hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model kombu.serialization

Browse Source 
More `pickle` wrappers.
This commit is contained in:
Taus
2023-10-13 12:17:45 +00:00
committed by Rasmus Wriedt Larsen
parent a6dc6f3e42
commit d29879a844
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
python/ql/lib/semmle/python/frameworks/Stdlib.qll
View File

@@ -1298,14 +1298,21 @@ module StdlibPrivate {
// pickle
// ---------------------------------------------------------------------------
/** Gets a reference to any of the `pickle` modules. */
API::Node pickle() { result = API::moduleImport(["pickle", "cPickle", "_pickle", "cloudpickle"]) }
API::Node pickle() {
result = API::moduleImport(["pickle", "cPickle", "_pickle", "cloudpickle"]) or
result = API::moduleImport("kombu").getMember("serialization").getMember("pickle")
}
/**
* A call to `pickle.load`
* See https://docs.python.org/3/library/pickle.html#pickle.load
*/
private class PickleLoadCall extends Decoding::Range, DataFlow::CallCfgNode {
PickleLoadCall() { this = pickle().getMember("load").getACall() }
PickleLoadCall() {
this = pickle().getMember("load").getACall() or
this =
API::moduleImport("kombu").getMember("serialization").getMember("pickle_load").getACall()
}
override predicate mayExecuteInput() { any() }