hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add support for x in ["safe", "also_safe"] (and not in)

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2020-11-23 10:42:24 +01:00
parent 431aab45f7
commit f35ffa5632
2 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
View File

@@ -372,6 +372,26 @@ module BarrierGuard {
or
this.operands(checked_node, op, str_const.getAFlowNode())
)
or
exists(ControlFlowNode str_const_iterable, Cmpop op |
op = any(In in_) and safe_branch = true
or
op = any(NotIn ni) and safe_branch = false
|
this.operands(checked_node, op, str_const_iterable) and
(
str_const_iterable instanceof SequenceNode
or
str_const_iterable instanceof SetNode
) and
forall(ControlFlowNode elem |
elem = str_const_iterable.(SequenceNode).getAnElement()
or
elem = str_const_iterable.(SetNode).getAnElement()
|
elem.getNode() instanceof StrConst
)
)
}
override predicate checks(ControlFlowNode node, boolean branch) {

8
python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.expected
View File

@@ -9,18 +9,18 @@
| test_string_const_compare.py:45 | ok | test_non_eq1 | ts |
| test_string_const_compare.py:51 | ok | test_non_eq2 | ts |
| test_string_const_compare.py:53 | fail | test_non_eq2 | ts |
| test_string_const_compare.py:59 | fail | test_in_list | ts |
| test_string_const_compare.py:59 | ok | test_in_list | ts |
| test_string_const_compare.py:61 | ok | test_in_list | ts |
| test_string_const_compare.py:67 | fail | test_in_tuple | ts |
| test_string_const_compare.py:67 | ok | test_in_tuple | ts |
| test_string_const_compare.py:69 | ok | test_in_tuple | ts |
| test_string_const_compare.py:75 | fail | test_in_set | ts |
| test_string_const_compare.py:75 | ok | test_in_set | ts |
| test_string_const_compare.py:77 | ok | test_in_set | ts |
| test_string_const_compare.py:83 | ok | test_in_unsafe1 | ts |
| test_string_const_compare.py:85 | ok | test_in_unsafe1 | ts |
| test_string_const_compare.py:91 | ok | test_in_unsafe2 | ts |
| test_string_const_compare.py:93 | ok | test_in_unsafe2 | ts |
| test_string_const_compare.py:99 | ok | test_not_in1 | ts |
| test_string_const_compare.py:101 | fail | test_not_in1 | ts |
| test_string_const_compare.py:101 | ok | test_not_in1 | ts |
| test_string_const_compare.py:107 | ok | test_not_in2 | ts |
| test_string_const_compare.py:109 | fail | test_not_in2 | ts |
| test_string_const_compare.py:119 | fail | test_eq_thorugh_func | ts |