mirror of
https://github.com/github/codeql.git
synced 2025-12-24 04:36:35 +01:00
python: ParameterNode -> SourceParameterNode
This commit is contained in:
@@ -828,7 +828,7 @@ module HTTP {
|
||||
}
|
||||
|
||||
/** A parameter that will receive parts of the url when handling an incoming request. */
|
||||
private class RoutedParameter extends RemoteFlowSource::Range, DataFlow::SourceParameterNode {
|
||||
private class RoutedParameter extends RemoteFlowSource::Range, DataFlow::ParameterNode {
|
||||
RequestHandler handler;
|
||||
|
||||
RoutedParameter() { this.getParameter() = handler.getARoutedParameter() }
|
||||
|
||||
@@ -305,7 +305,7 @@ private module SensitiveDataModeling {
|
||||
}
|
||||
|
||||
/** A parameter where the name indicates it will receive sensitive data. */
|
||||
class SensitiveParameter extends SensitiveDataSource::Range, DataFlow::SourceParameterNode {
|
||||
class SensitiveParameter extends SensitiveDataSource::Range, DataFlow::ParameterNode {
|
||||
SensitiveDataClassification classification;
|
||||
|
||||
SensitiveParameter() { this.getParameter().getName() = sensitiveString(classification) }
|
||||
|
||||
@@ -25,7 +25,7 @@ class MaximalFlowsConfig extends DataFlow::Configuration {
|
||||
exists(node.getLocation().getFile().getRelativePath()) and
|
||||
not node.asCfgNode() instanceof CallNode and
|
||||
not node.asCfgNode().getNode() instanceof Return and
|
||||
not node instanceof DataFlow::SourceParameterNode and
|
||||
not node instanceof DataFlow::ParameterNode and
|
||||
not node instanceof DataFlow::PostUpdateNode and
|
||||
// not node.asExpr() instanceof FunctionExpr and
|
||||
// not node.asExpr() instanceof ClassExpr and
|
||||
|
||||
@@ -9,7 +9,7 @@ class MaximalFlowsConfig extends DataFlow::Configuration {
|
||||
MaximalFlowsConfig() { this = "AllFlowsConfig" }
|
||||
|
||||
override predicate isSource(DataFlow::Node node) {
|
||||
node instanceof DataFlow::SourceParameterNode
|
||||
node instanceof DataFlow::ParameterNode
|
||||
or
|
||||
node instanceof DataFlow::EssaNode and
|
||||
not exists(DataFlow::EssaNode pred | DataFlow::localFlowStep(pred, node))
|
||||
|
||||
@@ -17,6 +17,6 @@ class CallGraphConfig extends DataFlow::Configuration {
|
||||
override predicate isSink(DataFlow::Node node) {
|
||||
node instanceof DataFlowPrivate::OutNode
|
||||
or
|
||||
node instanceof DataFlow::SourceParameterNode
|
||||
node instanceof DataFlow::ParameterNode
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,6 +2,6 @@ import python
|
||||
import semmle.python.dataflow.new.DataFlow
|
||||
|
||||
query predicate parameterWithoutNode(Parameter p, string msg) {
|
||||
not exists(DataFlow::SourceParameterNode node | p = node.getParameter()) and
|
||||
not exists(DataFlow::ParameterNode node | p = node.getParameter()) and
|
||||
msg = "There is no `ParameterNode` associated with this parameter."
|
||||
}
|
||||
|
||||
@@ -17,7 +17,7 @@ class CallGraphConfig extends DataFlow::Configuration {
|
||||
override predicate isSink(DataFlow::Node node) {
|
||||
node instanceof DataFlowPrivate::OutNode
|
||||
or
|
||||
node instanceof DataFlow::SourceParameterNode and
|
||||
node instanceof DataFlow::ParameterNode and
|
||||
// exclude parameters to the SINK-functions
|
||||
not exists(DataFlowPrivate::DataFlowCallable c |
|
||||
node.(DataFlow::SourceParameterNode).isParameterOf(c, _) and
|
||||
|
||||
@@ -89,7 +89,7 @@ private DataFlow::TypeTrackingNode tracked_self(TypeTracker t) {
|
||||
exists(Function f |
|
||||
f.isMethod() and
|
||||
f.getName() = "track_self" and
|
||||
result.(DataFlow::SourceParameterNode).getParameter() = f.getArg(0)
|
||||
result.(DataFlow::ParameterNode).getParameter() = f.getArg(0)
|
||||
)
|
||||
or
|
||||
exists(TypeTracker t2 | result = tracked_self(t2).track(t2, t))
|
||||
|
||||
Reference in New Issue
Block a user