hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-30 20:28:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: convert barrier guard to MaD

Browse Source
This commit is contained in:
yoff
2026-02-26 13:11:43 +01:00
parent 9b9c9304c7
commit cfbae50845
2 changed files with 9 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/lib/semmle/python/frameworks/AntiSSRF.model.yml Normal file
View File

@@ -0,0 +1,6 @@
extensions:
- addsTo:
pack: codeql/python-all
extensible: barrierGuardModel
data:
- ['AntiSSRF', 'Member[URIValidator].Member[in_domain,in_azure_keyvault_domain,in_azure_storage_domain].Argument[0]', "true", 'request-forgery']

19
python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
View File

@@ -10,6 +10,7 @@ private import semmle.python.Concepts
private import semmle.python.dataflow.new.RemoteFlowSources
private import semmle.python.dataflow.new.BarrierGuards
private import semmle.python.ApiGraphs
private import semmle.python.frameworks.data.internal.ApiGraphModels
/**
* Provides default sources, sinks and sanitizers for detecting
@@ -177,21 +178,7 @@ module ServerSideRequestForgery {
)
}
private class UriValidator extends FullUrlControlSanitizer {
UriValidator() { this = DataFlow::BarrierGuard<uri_validator/3>::getABarrierNode() }
}
import semmle.python.dataflow.new.internal.DataFlowPublic
private predicate uri_validator(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
exists(DataFlow::CallCfgNode call, string validator_name |
validator_name in ["in_domain", "in_azure_keyvault_domain", "in_azure_storage_domain"] and
call =
API::moduleImport("AntiSSRF").getMember("URIValidator").getMember(validator_name).getACall() and
call.getArg(0).asCfgNode() = node
|
g = call.asCfgNode() and
branch = true
)
private class ExternalRequestForgerySanitizer extends FullUrlControlSanitizer {
ExternalRequestForgerySanitizer() { ModelOutput::barrierNode(this, "request-forgery") }
}
}