hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove a write step & update the builtin open step

Browse Source
This commit is contained in:
Sim4n6
2023-01-28 09:53:54 +01:00
parent 0e2f37825d
commit a4aaf0ec6f
1 changed files with 8 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
View File

@@ -66,8 +66,14 @@ class UnsafeUnpackingConfig extends TaintTracking::Configuration {
or
// Open a file for access
exists(MethodCallNode cn |
nodeTo = cn.getObject() and
cn.getMethodName() = "open" and
cn.calls(nodeTo, "open") and
cn.flowsTo(nodeFrom)
)
or
// Open a file for access using builtin
exists(API::CallNode cn |
cn = API::builtin("open").getACall() and
nodeTo = cn.(API::CallNode).getArg(0) and
cn.flowsTo(nodeFrom)
)
or
@@ -77,22 +83,11 @@ class UnsafeUnpackingConfig extends TaintTracking::Configuration {
nodeFrom = cn.getArg(0)
)
or
// Open a file for access using builtin
nodeFrom = API::builtin("open").getACall() and nodeTo = nodeFrom.(API::CallNode).getArg(0)
or
// Retrieve Django uploaded files
// see getlist(): https://docs.djangoproject.com/en/4.1/ref/request-response/#django.http.QueryDict.getlist
// see chunks(): https://docs.djangoproject.com/en/4.1/ref/files/uploads/#django.core.files.uploadedfile.UploadedFile.chunks
nodeTo.(MethodCallNode).calls(nodeFrom, ["getlist", "get", "chunks"])
or
// Writing the response data to the archive
exists(Stdlib::FileLikeObject::InstanceSource is, Node f, MethodCallNode mc |
is.flowsTo(f) and
mc.calls(f, "write") and
nodeFrom = mc.getArg(0) and
nodeTo = is.(CallCfgNode).getArg(0)
)
or
// Considering the use of "fs"
exists(API::CallNode fs, MethodCallNode mcn |
fs =