest

3
python/ql/test/library-tests/frameworks/idna/InlineTaintTest.expected Normal file
View File

@@ -0,0 +1,3 @@
argumentToEnsureNotTaintedNotMarkedAsSpurious
untaintedArgumentToEnsureTaintedNotMarkedAsMissing
failures

1
python/ql/test/library-tests/frameworks/idna/InlineTaintTest.ql Normal file
View File

@@ -0,0 +1 @@
import experimental.meta.InlineTaintTest

13
python/ql/test/library-tests/frameworks/idna/taint_test.py Normal file
View File

@@ -0,0 +1,13 @@
import idna
def test_idna():
ts = TAINTED_STRING
tb = TAINTED_BYTES
ensure_tainted(
idna.encode(ts), # $ tainted encodeInput=ts encodeOutput=Attribute() encodeFormat=IDNA
idna.encode(s=ts), # $ tainted encodeInput=ts encodeOutput=Attribute() encodeFormat=IDNA
idna.decode(tb), # $ tainted decodeInput=tb decodeOutput=Attribute() decodeFormat=IDNA
idna.decode(s=tb), # $ tainted decodeInput=tb decodeOutput=Attribute() decodeFormat=IDNA
)