hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update python/ql/src/experimental/Security/UnsafeUnpackQuery.qll

Browse Source 
Co-authored-by: yoff <lerchedahl@gmail.com>
This commit is contained in:
Sim4n6
2023-01-27 16:07:39 +01:00
committed by GitHub
parent 207ed3da9c
commit 8ef2aa00e7
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
View File

@@ -32,12 +32,13 @@ class UnsafeUnpackingConfig extends TaintTracking::Configuration {
or
// A source catching an S3 filename download
// see boto3: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3.html#S3.Client.download_file
exists(MethodCallNode mcn, Node s3, Node bc |
bc = API::moduleImport("boto3").getMember("client").getACall() and
bc = s3.getALocalSource() and
mcn.calls(s3, "download_file") and
source = mcn.getArg(2)
)
source =
API::moduleImport("boto3")
.getMember("client")
.getReturn()
.getMember("download_file")
.getACall()
.getArg(2)
or
// A source download a file using wget
// see wget: https://pypi.org/project/wget/