hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Write (String|Bytes)IO additional taint step

Browse Source
This commit is contained in:
jorgectf
2021-07-22 19:15:30 +02:00
parent 11f4c1cc8e
commit b5e10b6c42
3 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
python/ql/src/experimental/semmle/python/security/XXE.qll
View File

@@ -4,6 +4,7 @@ import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.dataflow.new.BarrierGuards import semmle.python.dataflow.new.BarrierGuards
import semmle.python.ApiGraphs
/** /**
* A taint-tracking configuration for detecting XML External entities abuse. * A taint-tracking configuration for detecting XML External entities abuse.
@@ -23,4 +24,12 @@ class XXEFlowConfig extends TaintTracking::Configuration {
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
guard instanceof StringConstCompare guard instanceof StringConstCompare
} }
override predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeIn) {
exists(DataFlow::CallCfgNode ioCalls |
ioCalls = API::moduleImport("io").getMember(["StringIO", "BytesIO"]).getACall() and
nodeFrom = ioCalls and
nodeIn = ioCalls.getArg(0)
)
}
} }

4
python/ql/test/experimental/query-tests/Security/CWE-611/general.py
View File

@@ -12,8 +12,6 @@ TO-DO
Extend tests Extend tests
Model xmltodict and xml.dom Model xmltodict and xml.dom
Write StringIO/BytesIO additional tain steps
XML Parsers: XML Parsers:
xml.etree.ElementTree.XMLParser() - no options, vuln by default xml.etree.ElementTree.XMLParser() - no options, vuln by default
@@ -35,6 +33,8 @@ XML Parsing:
xml.dom.(mini|pull)dom.parse(String) xml.dom.(mini|pull)dom.parse(String)
''' '''
app = Flask(__name__)
@app.route("/XMLParser-Empty&xml.etree.ElementTree.fromstring") @app.route("/XMLParser-Empty&xml.etree.ElementTree.fromstring")
def test1(): def test1():

4
python/ql/test/experimental/query-tests/Security/CWE-611/xml_sax_make_parser.py
View File

@@ -1,6 +1,10 @@
from flask import request, Flask
from io import StringIO from io import StringIO
import xml.sax import xml.sax
app = Flask(__name__)
# https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges # https://docs.python.org/3/library/xml.sax.handler.html#xml.sax.handler.feature_external_ges