mirror of
https://github.com/github/codeql.git
synced 2026-05-05 13:45:19 +02:00
Merge pull request #7259 from RasmusWL/even-more-path-injection-sinks
Python: Add more path-injection sinks from `os` and `tempfile` modules
This commit is contained in:
yoff
@@ -276,25 +276,589 @@ private module StdlibPrivate {
|
||||
}
|
||||
|
||||
/**
|
||||
* The `os` module has multiple methods for getting the status of a file, like
|
||||
* a stat() system call.
|
||||
*
|
||||
* Note: `os.fstat` and `os.fstatvfs` operate on file-descriptors.
|
||||
*
|
||||
* See:
|
||||
* - https://docs.python.org/3.10/library/os.html#os.stat
|
||||
* - https://docs.python.org/3.10/library/os.html#os.lstat
|
||||
* - https://docs.python.org/3.10/library/os.html#os.statvfs
|
||||
* - https://docs.python.org/3.10/library/os.html#os.fstat
|
||||
* - https://docs.python.org/3.10/library/os.html#os.fstatvfs
|
||||
* Modeling of path related functions in the `os` module.
|
||||
* Wrapped in QL module to make it easy to fold/unfold.
|
||||
*/
|
||||
private class OsProbingCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsProbingCall() {
|
||||
this = os().getMember(["stat", "lstat", "statvfs", "fstat", "fstatvfs"]).getACall()
|
||||
private module OsFileSystemAccessModeling {
|
||||
/**
|
||||
* A call to the `os.fsencode` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.fsencode
|
||||
*/
|
||||
private class OsFsencodeCall extends Encoding::Range, DataFlow::CallCfgNode {
|
||||
OsFsencodeCall() { this = os().getMember("fsencode").getACall() }
|
||||
|
||||
override DataFlow::Node getAnInput() {
|
||||
result in [this.getArg(0), this.getArgByName("filename")]
|
||||
}
|
||||
|
||||
override DataFlow::Node getOutput() { result = this }
|
||||
|
||||
override string getFormat() { result = "filesystem" }
|
||||
}
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
/**
|
||||
* A call to the `os.fsdecode` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.fsdecode
|
||||
*/
|
||||
private class OsFsdecodeCall extends Decoding::Range, DataFlow::CallCfgNode {
|
||||
OsFsdecodeCall() { this = os().getMember("fsdecode").getACall() }
|
||||
|
||||
override DataFlow::Node getAnInput() {
|
||||
result in [this.getArg(0), this.getArgByName("filename")]
|
||||
}
|
||||
|
||||
override DataFlow::Node getOutput() { result = this }
|
||||
|
||||
override string getFormat() { result = "filesystem" }
|
||||
|
||||
override predicate mayExecuteInput() { none() }
|
||||
}
|
||||
|
||||
/**
|
||||
* Additional taint step from a call to the `os.fspath` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.fspath
|
||||
*/
|
||||
private class OsFspathCallAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
|
||||
override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
||||
exists(DataFlow::CallCfgNode call |
|
||||
call = os().getMember("fspath").getACall() and
|
||||
nodeFrom in [call.getArg(0), call.getArgByName("path")] and
|
||||
nodeTo = call
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.open` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.open
|
||||
*/
|
||||
private class OsOpenCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsOpenCall() { this = os().getMember("open").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.access` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.access
|
||||
*/
|
||||
private class OsAccessCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsAccessCall() { this = os().getMember("access").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chdir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chdir
|
||||
*/
|
||||
private class OsChdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChdirCall() { this = os().getMember("chdir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chflags` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chflags
|
||||
*/
|
||||
private class OsChflagsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChflagsCall() { this = os().getMember("chflags").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chmod` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chmod
|
||||
*/
|
||||
private class OsChmodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChmodCall() { this = os().getMember("chmod").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chown` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chown
|
||||
*/
|
||||
private class OsChownCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChownCall() { this = os().getMember("chown").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.chroot` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.chroot
|
||||
*/
|
||||
private class OsChrootCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsChrootCall() { this = os().getMember("chroot").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.lchflags` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.lchflags
|
||||
*/
|
||||
private class OsLchflagsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLchflagsCall() { this = os().getMember("lchflags").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.lchmod` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.lchmod
|
||||
*/
|
||||
private class OsLchmodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLchmodCall() { this = os().getMember("lchmod").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.lchown` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.lchown
|
||||
*/
|
||||
private class OsLchownCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLchownCall() { this = os().getMember("lchown").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.link` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.link
|
||||
*/
|
||||
private class OsLinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLinkCall() { this = os().getMember("link").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.listdir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.listdir
|
||||
*/
|
||||
private class OsListdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsListdirCall() { this = os().getMember("listdir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.lstat` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.lstat
|
||||
*/
|
||||
private class OsLstatCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsLstatCall() { this = os().getMember("lstat").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.mkdir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.mkdir
|
||||
*/
|
||||
private class OsMkdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsMkdirCall() { this = os().getMember("mkdir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.makedirs` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.makedirs
|
||||
*/
|
||||
private class OsMakedirsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsMakedirsCall() { this = os().getMember("makedirs").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("name")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.mkfifo` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.mkfifo
|
||||
*/
|
||||
private class OsMkfifoCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsMkfifoCall() { this = os().getMember("mkfifo").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.mknod` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.mknod
|
||||
*/
|
||||
private class OsMknodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsMknodCall() { this = os().getMember("mknod").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.pathconf` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.pathconf
|
||||
*/
|
||||
private class OsPathconfCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsPathconfCall() { this = os().getMember("pathconf").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.readlink` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.readlink
|
||||
*/
|
||||
private class OsReadlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsReadlinkCall() { this = os().getMember("readlink").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.remove` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.remove
|
||||
*/
|
||||
private class OsRemoveCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRemoveCall() { this = os().getMember("remove").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.removedirs` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.removedirs
|
||||
*/
|
||||
private class OsRemovedirsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRemovedirsCall() { this = os().getMember("removedirs").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("name")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.rename` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.rename
|
||||
*/
|
||||
private class OsRenameCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRenameCall() { this = os().getMember("rename").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.renames` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.renames
|
||||
*/
|
||||
private class OsRenamesCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRenamesCall() { this = os().getMember("renames").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("old"), this.getArg(1), this.getArgByName("new")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.replace` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.replace
|
||||
*/
|
||||
private class OsReplaceCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsReplaceCall() { this = os().getMember("replace").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.rmdir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.rmdir
|
||||
*/
|
||||
private class OsRmdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRmdirCall() { this = os().getMember("rmdir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.scandir` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.scandir
|
||||
*/
|
||||
private class OsScandirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsScandirCall() { this = os().getMember("scandir").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.stat` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.stat
|
||||
*/
|
||||
private class OsStatCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsStatCall() { this = os().getMember("stat").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.statvfs` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.statvfs
|
||||
*/
|
||||
private class OsStatvfsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsStatvfsCall() { this = os().getMember("statvfs").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.symlink` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.symlink
|
||||
*/
|
||||
private class OsSymlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsSymlinkCall() { this = os().getMember("symlink").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.truncate` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.truncate
|
||||
*/
|
||||
private class OsTruncateCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsTruncateCall() { this = os().getMember("truncate").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.unlink` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.unlink
|
||||
*/
|
||||
private class OsUnlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsUnlinkCall() { this = os().getMember("unlink").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.utime` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.utime
|
||||
*/
|
||||
private class OsUtimeCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsUtimeCall() { this = os().getMember("utime").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.walk` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.walk
|
||||
*/
|
||||
private class OsWalkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsWalkCall() { this = os().getMember("walk").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("top")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.fwalk` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.fwalk
|
||||
*/
|
||||
private class OsFwalkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsFwalkCall() { this = os().getMember("fwalk").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("top")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.getxattr` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.getxattr
|
||||
*/
|
||||
private class OsGetxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsGetxattrCall() { this = os().getMember("getxattr").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.listxattr` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.listxattr
|
||||
*/
|
||||
private class OsListxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsListxattrCall() { this = os().getMember("listxattr").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.removexattr` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.removexattr
|
||||
*/
|
||||
private class OsRemovexattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsRemovexattrCall() { this = os().getMember("removexattr").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.setxattr` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.setxattr
|
||||
*/
|
||||
private class OsSetxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsSetxattrCall() { this = os().getMember("setxattr").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.add_dll_directory` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.add_dll_directory
|
||||
*/
|
||||
private class OsAdd_dll_directoryCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsAdd_dll_directoryCall() { this = os().getMember("add_dll_directory").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to the `os.startfile` function.
|
||||
*
|
||||
* See https://docs.python.org/3/library/os.html#os.startfile
|
||||
*/
|
||||
private class OsStartfileCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
OsStartfileCall() { this = os().getMember("startfile").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -318,20 +882,26 @@ private module StdlibPrivate {
|
||||
* - https://docs.python.org/3/library/os.path.html#os.path.realpath
|
||||
*/
|
||||
private class OsPathProbingCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
string name;
|
||||
|
||||
OsPathProbingCall() {
|
||||
this =
|
||||
os::path()
|
||||
.getMember([
|
||||
// these check if the file exists
|
||||
"exists", "lexists", "isfile", "isdir", "islink", "ismount",
|
||||
// these raise errors if the file does not exist
|
||||
"getatime", "getmtime", "getctime", "getsize"
|
||||
])
|
||||
.getACall()
|
||||
name in [
|
||||
// these check if the file exists
|
||||
"exists", "lexists", "isfile", "isdir", "islink", "ismount",
|
||||
// these raise errors if the file does not exist
|
||||
"getatime", "getmtime", "getctime", "getsize"
|
||||
] and
|
||||
this = os::path().getMember(name).getACall()
|
||||
}
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
not name = "isdir" and
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
or
|
||||
// although the Python docs say the parameter is called `path`, the implementation
|
||||
// actually uses `s`.
|
||||
name = "isdir" and
|
||||
result in [this.getArg(0), this.getArgByName("s")]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -461,7 +1031,8 @@ private module StdlibPrivate {
|
||||
* A call to any of the `os.exec*` functions
|
||||
* See https://docs.python.org/3.8/library/os.html#os.execl
|
||||
*/
|
||||
private class OsExecCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
|
||||
private class OsExecCall extends SystemCommandExecution::Range, FileSystemAccess::Range,
|
||||
DataFlow::CallCfgNode {
|
||||
OsExecCall() {
|
||||
exists(string name |
|
||||
name in ["execl", "execle", "execlp", "execlpe", "execv", "execve", "execvp", "execvpe"] and
|
||||
@@ -470,13 +1041,16 @@ private module StdlibPrivate {
|
||||
}
|
||||
|
||||
override DataFlow::Node getCommand() { result = this.getArg(0) }
|
||||
|
||||
override DataFlow::Node getAPathArgument() { result = this.getCommand() }
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to any of the `os.spawn*` functions
|
||||
* See https://docs.python.org/3.8/library/os.html#os.spawnl
|
||||
*/
|
||||
private class OsSpawnCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
|
||||
private class OsSpawnCall extends SystemCommandExecution::Range, FileSystemAccess::Range,
|
||||
DataFlow::CallCfgNode {
|
||||
OsSpawnCall() {
|
||||
exists(string name |
|
||||
name in [
|
||||
@@ -486,17 +1060,28 @@ private module StdlibPrivate {
|
||||
)
|
||||
}
|
||||
|
||||
override DataFlow::Node getCommand() { result = this.getArg(1) }
|
||||
override DataFlow::Node getCommand() {
|
||||
result = this.getArg(1)
|
||||
or
|
||||
// `file` keyword argument only valid for the `v` variants, but this
|
||||
// over-approximation is not hurting anyone, and is easy to implement.
|
||||
result = this.getArgByName("file")
|
||||
}
|
||||
|
||||
override DataFlow::Node getAPathArgument() { result = this.getCommand() }
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to any of the `os.posix_spawn*` functions
|
||||
* See https://docs.python.org/3.8/library/os.html#os.posix_spawn
|
||||
*/
|
||||
private class OsPosixSpawnCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
|
||||
private class OsPosixSpawnCall extends SystemCommandExecution::Range, FileSystemAccess::Range,
|
||||
DataFlow::CallCfgNode {
|
||||
OsPosixSpawnCall() { this = os().getMember(["posix_spawn", "posix_spawnp"]).getACall() }
|
||||
|
||||
override DataFlow::Node getCommand() { result = this.getArg(0) }
|
||||
override DataFlow::Node getCommand() { result in [this.getArg(0), this.getArgByName("path")] }
|
||||
|
||||
override DataFlow::Node getAPathArgument() { result = this.getCommand() }
|
||||
}
|
||||
|
||||
/** An additional taint step for calls to `os.path.join` */
|
||||
@@ -2052,6 +2637,116 @@ private module StdlibPrivate {
|
||||
nodeTo.(UrllibParseUrlsplitCall).getUrl() = nodeFrom
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// tempfile
|
||||
// ---------------------------------------------------------------------------
|
||||
/**
|
||||
* A call to `tempfile.mkstemp`.
|
||||
*
|
||||
* See https://docs.python.org/3/library/tempfile.html#tempfile.mkstemp
|
||||
*/
|
||||
private class TempfileMkstempCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
TempfileMkstempCall() { this = API::moduleImport("tempfile").getMember("mkstemp").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("suffix"), this.getArg(1), this.getArgByName("prefix"),
|
||||
this.getArg(2), this.getArgByName("dir")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to `tempfile.NamedTemporaryFile`.
|
||||
*
|
||||
* See https://docs.python.org/3/library/tempfile.html#tempfile.NamedTemporaryFile
|
||||
*/
|
||||
private class TempfileNamedTemporaryFileCall extends FileSystemAccess::Range,
|
||||
DataFlow::CallCfgNode {
|
||||
TempfileNamedTemporaryFileCall() {
|
||||
this = API::moduleImport("tempfile").getMember("NamedTemporaryFile").getACall()
|
||||
}
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(4), this.getArgByName("suffix"), this.getArg(5), this.getArgByName("prefix"),
|
||||
this.getArg(6), this.getArgByName("dir")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to `tempfile.TemporaryFile`.
|
||||
*
|
||||
* See https://docs.python.org/3/library/tempfile.html#tempfile.TemporaryFile
|
||||
*/
|
||||
private class TempfileTemporaryFileCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
TempfileTemporaryFileCall() {
|
||||
this = API::moduleImport("tempfile").getMember("TemporaryFile").getACall()
|
||||
}
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(4), this.getArgByName("suffix"), this.getArg(5), this.getArgByName("prefix"),
|
||||
this.getArg(6), this.getArgByName("dir")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to `tempfile.SpooledTemporaryFile`.
|
||||
*
|
||||
* See https://docs.python.org/3/library/tempfile.html#tempfile.SpooledTemporaryFile
|
||||
*/
|
||||
private class TempfileSpooledTemporaryFileCall extends FileSystemAccess::Range,
|
||||
DataFlow::CallCfgNode {
|
||||
TempfileSpooledTemporaryFileCall() {
|
||||
this = API::moduleImport("tempfile").getMember("SpooledTemporaryFile").getACall()
|
||||
}
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(5), this.getArgByName("suffix"), this.getArg(6), this.getArgByName("prefix"),
|
||||
this.getArg(7), this.getArgByName("dir")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to `tempfile.mkdtemp`.
|
||||
*
|
||||
* See https://docs.python.org/3/library/tempfile.html#tempfile.mkdtemp
|
||||
*/
|
||||
private class TempfileMkdtempCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
TempfileMkdtempCall() { this = API::moduleImport("tempfile").getMember("mkdtemp").getACall() }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("suffix"), this.getArg(1), this.getArgByName("prefix"),
|
||||
this.getArg(2), this.getArgByName("dir")
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to `tempfile.TemporaryDirectory`.
|
||||
*
|
||||
* See https://docs.python.org/3/library/tempfile.html#tempfile.TemporaryDirectory
|
||||
*/
|
||||
private class TempfileTemporaryDirectoryCall extends FileSystemAccess::Range,
|
||||
DataFlow::CallCfgNode {
|
||||
TempfileTemporaryDirectoryCall() {
|
||||
this = API::moduleImport("tempfile").getMember("TemporaryDirectory").getACall()
|
||||
}
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result in [
|
||||
this.getArg(0), this.getArgByName("suffix"), this.getArg(1), this.getArgByName("prefix"),
|
||||
this.getArg(2), this.getArgByName("dir")
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
Reference in New Issue
Block a user