hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #16771 from porcupineyhairs/js2py

Browse Source 
Python : Arbitrary code execution due to Js2Py
This commit is contained in:
Rasmus Wriedt Larsen
2024-07-11 15:31:57 +02:00
committed by GitHub
parent 8152ec7472 5ecde387af
commit f41d2a896c
7 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
python/ql/test/experimental/query-tests/Security/CWE-094/Js2Py.expected Normal file
View File

@@ -0,0 +1,10 @@
edges
| Js2PyTest.py:9:5:9:6 | ControlFlowNode for jk | Js2PyTest.py:10:18:10:28 | ControlFlowNode for Fstring | provenance | |
| Js2PyTest.py:9:10:9:22 | ControlFlowNode for Attribute | Js2PyTest.py:9:5:9:6 | ControlFlowNode for jk | provenance | AdditionalTaintStep |
nodes
| Js2PyTest.py:9:5:9:6 | ControlFlowNode for jk | semmle.label | ControlFlowNode for jk |
| Js2PyTest.py:9:10:9:22 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
| Js2PyTest.py:10:18:10:28 | ControlFlowNode for Fstring | semmle.label | ControlFlowNode for Fstring |
subpaths
#select
| Js2PyTest.py:10:18:10:28 | ControlFlowNode for Fstring | Js2PyTest.py:9:10:9:22 | ControlFlowNode for Attribute | Js2PyTest.py:10:18:10:28 | ControlFlowNode for Fstring | This input to Js2Py depends on a $@. | Js2PyTest.py:9:10:9:22 | ControlFlowNode for Attribute | user-provided value |

1
python/ql/test/experimental/query-tests/Security/CWE-094/Js2Py.qlref Normal file
View File

@@ -0,0 +1 @@
experimental/Security/CWE-094/Js2Py.ql

10
python/ql/test/experimental/query-tests/Security/CWE-094/Js2PyTest.py Normal file
View File

@@ -0,0 +1,10 @@
import flask
from js2py import eval_js, disable_pyimport
bp = flask.Blueprint("app", __name__, url_prefix="/")
@bp.route("/bad")
def bad():
jk = flask.request.form["jk"]
jk = eval_js(f"{jk} f()")