hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix taint configs

Browse Source
This commit is contained in:
jorgectf
2021-04-01 12:50:25 +02:00
parent c8740a2031
commit f980d0694b
2 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/ql/src/experimental/Security/CWE-943/NoSQLInjection.ql
View File

@@ -13,7 +13,6 @@
import python import python
import experimental.semmle.python.security.injection.NoSQLInjection import experimental.semmle.python.security.injection.NoSQLInjection
// https://github.com/github/codeql/blob/e266cedc84cf73d01c9b2d4b0e4313e5d96755ba/python/ql/src/semmle/python/security/dataflow/PathInjection.qll#L103
from CustomPathNode source, CustomPathNode sink from CustomPathNode source, CustomPathNode sink
where noSQLInjectionFlow(source, sink) where noSQLInjectionFlow(source, sink)
select source, sink select source, sink

11
python/ql/src/experimental/semmle/python/security/injection/NoSQLInjection.qll
View File

@@ -36,8 +36,8 @@ class JSONRelatedSink extends DataFlow::Node {
} }
} }
class NoSQLInjectionConfig extends TaintTracking::Configuration { class RFStoJSON extends TaintTracking::Configuration {
NoSQLInjectionConfig() { this = "NoSQLInjectionConfig" } RFStoJSON() { this = "RFStoJSON" }
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -49,8 +49,8 @@ class NoSQLInjectionConfig extends TaintTracking::Configuration {
} }
// better name? // better name?
class FromJSONConfig extends TaintTracking2::Configuration { class FromJSONtoSink extends TaintTracking2::Configuration {
FromJSONConfig() { this = "FromJSONConfig" } FromJSONtoSink() { this = "FromJSONtoSink" }
override predicate isSource(DataFlow::Node source) { source instanceof JSONRelatedSink } override predicate isSource(DataFlow::Node source) { source instanceof JSONRelatedSink }
@@ -65,8 +65,7 @@ class FromJSONConfig extends TaintTracking2::Configuration {
predicate noSQLInjectionFlow(CustomPathNode source, CustomPathNode sink) { predicate noSQLInjectionFlow(CustomPathNode source, CustomPathNode sink) {
exists( exists(
FromJSONConfig config, DataFlow::PathNode mid1, DataFlow2::PathNode mid2, RFStoJSON config, DataFlow::PathNode mid1, DataFlow2::PathNode mid2, FromJSONtoSink config2
NoSQLInjectionConfig config2
| |
config.hasFlowPath(source.asNode1(), mid1) and config.hasFlowPath(source.asNode1(), mid1) and
config2.hasFlowPath(mid2, sink.asNode2()) and config2.hasFlowPath(mid2, sink.asNode2()) and