hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add modeling of ujson PyPI package

Browse Source 
The problem with `tainted_filelike` not having taint, is that in the call

`ujson.dump(tainted_obj, tainted_filelike)`

there is no PostUpdateNote for `tainted_filelike` :( The reason is that
points-to is not able to resolve the call, so none of the clauses in
`argumentPreUpdateNode` matches

See 08731fc6cf/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll (L101-L111)

Let's deal with that issue in an other PR though
This commit is contained in:
Rasmus Wriedt Larsen
2021-05-10 15:07:55 +02:00
parent 72d08f4d6e
commit c2a6b811fc
9 changed files with 130 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/change-notes/2021-05-10-ujson-add-modeling.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* Added modeling of the PyPI package `ujson`.