hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-11 20:51:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Allow MaD sanitizers for queries with MaD sinks

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-01-29 12:04:18 +00:00
parent ad6f800022
commit ef6332c581
8 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/lib/semmle/python/security/dataflow/CodeInjectionCustomizations.qll
View File

@@ -60,4 +60,11 @@ module CodeInjection {
/** DEPRECATED: Use ConstCompareAsSanitizerGuard instead. */
deprecated class StringConstCompareAsSanitizerGuard = ConstCompareAsSanitizerGuard;
/**
* A sanitizer defined via models-as-data with kind "code-injection".
*/
class SanitizerFromModel extends Sanitizer {
SanitizerFromModel() { ModelOutput::barrierNode(this, "code-injection") }
}
}

7
python/ql/lib/semmle/python/security/dataflow/CommandInjectionCustomizations.qll
View File

@@ -95,4 +95,11 @@ module CommandInjection {
/** DEPRECATED: Use ConstCompareAsSanitizerGuard instead. */
deprecated class StringConstCompareAsSanitizerGuard = ConstCompareAsSanitizerGuard;
/**
* A sanitizer defined via models-as-data with kind "command-injection".
*/
class SanitizerFromModel extends Sanitizer {
SanitizerFromModel() { ModelOutput::barrierNode(this, "command-injection") }
}
}

7
python/ql/lib/semmle/python/security/dataflow/LogInjectionCustomizations.qll
View File

@@ -106,4 +106,11 @@ module LogInjection {
this.getArg(0).asExpr().(StringLiteral).getText() in ["\r\n", "\n"]
}
}
/**
* A sanitizer defined via models-as-data with kind "log-injection".
*/
class SanitizerFromModel extends Sanitizer {
SanitizerFromModel() { ModelOutput::barrierNode(this, "log-injection") }
}
}

7
python/ql/lib/semmle/python/security/dataflow/PathInjectionCustomizations.qll
View File

@@ -98,4 +98,11 @@ module PathInjection {
/** DEPRECATED: Use ConstCompareAsSanitizerGuard instead. */
deprecated class StringConstCompareAsSanitizerGuard = ConstCompareAsSanitizerGuard;
/**
* A sanitizer defined via models-as-data with kind "path-injection".
*/
class SanitizerFromModel extends Sanitizer {
SanitizerFromModel() { ModelOutput::barrierNode(this, "path-injection") }
}
}

7
python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll
View File

@@ -84,4 +84,11 @@ module ReflectedXss {
/** DEPRECATED: Use ConstCompareAsSanitizerGuard instead. */
deprecated class StringConstCompareAsSanitizerGuard = ConstCompareAsSanitizerGuard;
/**
* A sanitizer defined via models-as-data with kind "html-injection" or "js-injection".
*/
class SanitizerFromModel extends Sanitizer {
SanitizerFromModel() { ModelOutput::barrierNode(this, ["html-injection", "js-injection"]) }
}
}

7
python/ql/lib/semmle/python/security/dataflow/SqlInjectionCustomizations.qll
View File

@@ -69,4 +69,11 @@ module SqlInjection {
private class DataAsSqlSink extends Sink {
DataAsSqlSink() { ModelOutput::sinkNode(this, "sql-injection") }
}
/**
* A sanitizer defined via models-as-data with kind "sql-injection".
*/
class SanitizerFromModel extends Sanitizer {
SanitizerFromModel() { ModelOutput::barrierNode(this, "sql-injection") }
}
}

7
python/ql/lib/semmle/python/security/dataflow/UnsafeDeserializationCustomizations.qll
View File

@@ -65,4 +65,11 @@ module UnsafeDeserialization {
/** DEPRECATED: Use ConstCompareAsSanitizerGuard instead. */
deprecated class StringConstCompareAsSanitizerGuard = ConstCompareAsSanitizerGuard;
/**
* A sanitizer defined via models-as-data with kind "unsafe-deserialization".
*/
class SanitizerFromModel extends Sanitizer {
SanitizerFromModel() { ModelOutput::barrierNode(this, "unsafe-deserialization") }
}
}

11
python/ql/src/Security/CWE-798/HardcodedCredentials.ql
View File

@@ -105,6 +105,15 @@ class CredentialSink extends DataFlow::Node {
}
}
class CredentialSanitizer extends DataFlow::Node {
CredentialSanitizer() {
exists(string s | s.matches("credentials-%") |
// Whatever the string, this will sanitize flow to all credential sinks.
ModelOutput::barrierNode(this, s)
)
}
}
/**
* Gets a regular expression for matching names of locations (variables, parameters, keys) that
* indicate the value being held is a credential.
@@ -120,6 +129,8 @@ private module HardcodedCredentialsConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof CredentialSink }
predicate isBarrier(DataFlow::Node node) { node instanceof CredentialSanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}