mirror of
https://github.com/github/codeql.git
synced 2026-04-27 09:45:15 +02:00
Python: Add worked example of taint step modeling of external libs
This can't be seen on the example, but I went through quite a lot of iterations before arriving at this fairly simple solution.
This commit is contained in:
@@ -0,0 +1,36 @@
|
||||
private import python
|
||||
private import experimental.dataflow.DataFlow
|
||||
private import experimental.dataflow.TaintTracking
|
||||
|
||||
// Helpers modeling MyClass
|
||||
/** A data-flow Node representing an instance of MyClass. */
|
||||
abstract class MyClass extends DataFlow::Node { }
|
||||
|
||||
private DataFlow::Node myClassGetValue(MyClass qualifier, DataFlow::TypeTracker t) {
|
||||
t.startInAttr("get_value") and
|
||||
result = qualifier
|
||||
or
|
||||
exists(DataFlow::TypeTracker t2 | result = myClassGetValue(qualifier, t2).track(t2, t))
|
||||
}
|
||||
|
||||
DataFlow::Node myClassGetValue(MyClass qualifier) {
|
||||
result = myClassGetValue(qualifier, DataFlow::TypeTracker::end())
|
||||
}
|
||||
|
||||
// Config
|
||||
class SourceCall extends DataFlow::Node, MyClass {
|
||||
SourceCall() { this.asCfgNode().(CallNode).getFunction().(NameNode).getId() = "source" }
|
||||
}
|
||||
|
||||
class SharedConfig extends TaintTracking::Configuration {
|
||||
SharedConfig() { this = "SharedConfig" }
|
||||
|
||||
override predicate isSource(DataFlow::Node source) { source instanceof SourceCall }
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) {
|
||||
exists(CallNode call |
|
||||
call.getFunction().(NameNode).getId() = "sink" and
|
||||
call.getArg(0) = sink.asCfgNode()
|
||||
)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user