hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 02:44:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix taint configs

Browse Source
This commit is contained in:
jorgectf
2021-04-01 12:50:25 +02:00
parent c8740a2031
commit f980d0694b
2 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/ql/src/experimental/Security/CWE-943/NoSQLInjection.ql
View File

@@ -13,7 +13,6 @@
import python
import experimental.semmle.python.security.injection.NoSQLInjection
// https://github.com/github/codeql/blob/e266cedc84cf73d01c9b2d4b0e4313e5d96755ba/python/ql/src/semmle/python/security/dataflow/PathInjection.qll#L103
from CustomPathNode source, CustomPathNode sink
where noSQLInjectionFlow(source, sink)
select source, sink

11
python/ql/src/experimental/semmle/python/security/injection/NoSQLInjection.qll
View File

@@ -36,8 +36,8 @@ class JSONRelatedSink extends DataFlow::Node {
}
}
class NoSQLInjectionConfig extends TaintTracking::Configuration {
NoSQLInjectionConfig() { this = "NoSQLInjectionConfig" }
class RFStoJSON extends TaintTracking::Configuration {
RFStoJSON() { this = "RFStoJSON" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -49,8 +49,8 @@ class NoSQLInjectionConfig extends TaintTracking::Configuration {
}
// better name?
class FromJSONConfig extends TaintTracking2::Configuration {
FromJSONConfig() { this = "FromJSONConfig" }
class FromJSONtoSink extends TaintTracking2::Configuration {
FromJSONtoSink() { this = "FromJSONtoSink" }
override predicate isSource(DataFlow::Node source) { source instanceof JSONRelatedSink }
@@ -65,8 +65,7 @@ class FromJSONConfig extends TaintTracking2::Configuration {
predicate noSQLInjectionFlow(CustomPathNode source, CustomPathNode sink) {
exists(
FromJSONConfig config, DataFlow::PathNode mid1, DataFlow2::PathNode mid2,
NoSQLInjectionConfig config2
RFStoJSON config, DataFlow::PathNode mid1, DataFlow2::PathNode mid2, FromJSONtoSink config2
|
config.hasFlowPath(source.asNode1(), mid1) and
config2.hasFlowPath(mid2, sink.asNode2()) and