hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add taint test for os.path.join

Browse Source 
Surprisingly the first two just worked, due to our very general handling of any
`join` methods :D
This commit is contained in:
Rasmus Wriedt Larsen
2020-09-30 11:16:15 +02:00
parent aa6fad558c
commit efa2484718
3 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/src/experimental/dataflow/internal/TaintTrackingPrivate.qll
View File

@@ -101,7 +101,7 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
nodeFrom.getNode() = object and
method_name in ["partition", "rpartition", "rsplit", "split", "splitlines"]
or
// List[str] -> str
// Iterable[str] -> str
// TODO: check if these should be handled differently in regards to content
method_name = "join" and
nodeFrom.getNode() = call.getArg(0)