hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Move experimental LDAPInsecureAuth to new dataflow API

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2023-08-25 17:23:51 +02:00
parent c6911c2ae0
commit acd0f2a8fb
2 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/src/experimental/Security/CWE-522/LDAPInsecureAuth.ql
View File

@@ -12,9 +12,9 @@
// determine precision above
import python
import DataFlow::PathGraph
import LDAPInsecureAuthFlow::PathGraph
import experimental.semmle.python.security.LDAPInsecureAuth
from LdapInsecureAuthConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
from LDAPInsecureAuthFlow::PathNode source, LDAPInsecureAuthFlow::PathNode sink
where LDAPInsecureAuthFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "This LDAP host is authenticated insecurely."

11
python/ql/src/experimental/semmle/python/security/LDAPInsecureAuth.qll
View File

@@ -88,10 +88,8 @@ class LdapStringVar extends BinaryExpr {
/**
* A taint-tracking configuration for detecting LDAP insecure authentications.
*/
class LdapInsecureAuthConfig extends TaintTracking::Configuration {
LdapInsecureAuthConfig() { this = "LDAPInsecureAuthConfig" }
override predicate isSource(DataFlow::Node source) {
private module LDAPInsecureAuthConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof RemoteFlowSource or
source.asExpr() instanceof LdapFullHost or
source.asExpr() instanceof LdapBothStrings or
@@ -100,7 +98,10 @@ class LdapInsecureAuthConfig extends TaintTracking::Configuration {
source.asExpr() instanceof LdapStringVar
}
override predicate isSink(DataFlow::Node sink) {
predicate isSink(DataFlow::Node sink) {
exists(LdapBind ldapBind | not ldapBind.useSsl() and sink = ldapBind.getHost())
}
}
/** Global taint-tracking for detecting "LDAP insecure authentications" vulnerabilities. */
module LDAPInsecureAuthFlow = TaintTracking::Global<LDAPInsecureAuthConfig>;