Restrict the reach for an additional taint step

2026-04-30 19:26:02 +02:00 · 2022-10-19 16:08:49 +01:00
parent 25a7fcffc0
commit 9163cbec09
1 changed files with 1 additions and 0 deletions
--- a/python/ql/src/experimental/Security/CWE-022bis/TarSlipImprov.ql
+++ b/python/ql/src/experimental/Security/CWE-022bis/TarSlipImprov.ql
@@ -97,6 +97,7 @@ class Configuration extends TaintTracking::Configuration {
    exists(AttrRead attr, MethodCallNode call |
      attr.accesses(nodeFrom, "getmembers") and
      nodeFrom = call.getObject() and
+      nodeFrom instanceof AllTarfileOpens and
      nodeTo = call
    )
    or