hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix errors introduced during port

Browse Source 
testing on a database helps..
This commit is contained in:
Rasmus Lerchedahl Petersen
2021-09-14 13:08:21 +02:00
parent 6c82daef3d
commit abbd1d1dc5
2 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
python/ql/lib/semmle/python/security/injection/RegexInjectionCustomizations.qll
View File

@@ -25,7 +25,14 @@ module RegexInjection {
* A sink for "regular expression injection" vulnerabilities is the execution of a regular expression.
* If you have a custom way to execute regular expressions, you can extend `RegexExecution::Range`.
*/
class Sink extends RegexExecution { }
class Sink extends DataFlow::Node {
RegexExecution regexExecution;
Sink() { this = regexExecution.getRegexNode() }
/** Gets the call that executes the regular expression marked by this sink. */
RegexExecution getRegexExecution() { result = regexExecution }
}
/**
* A sanitizer for "regular expression injection" vulnerabilities.

10
python/ql/src/Security/CWE-730/RegexInjection.ql
View File

@@ -13,16 +13,16 @@
// determine precision above
import python
private import semmle.python.Concepts
import semmle.python.security.injection.RegexInjection
import DataFlow::PathGraph
from
RegexInjection::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink,
RegexInjection::Sink regexInjectionSink
RegexExecution regexExecution
where
config.hasFlowPath(source, sink) and
regexInjectionSink = sink.getNode()
regexExecution = sink.getNode().(RegexInjection::Sink).getRegexExecution()
select sink.getNode(), source, sink,
"$@ regular expression is constructed from a $@ and executed by $@.",
regexInjectionSink.getRegexNode(), "This", source.getNode(), "user-provided value",
regexInjectionSink, regexInjectionSink.getName()
"$@ regular expression is constructed from a $@ and executed by $@.", sink.getNode(), "This",
source.getNode(), "user-provided value", regexExecution, regexExecution.getName()