hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python taint-tracking: If taint has no class allow it flow through both branches of isinstance test.

Browse Source
This commit is contained in:
Mark Shannon
2019-04-04 14:29:34 +01:00
parent b226cb64cd
commit e2a3d91a7d
8 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/src/semmle/python/security/TaintTracking.qll
View File

@@ -1267,6 +1267,8 @@ library module TaintFlowImplementation {
Filters::isinstance(test.getTest(), c, var.getSourceVariable().getAUse())
and c.refersTo(cls)
|
test.getSense() = true and not exists(kind.getClass())
or
test.getSense() = true and kind.getClass().getAnImproperSuperType() = cls
or
test.getSense() = false and not kind.getClass().getAnImproperSuperType() = cls

7
python/ql/test/library-tests/taint/general/TestDefn.expected
View File

@@ -182,3 +182,10 @@
| test.py:186 | ArgumentRefinement(t_3) | test.py:178 | Taint simple.test | SOURCE |
| test.py:189 | FALSEY | test.py:189 | Taint falsey | FALSEY |
| test.py:191 | Pi(t_0) [true] | test.py:189 | Taint falsey | FALSEY |
| test.py:194 | phi(t_3, t_5) | test.py:195 | Taint simple.test | SOURCE |
| test.py:195 | SOURCE | test.py:195 | Taint simple.test | SOURCE |
| test.py:196 | ArgumentRefinement(t_0) | test.py:195 | Taint simple.test | SOURCE |
| test.py:197 | ArgumentRefinement(t_2) | test.py:195 | Taint simple.test | SOURCE |
| test.py:197 | Pi(t_1) [true] | test.py:195 | Taint simple.test | SOURCE |
| test.py:199 | ArgumentRefinement(t_4) | test.py:195 | Taint simple.test | SOURCE |
| test.py:199 | Pi(t_1) [false] | test.py:195 | Taint simple.test | SOURCE |

4
python/ql/test/library-tests/taint/general/TestNode.expected
View File

@@ -222,6 +222,10 @@
| Taint simple.test | test.py:180 | t | |
| Taint simple.test | test.py:183 | t | |
| Taint simple.test | test.py:186 | t | |
| Taint simple.test | test.py:195 | SOURCE | |
| Taint simple.test | test.py:196 | t | |
| Taint simple.test | test.py:197 | t | |
| Taint simple.test | test.py:199 | t | |
| Taint {simple.test} | test.py:169 | Dict | |
| Taint {simple.test} | test.py:171 | d | |
| Taint {simple.test} | test.py:173 | y | |

2
python/ql/test/library-tests/taint/general/TestSink.expected
View File

@@ -34,3 +34,5 @@
| simple.test | test.py:169 | 173 | Subscript | simple.test |
| simple.test | test.py:178 | 180 | t | simple.test |
| simple.test | test.py:178 | 186 | t | simple.test |
| simple.test | test.py:195 | 197 | t | simple.test |
| simple.test | test.py:195 | 199 | t | simple.test |

1
python/ql/test/library-tests/taint/general/TestSource.expected
View File

@@ -42,3 +42,4 @@
| test.py:169 | SOURCE | simple.test |
| test.py:178 | SOURCE | simple.test |
| test.py:189 | FALSEY | falsey |
| test.py:195 | SOURCE | simple.test |

3
python/ql/test/library-tests/taint/general/TestStep.expected
View File

@@ -178,6 +178,9 @@
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:180 | t | |
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:183 | t | |
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:186 | t | |
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:196 | t | |
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:197 | t | |
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:199 | t | |
| Taint {simple.test} | test.py:169 | Dict | | --> | Taint {simple.test} | test.py:171 | d | |
| Taint {simple.test} | test.py:169 | Dict | | --> | Taint {simple.test} | test.py:175 | d | |
| Taint {simple.test} | test.py:171 | d | | --> | Taint {simple.test} | test.py:173 | y | |

7
python/ql/test/library-tests/taint/general/TestVar.expected
View File

@@ -184,3 +184,10 @@
| test.py:186 | t_4 | test.py:178 | Taint simple.test | SOURCE |
| test.py:189 | t_0 | test.py:189 | Taint falsey | FALSEY |
| test.py:191 | t_1 | test.py:189 | Taint falsey | FALSEY |
| test.py:194 | t_6 | test.py:195 | Taint simple.test | SOURCE |
| test.py:195 | t_0 | test.py:195 | Taint simple.test | SOURCE |
| test.py:196 | t_1 | test.py:195 | Taint simple.test | SOURCE |
| test.py:197 | t_2 | test.py:195 | Taint simple.test | SOURCE |
| test.py:197 | t_3 | test.py:195 | Taint simple.test | SOURCE |
| test.py:199 | t_4 | test.py:195 | Taint simple.test | SOURCE |
| test.py:199 | t_5 | test.py:195 | Taint simple.test | SOURCE |

8
python/ql/test/library-tests/taint/general/test.py
View File

@@ -190,3 +190,11 @@ def test_early_exit():
if not t:
return
t
def flow_through_type_test_if_no_class():
t = SOURCE
if isinstance(t, str):
SINK(t)
else:
SINK(t)