hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix some Ql4Ql violations.

Browse Source
This commit is contained in:
Michael Nebel
2025-09-01 15:16:25 +02:00
parent b4d6cb6e5f
commit dbd31259b3
10 changed files with 35 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
python/ql/lib/experimental/cryptography/modules/CryptographyModule.qll
View File

@@ -117,31 +117,25 @@ module KDF {
override predicate requiresIteration() { this.getAlgorithm().getKDFName() in ["PBKDF2HMAC"] }
override DataFlow::Node getIterationSizeSrc() {
if this.requiresIteration()
then
// ASSUMPTION: ONLY EVER in arg 3 in PBKDF2HMAC
result = Utils::getUltimateSrcFromApiNode(this.getParameter(3, "iterations"))
else none()
this.requiresIteration() and
// ASSUMPTION: ONLY EVER in arg 3 in PBKDF2HMAC
result = Utils::getUltimateSrcFromApiNode(this.getParameter(3, "iterations"))
}
override DataFlow::Node getSaltConfigSrc() {
if this.requiresSalt()
then
// SCRYPT has it in arg 1
if this.getAlgorithm().getKDFName() = "SCRYPT"
then result = Utils::getUltimateSrcFromApiNode(this.getParameter(1, "salt"))
else
// EVERYTHING ELSE that uses salt is in arg 2
result = Utils::getUltimateSrcFromApiNode(this.getParameter(2, "salt"))
else none()
this.requiresSalt() and
// SCRYPT has it in arg 1
if this.getAlgorithm().getKDFName() = "SCRYPT"
then result = Utils::getUltimateSrcFromApiNode(this.getParameter(1, "salt"))
else
// EVERYTHING ELSE that uses salt is in arg 2
result = Utils::getUltimateSrcFromApiNode(this.getParameter(2, "salt"))
}
override DataFlow::Node getHashConfigSrc() {
if this.requiresHash()
then
// ASSUMPTION: ONLY EVER in arg 0
result = Utils::getUltimateSrcFromApiNode(this.getParameter(0, "algorithm"))
else none()
this.requiresHash() and
// ASSUMPTION: ONLY EVER in arg 0
result = Utils::getUltimateSrcFromApiNode(this.getParameter(0, "algorithm"))
}
// TODO: get encryption algorithm for CBC-based KDF?
@@ -152,11 +146,9 @@ module KDF {
}
override DataFlow::Node getModeSrc() {
if this.requiresMode()
then
// ASSUMPTION: ONLY EVER in arg 1
result = Utils::getUltimateSrcFromApiNode(this.getParameter(1, "mode"))
else none()
this.requiresMode() and
// ASSUMPTION: ONLY EVER in arg 1
result = Utils::getUltimateSrcFromApiNode(this.getParameter(1, "mode"))
}
}
}

2
python/ql/lib/experimental/cryptography/modules/stdlib/HashlibModule.qll
View File

@@ -201,7 +201,7 @@ module KDF {
// TODO: better modeling of scrypt
/**
* Identifies key derivation fucntion hashlib.scrypt accesses.
* Identifies key derivation function hashlib.scrypt accesses.
*/
class HashlibScryptAlgorithm extends KeyDerivationAlgorithm, KeyDerivationOperation {
HashlibScryptAlgorithm() { this = API::moduleImport("hashlib").getMember("scrypt").getACall() }