remove unused saniter

This commit is contained in:
amammad
2023-07-27 01:41:31 +10:00
parent 591d81b5f9
commit bee8e6ff0d
2 changed files with 0 additions and 14 deletions

View File

@@ -65,24 +65,11 @@ module FlaskConstantSecretKeyConfig {
or
exists(SecretKeyAssignStmt e |
sink.asExpr() = e.getValue()
// | sameAsHardCodedConstantSanitizer(e.getTarget(0))
)
) and
exists(sink.getScope().getLocation().getFile().getRelativePath()) and
not sink.getScope().getLocation().getFile().inStdlib()
}
// for case check whether SECRECT_KEY is empty or not or whether it is == to a hardcoded constant value
// i don't know why I can't reach from an expression to an If subExpression node
predicate sameAsHardCodedConstantSanitizer(
DataFlow::Node source, DataFlow::Node sink, SecretKeyAssignStmt e, If i
) {
source.asExpr() = e.getTarget(0).getAChildNode() and
// source.getLocation().toString().matches("%config3.py%")and
DataFlow::localFlow(source, sink) and
sink.asExpr() = i.getASubExpression().getAChildNode*().(Compare)
}
/**
* An Assignments like `SECRET_KEY = ConstantValue`
* and `SECRET_KEY` file must be the Location that is specified in argument of `from_object` or `from_pyfile` methods

View File

@@ -6,7 +6,6 @@ import semmle.python.ApiGraphs
class WebAppConstantSecretKeySource extends DataFlow::Node {
WebAppConstantSecretKeySource() {
(
// because Env return an Exeption if there isan't any value
// we should check whether there is a default value or not
exists(API::Node env |
env = API::moduleImport("environ").getMember("Env") and