hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix Sink utilization in select

Browse Source
This commit is contained in:
jorgectf
2021-03-27 19:54:30 +01:00
parent a5850f4a99
commit f75110365f
2 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
python/ql/src/experimental/Security/CWE-730/RegexInjection.ql
View File

@@ -16,13 +16,10 @@ import python
import experimental.semmle.python.security.injection.RegexInjection
import DataFlow::PathGraph
from
RegexInjectionFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink,
RegexInjectionSink castedSink
where
config.hasFlowPath(source, sink) and
castedSink = sink.getNode()
from RegexInjectionFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink,
"$@ regular expression is constructed from a $@ and executed by $@.", sink.getNode(), "This",
source.getNode(), "user-provided value", castedSink,
castedSink.getRegexModule() + "." + castedSink.asExpr().(Attribute).getName()
source.getNode(), "user-provided value", sink.getNode(),
sink.getNode().(RegexInjectionSink).getRegexModule() + "." +
sink.getNode().(RegexInjectionSink).getRegexMethod().getName()

6
python/ql/src/experimental/semmle/python/security/injection/RegexInjection.qll
View File

@@ -11,15 +11,19 @@ import semmle.python.dataflow.new.RemoteFlowSources
class RegexInjectionSink extends DataFlow::Node {
string regexModule;
Attribute regexMethod;
RegexInjectionSink() {
exists(RegexExecution reExec |
this = reExec.getRegexNode() and
regexModule = reExec.getRegexModule()
regexModule = reExec.getRegexModule() and
regexMethod = reExec.(DataFlow::CallCfgNode).getFunction().asExpr().(Attribute)
)
}
string getRegexModule() { result = regexModule }
Attribute getRegexMethod() { result = regexMethod }
}
/**