hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2662 from RasmusWL/python-taint-on-eq-test

Browse Source 
Python: Only clear taint on constant comparison in if
This commit is contained in:
Taus
2020-01-23 13:41:40 +01:00
committed by GitHub
parent ef7eafa849 bbe93f43d3
commit d06e86f54d
7 changed files with 53 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
python/ql/src/semmle/python/dataflow/Implementation.qll
View File

@@ -806,7 +806,10 @@ private predicate testEvaluatesMaybe(ControlFlowNode test, ControlFlowNode use)
any(PyEdgeRefinement ref).getTest().getAChild*() = test and
test.getAChild*() = use and
not test.(UnaryExprNode).getNode().getOp() instanceof Not and
not Filters::equality_test(test, use, _, _) and
not exists(ControlFlowNode const |
Filters::equality_test(test, use, _, const) and
const.getNode() instanceof ImmutableLiteral
) and
not Filters::isinstance(test, _, use) and
not test = use
or

3
python/ql/test/library-tests/taint/general/TestDefn.expected
View File

@@ -93,3 +93,6 @@
| test.py:208 | List | test.py:208 | Taint sequence of simple.test | seq |
| test.py:209 | For | test.py:209 | Taint simple.test | i |
| test.py:213 | For | test.py:213 | Taint simple.test | x |
| test.py:217 | SOURCE | test.py:217 | Taint simple.test | tainted |
| test.py:223 | SOURCE | test.py:223 | Taint simple.test | tainted |
| test.py:229 | SOURCE | test.py:229 | Taint simple.test | tainted |

3
python/ql/test/library-tests/taint/general/TestSink.expected
View File

@@ -38,3 +38,6 @@
| simple.test | test.py:195 | 197 | t | simple.test |
| simple.test | test.py:195 | 199 | t | simple.test |
| simple.test | test.py:208 | 214 | x | simple.test |
| simple.test | test.py:217 | 220 | tainted | simple.test |
| simple.test | test.py:229 | 231 | tainted | simple.test |
| simple.test | test.py:229 | 233 | tainted | simple.test |

3
python/ql/test/library-tests/taint/general/TestSource.expected
View File

@@ -45,3 +45,6 @@
| test.py:195 | SOURCE | simple.test |
| test.py:202 | ITERABLE_SOURCE | iterable.simple |
| test.py:208 | SOURCE | simple.test |
| test.py:217 | SOURCE | simple.test |
| test.py:223 | SOURCE | simple.test |
| test.py:229 | SOURCE | simple.test |

7
python/ql/test/library-tests/taint/general/TestStep.expected
View File

@@ -199,3 +199,10 @@
| simple.test | test.py:210 | i | | --> | iterable.simple | test.py:213 | flow_in_generator() | |
| simple.test | test.py:210 | i | | --> | sequence of simple.test | test.py:213 | flow_in_generator() | |
| simple.test | test.py:213 | For | | --> | simple.test | test.py:214 | x | |
| simple.test | test.py:217 | SOURCE | | --> | simple.test | test.py:218 | tainted | |
| simple.test | test.py:217 | SOURCE | | --> | simple.test | test.py:220 | tainted | |
| simple.test | test.py:223 | SOURCE | | --> | simple.test | test.py:224 | tainted | |
| simple.test | test.py:229 | SOURCE | | --> | simple.test | test.py:230 | tainted | |
| simple.test | test.py:229 | SOURCE | | --> | simple.test | test.py:231 | tainted | |
| simple.test | test.py:229 | SOURCE | | --> | simple.test | test.py:232 | tainted | |
| simple.test | test.py:229 | SOURCE | | --> | simple.test | test.py:233 | tainted | |

15
python/ql/test/library-tests/taint/general/TestVar.expected
View File

@@ -193,3 +193,18 @@
| test.py:213 | x_0 | test.py:213 | Taint simple.test |
| test.py:213 | x_1 | test.py:213 | Taint simple.test |
| test.py:214 | x_2 | test.py:214 | Taint simple.test |
| test.py:217 | tainted_0 | test.py:217 | Taint simple.test |
| test.py:220 | tainted_3 | test.py:220 | Taint simple.test |
| test.py:220 | tainted_4 | test.py:220 | Taint simple.test |
| test.py:220 | tainted_5 | test.py:220 | Taint simple.test |
| test.py:223 | tainted_0 | test.py:223 | Taint simple.test |
| test.py:225 | tainted_1 | test.py:225 | Taint simple.test |
| test.py:228 | tainted_7 | test.py:228 | Taint simple.test |
| test.py:228 | tainted_8 | test.py:228 | Taint simple.test |
| test.py:229 | tainted_0 | test.py:229 | Taint simple.test |
| test.py:231 | tainted_1 | test.py:231 | Taint simple.test |
| test.py:231 | tainted_2 | test.py:231 | Taint simple.test |
| test.py:232 | tainted_3 | test.py:232 | Taint simple.test |
| test.py:232 | tainted_4 | test.py:232 | Taint simple.test |
| test.py:233 | tainted_5 | test.py:233 | Taint simple.test |
| test.py:233 | tainted_6 | test.py:233 | Taint simple.test |

18
python/ql/test/library-tests/taint/general/test.py
View File

@@ -213,3 +213,21 @@ def flow_from_generator():
for x in flow_in_generator():
SINK(x)
def const_eq_clears_taint():
tainted = SOURCE
if tainted == "safe":
SINK(tainted) # safe
SINK(tainted) # unsafe
def const_eq_clears_taint2():
tainted = SOURCE
if tainted != "safe":
return
SINK(tainted) # safe
def non_const_eq_preserves_taint(x):
tainted = SOURCE
if tainted == tainted:
SINK(tainted) # unsafe
if tainted == x:
SINK(tainted) # unsafe