hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add modeling of idna PyPI package

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-05-10 10:57:33 +02:00
parent 7ed20a8b2c
commit 8afdf26540
9 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/ql/src/semmle/python/Frameworks.qll
View File

@@ -10,6 +10,7 @@ private import semmle.python.frameworks.Dill
private import semmle.python.frameworks.Django
private import semmle.python.frameworks.Fabric
private import semmle.python.frameworks.Flask
private import semmle.python.frameworks.Idna
private import semmle.python.frameworks.Invoke
private import semmle.python.frameworks.MysqlConnectorPython
private import semmle.python.frameworks.MySQLdb

40
python/ql/src/semmle/python/frameworks/Idna.qll Normal file
View File

@@ -0,0 +1,40 @@
/**
* Provides classes modeling security-relevant aspects of the `idna` PyPI package.
* See https://pypi.org/project/idna/.
*/
private import python
private import semmle.python.dataflow.new.DataFlow
private import semmle.python.dataflow.new.TaintTracking
private import semmle.python.Concepts
private import semmle.python.ApiGraphs
/**
* Provides models for the `idna` PyPI package.
* See https://pypi.org/project/idna/.
*/
private module IdnaModel {
/** A call to `idna.encode`. */
private class IdnaEncodeCall extends Encoding::Range, DataFlow::CallCfgNode {
IdnaEncodeCall() { this = API::moduleImport("idna").getMember("encode").getACall() }
override DataFlow::Node getAnInput() { result = [this.getArg(0), this.getArgByName("s")] }
override DataFlow::Node getOutput() { result = this }
override string getFormat() { result = "IDNA" }
}
/** A call to `idna.decode`. */
private class IdnaDecodeCall extends Decoding::Range, DataFlow::CallCfgNode {
IdnaDecodeCall() { this = API::moduleImport("idna").getMember("decode").getACall() }
override DataFlow::Node getAnInput() { result = [this.getArg(0), this.getArgByName("s")] }
override DataFlow::Node getOutput() { result = this }
override string getFormat() { result = "IDNA" }
override predicate mayExecuteInput() { none() }
}
}