hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 20:58:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model sensitive data based on parameter names

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-06-03 14:25:15 +02:00
parent 925e67d734
commit f5fd0f8d1c
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
python/ql/src/semmle/python/dataflow/new/SensitiveDataSources.qll
View File

@@ -149,4 +149,15 @@ private module SensitiveDataModeling {
override SensitiveDataClassification getClassification() { result = classification }
}
/** A parameter where the name indicates it will receive sensitive data. */
class SensitiveParameter extends SensitiveDataSource::Range, DataFlow::ParameterNode {
SensitiveDataClassification classification;
SensitiveParameter() {
nameIndicatesSensitiveData(this.getParameter().getName(), classification)
}
override SensitiveDataClassification getClassification() { result = classification }
}
}

5
python/ql/test/experimental/dataflow/sensitive-data/test.py
View File

@@ -29,7 +29,10 @@ foo = ObjectFromDatabase()
foo.secret # $ SensitiveDataSource=secret
foo.username # $ SensitiveDataSource=id
# plain variables
# based on variable/parameter names
def my_func(password): # $ SensitiveDataSource=password
print(password) # $ SensitiveUse=password
password = some_function()
print(password) # $ MISSING: SensitiveUse=password