hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'python-port-unsafe-deserialization' of github.com:yoff/codeql into python-port-unsafe-deserialization

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2020-10-15 13:01:38 +02:00
parent 172e058438 c36ad7dd9b
commit cc7d32c27c
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/src/experimental/semmle/python/Concepts.qll
View File

@@ -46,7 +46,7 @@ module SystemCommandExecution {
* decompressing, decrypting, parsing etc.
*
* Doing so should normally preserve taint, but it can also be a problem
* in itself, e.g. if it allows code execution or could result in deinal-of-service.
* in itself, e.g. if it allows code execution or could result in denial-of-service.
*
* Extend this class to refine existing API models. If you want to model new APIs,
* extend `Decoding::Range` instead.
@@ -77,7 +77,7 @@ module Decoding {
* decompressing, decrypting, parsing etc.
*
* Doing so should normally preserve taint, but it can also be a problem
* in itself, e.g. if it allows code execution or could result in deinal-of-service.
* in itself, e.g. if it allows code execution or could result in denial-of-service.
*
* Extend this class to model new APIs. If you want to refine existing API models,
* extend `Decoding` instead.

7
python/ql/src/experimental/semmle/python/frameworks/Dill.qll
View File

@@ -43,13 +43,14 @@ private module Dill {
* See https://pypi.org/project/dill/ (which currently refers you
* to https://docs.python.org/3/library/pickle.html#pickle.loads)
*/
private class DillLoadsCall extends Decoding::Range {
DillLoadsCall() { this.asCfgNode().(CallNode).getFunction() = Dill::dill::loads().asCfgNode() }
private class DillLoadsCall extends Decoding::Range, DataFlow::CfgNode {
override CallNode node;
DillLoadsCall() { node.getFunction() = Dill::dill::loads().asCfgNode() }
override predicate mayExecuteInput() { any() }
override DataFlow::Node getAnInput() {
result.asCfgNode() = this.asCfgNode().(CallNode).getArg(0)
result.asCfgNode() = node.getArg(0)
}
override DataFlow::Node getOutput() { result = this }