hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 18:33:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix huge_tree modeling

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2022-03-04 09:49:00 +01:00
parent d6cbfec434
commit f0131afc54
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
python/ql/src/experimental/semmle/python/frameworks/Xml.qll
View File

@@ -341,7 +341,8 @@ private module Lxml {
)
or
(kind.isBillionLaughs() or kind.isQuadraticBlowup()) and
this.getArgByName("huge_tree").getALocalSource().asExpr() = any(True t)
this.getArgByName("huge_tree").getALocalSource().asExpr() = any(True t) and
not this.getArgByName("resolve_entities").getALocalSource().asExpr() = any(False t)
or
kind.isDtdRetrieval() and
this.getArgByName("load_dtd").getALocalSource().asExpr() = any(True t) and