From a168af349ec0239bac4bd102ea03e3d0ae2935b2 Mon Sep 17 00:00:00 2001 From: Rasmus Wriedt Larsen Date: Tue, 18 Apr 2023 11:57:20 +0200 Subject: [PATCH] Python: Expand modeling of `paramiko` --- .../ql/src/Security/CWE-295/MissingHostKeyValidation.ql | 8 +++++++- .../MissingHostKeyValidation.expected | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/python/ql/src/Security/CWE-295/MissingHostKeyValidation.ql b/python/ql/src/Security/CWE-295/MissingHostKeyValidation.ql index 403c4c42d4f..91041519ba8 100644 --- a/python/ql/src/Security/CWE-295/MissingHostKeyValidation.ql +++ b/python/ql/src/Security/CWE-295/MissingHostKeyValidation.ql @@ -16,11 +16,17 @@ import semmle.python.ApiGraphs private API::Node unsafe_paramiko_policy(string name) { name in ["AutoAddPolicy", "WarningPolicy"] and - result = API::moduleImport("paramiko").getMember("client").getMember(name) + ( + result = API::moduleImport("paramiko").getMember("client").getMember(name) + or + result = API::moduleImport("paramiko").getMember(name) + ) } private API::Node paramikoSshClientInstance() { result = API::moduleImport("paramiko").getMember("client").getMember("SSHClient").getReturn() + or + result = API::moduleImport("paramiko").getMember("SSHClient").getReturn() } from DataFlow::CallCfgNode call, DataFlow::Node arg, string name diff --git a/python/ql/test/query-tests/Security/CWE-295-MissingHostKeyValidation/MissingHostKeyValidation.expected b/python/ql/test/query-tests/Security/CWE-295-MissingHostKeyValidation/MissingHostKeyValidation.expected index bcbb79ad6ff..d7245c5e602 100644 --- a/python/ql/test/query-tests/Security/CWE-295-MissingHostKeyValidation/MissingHostKeyValidation.expected +++ b/python/ql/test/query-tests/Security/CWE-295-MissingHostKeyValidation/MissingHostKeyValidation.expected @@ -2,3 +2,4 @@ | paramiko_host_key.py:7:1:7:49 | ControlFlowNode for Attribute() | Setting missing host key policy to WarningPolicy may be unsafe. | | paramiko_host_key.py:11:1:11:51 | ControlFlowNode for Attribute() | Setting missing host key policy to AutoAddPolicy may be unsafe. | | paramiko_host_key.py:13:1:13:51 | ControlFlowNode for Attribute() | Setting missing host key policy to WarningPolicy may be unsafe. | +| paramiko_host_key.py:20:1:20:58 | ControlFlowNode for Attribute() | Setting missing host key policy to AutoAddPolicy may be unsafe. |