hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: One family to rule them all...

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2021-04-07 08:32:21 +02:00
parent a0e3e3afaf
commit f22db2a30b
1 changed files with 4 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
python/ql/src/Security/CWE-327/TlsLibraryModel.qll
View File

@@ -71,15 +71,10 @@ abstract class UnspecificContextCreation extends ContextCreation, ProtocolUnrest
override DataFlow::CfgNode getContext() { result = this }
override ProtocolVersion getUnrestriction() {
// see https://www.openssl.org/docs/man1.1.0/man3/TLS_method.html
family = "TLS" and
result in ["SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
or
// This can negotiate a TLS 1.3 connection (!)
// see
// - https://docs.python.org/3/library/ssl.html#ssl-contexts
// - https://www.openssl.org/docs/man1.0.2/man3/TLSv1_method.html
family = "SSLv23" and
// There is only one family, the two names are aliases in OpenSSL.
// see https://github.com/openssl/openssl/blob/13888e797c5a3193e91d71e5f5a196a2d68d266f/include/openssl/ssl.h.in#L1953-L1955
family in ["SSLv23", "TLS"] and
// see https://docs.python.org/3/library/ssl.html#ssl-contexts
result in ["SSLv2", "SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2", "TLSv1_3"]
}
}