Add sanitizers for compiled regexes

2026-02-24 02:43:40 +01:00 · 2024-06-11 15:44:16 +01:00
parent 6ff7fb2a70
commit 93f10fcf14
2 changed files with 19 additions and 0 deletions
--- a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
@@ -157,6 +157,15 @@ module ServerSideRequestForgery {
      branch = true and
      call = API::moduleImport("re").getMember(["match", "fullmatch"]).getACall() and
      strNode = [call.getArg(1), call.getArgByName("string")]
+      or
+      branch = true and
+      call =
+        API::moduleImport("re")
+            .getMember("compile")
+            .getReturn()
+            .getMember(["match", "fullmatch"])
+            .getACall() and
+      strNode = [call.getArg(0), call.getArgByName("string")]
    )
  }
 }