hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-15 15:34:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into aegilops/polyfill-io-compromised-script

Browse Source
This commit is contained in:
Paul Hodgkinson
2024-07-01 17:15:07 +01:00
committed by GitHub
parent 73fc6bcdb1 2b2c381bf0
commit d289fb414e
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/src/Security/CWE-798/HardcodedCredentials.ql
View File

@@ -18,6 +18,7 @@ import semmle.python.dataflow.new.TaintTracking
import semmle.python.filters.Tests
private import semmle.python.dataflow.new.internal.DataFlowDispatch as DataFlowDispatch
private import semmle.python.dataflow.new.internal.Builtins::Builtins as Builtins
private import semmle.python.frameworks.data.ModelsAsData
bindingset[char, fraction]
predicate fewer_characters_than(StringLiteral str, string char, float fraction) {
@@ -80,6 +81,11 @@ class HardcodedValueSource extends DataFlow::Node {
class CredentialSink extends DataFlow::Node {
CredentialSink() {
exists(string s | s.matches("credentials-%") |
// Actual sink-type will be things like `credentials-password` or `credentials-username`
this = ModelOutput::getASinkNode(s).asSink()
)
or
exists(string name |
name.regexpMatch(getACredentialRegex()) and
not name.matches("%file")

4
python/ql/src/change-notes/2024-06-28-cred-hardcoded.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Adding Python support for Hardcoded Credentials as Models as Data