hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Taus <tausbn@github.com>
This commit is contained in:
yoff
2020-10-15 12:35:21 +02:00
committed by GitHub
parent 6a3aed337f
commit c36ad7dd9b
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/src/experimental/semmle/python/Concepts.qll
View File

@@ -46,7 +46,7 @@ module SystemCommandExecution {
* decompressing, decrypting, parsing etc.
*
* Doing so should normally preserve taint, but it can also be a problem
* in itself, e.g. if it allows code execution or could result in deinal-of-service.
* in itself, e.g. if it allows code execution or could result in denial-of-service.
*
* Extend this class to refine existing API models. If you want to model new APIs,
* extend `Decoding::Range` instead.
@@ -77,7 +77,7 @@ module Decoding {
* decompressing, decrypting, parsing etc.
*
* Doing so should normally preserve taint, but it can also be a problem
* in itself, e.g. if it allows code execution or could result in deinal-of-service.
* in itself, e.g. if it allows code execution or could result in denial-of-service.
*
* Extend this class to model new APIs. If you want to refine existing API models,
* extend `Decoding` instead.

7
python/ql/src/experimental/semmle/python/frameworks/Dill.qll
View File

@@ -43,13 +43,14 @@ private module Dill {
* See https://pypi.org/project/dill/ (which currently refers you
* to https://docs.python.org/3/library/pickle.html#pickle.loads)
*/
private class DillLoadsCall extends Decoding::Range {
DillLoadsCall() { this.asCfgNode().(CallNode).getFunction() = Dill::dill::loads().asCfgNode() }
private class DillLoadsCall extends Decoding::Range, DataFlow::CfgNode {
override CallNode node;
DillLoadsCall() { node.getFunction() = Dill::dill::loads().asCfgNode() }
override predicate unsafe() { any() }
override DataFlow::Node getAnInput() {
result.asCfgNode() = this.asCfgNode().(CallNode).getArg(0)
result.asCfgNode() = node.getArg(0)
}
override DataFlow::Node getOutput() { result = this }