mirror of
https://github.com/github/codeql.git
synced 2026-04-29 02:35:15 +02:00
Python: Only comparison with constant will clear taint
tainted = SOURCE
if tainted == tainted:
SINK(tainted) # unsafe
before, in the body of the if statement, `tainted` was not tainted
This commit is contained in:
@@ -806,7 +806,10 @@ private predicate testEvaluatesMaybe(ControlFlowNode test, ControlFlowNode use)
|
||||
any(PyEdgeRefinement ref).getTest().getAChild*() = test and
|
||||
test.getAChild*() = use and
|
||||
not test.(UnaryExprNode).getNode().getOp() instanceof Not and
|
||||
not Filters::equality_test(test, use, _, _) and
|
||||
not exists(ControlFlowNode const |
|
||||
Filters::equality_test(test, use, _, const) and
|
||||
const.getNode() instanceof ImmutableLiteral
|
||||
) and
|
||||
not Filters::isinstance(test, _, use) and
|
||||
not test = use
|
||||
or
|
||||
|
||||
Reference in New Issue
Block a user