hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Weak file permissions query.

Browse Source
This commit is contained in:
Mark Shannon
2018-11-27 16:41:39 +00:00
parent aba73f4aac
commit a3b5769c2c
8 changed files with 95 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/test/query-tests/Security/CWE-732/WeakFilePermissions.expected Normal file
View File

@@ -0,0 +1,6 @@
| test.py:7:1:7:19 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to world writable. |
| test.py:8:1:8:20 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to world writable. |
| test.py:9:1:9:21 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to world writable. |
| test.py:11:1:11:21 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to group readable. |
| test.py:13:1:13:28 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to group writable. |
| test.py:14:1:14:19 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to group writable. |

1
python/ql/test/query-tests/Security/CWE-732/WeakFilePermissions.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE-732/WeakFilePermissions.ql

2
python/ql/test/query-tests/Security/CWE-732/options Normal file
View File

@@ -0,0 +1,2 @@
semmle-extractor-options: --max-import-depth=2 -p ../lib
optimize: true

14
python/ql/test/query-tests/Security/CWE-732/test.py Normal file
View File

@@ -0,0 +1,14 @@
import os
import stat
file = 'semmle/important_secrets'
os.chmod(file, 0o7) # BAD
os.chmod(file, 0o77) # BAD
os.chmod(file, 0o777) # BAD
os.chmod(file, 0o600) # GOOD
os.chmod(file, 0o550) # BAD
os.chmod(file, stat.S_IRWXU) # GOOD
os.chmod(file, stat.S_IWGRP) # BAD
os.chmod(file, 400) # BAD -- Decimal format.

3
python/ql/test/query-tests/Security/lib/os/__init__.py
View File

@@ -3,3 +3,6 @@ def system(cmd, *args, **kwargs):
def popen(cmd, *args, **kwargs):
return None
def chmod(path, mode):
pass