hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Apply suggestions from code review

Browse Source 
Co-authored-by: Taus <tausbn@github.com>
This commit is contained in:
Rasmus Wriedt Larsen
2022-05-18 10:30:29 +02:00
committed by GitHub
parent 044829c3bb
commit b54de13d97
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/src/Security/CWE-285/PamAuthorization.qhelp
View File

@@ -10,7 +10,7 @@
A A
<code>pam_authenticate</code> <code>pam_authenticate</code>
only verifies the credentials of a user. It does not check if a user has an only verifies the credentials of a user. It does not check if a user has an
appropriate authorization to actually login. This means a user with a expired appropriate authorization to actually login. This means a user with an expired
login or a password can still access the system. login or a password can still access the system.
</p> </p>
@@ -29,7 +29,7 @@
<example> <example>
<p> <p>
In the following example, the code only checks the credentials of a user. Hence, In the following example, the code only checks the credentials of a user. Hence,
in this case, a user expired with expired creds can still login. This can be in this case, a user with expired credentials can still login. This can be
verified by creating a new user account, expiring it with verified by creating a new user account, expiring it with
<code>chage -E0 `username` </code> <code>chage -E0 `username` </code>
and then trying to log in. and then trying to log in.

2
python/ql/src/Security/CWE-285/PamAuthorization.ql
View File

@@ -35,4 +35,4 @@ where
DataFlow::localFlow(handle, acctMgmtCall.getArg(0)) DataFlow::localFlow(handle, acctMgmtCall.getArg(0))
) )
select authenticateCall, select authenticateCall,
"This PAM authentication call may be lead to an authorization bypass, since 'pam_acct_mgmt' is not called afterwards." "This PAM authentication call may lead to an authorization bypass, since 'pam_acct_mgmt' is not called afterwards."

2
python/ql/test/query-tests/Security/CWE-285-PamAuthorization/PamAuthorization.expected
View File

@@ -1 +1 @@
| pam_test.py:48:18:48:44 | ControlFlowNode for pam_authenticate() | This PAM authentication call may be lead to an authorization bypass, since 'pam_acct_mgmt' is not called afterwards. | | pam_test.py:48:18:48:44 | ControlFlowNode for pam_authenticate() | This PAM authentication call may lead to an authorization bypass, since 'pam_acct_mgmt' is not called afterwards. |