hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Properly handle huge_tree in lxml

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2022-03-03 14:43:37 +01:00
parent 124c03c15c
commit e295399f70
2 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
python/ql/src/experimental/semmle/python/frameworks/Xml.qll
View File

@@ -226,10 +226,7 @@ private module Xml {
)
or
(kind.isBillionLaughs() or kind.isQuadraticBlowup()) and
(
this.getArgByName("huge_tree").getALocalSource().asExpr() = any(True t) and
not this.getArgByName("resolve_entities").getALocalSource().asExpr() = any(False f)
)
this.getArgByName("huge_tree").getALocalSource().asExpr() = any(True t)
}
}