From c004ffaca8e721834f4f10ef0deb7bf6f18ff421 Mon Sep 17 00:00:00 2001 From: Rasmus Lerchedahl Petersen Date: Thu, 14 Mar 2024 09:22:08 +0100 Subject: [PATCH] python: move model to `Stdlib.yml` There is already a model there so we add to that one. We did observe that this existing model was blocked by the external MaD model. This is concerning and needs to be cleared up. --- python/ql/lib/ext/StdLib.model.yml | 2 -- python/ql/lib/semmle/python/frameworks/Stdlib.qll | 9 +++++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/python/ql/lib/ext/StdLib.model.yml b/python/ql/lib/ext/StdLib.model.yml index 16f62bd7748..df4feaf0424 100644 --- a/python/ql/lib/ext/StdLib.model.yml +++ b/python/ql/lib/ext/StdLib.model.yml @@ -30,8 +30,6 @@ extensions: # See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urljoin - ["urllib", "Member[parse].Member[urljoin]", "Argument[0,base:]", "ReturnValue", "taint"] - ["urllib", "Member[parse].Member[urljoin]", "Argument[1,url:]", "ReturnValue", "taint"] - # See https://docs.python.org/3/library/re.html#re.compile - - ["re", "Member[compile]", "Argument[0,pattern:]", "ReturnValue", "taint"] - addsTo: pack: codeql/python-all extensible: neutralModel diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.qll b/python/ql/lib/semmle/python/frameworks/Stdlib.qll index 3c23b392991..7a373a523e4 100644 --- a/python/ql/lib/semmle/python/frameworks/Stdlib.qll +++ b/python/ql/lib/semmle/python/frameworks/Stdlib.qll @@ -3251,8 +3251,13 @@ module StdlibPrivate { override predicate propagatesFlow(string input, string output, boolean preservesValue) { input in ["Argument[0]", "Argument[pattern:]"] and - output = "ReturnValue.Attribute[pattern]" and - preservesValue = true + ( + output = "ReturnValue.Attribute[pattern]" and + preservesValue = true + or + output = "ReturnValue" and + preservesValue = false + ) } }