hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 10:23:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix select for py/cookie-injection

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2022-05-11 13:16:28 +02:00
parent 27b99c51e9
commit fc8633cc01
2 changed files with 69 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
python/ql/src/experimental/Security/CWE-614/CookieInjection.ql
View File

@@ -1,7 +1,7 @@
/**
* @name Construction of a cookie using user-supplied input.
* @description Constructing cookies from user input may allow an attacker to perform a Cookie Poisoning attack.
* @kind problem
* @kind path-problem
* @problem.severity error
* @id py/cookie-injection
* @tags security
@@ -14,6 +14,7 @@ import semmle.python.dataflow.new.DataFlow
import experimental.semmle.python.Concepts
import experimental.semmle.python.CookieHeader
import experimental.semmle.python.security.injection.CookieInjection
import DataFlow::PathGraph
from
CookieInjectionFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink,
@@ -21,7 +22,7 @@ from
where
config.hasFlowPath(source, sink) and
if exists(sink.getNode().(CookieSink))
then insecure = "and its " + sink.getNode().(CookieSink).getFlag() + " flag is not properly set"
else insecure = ""
select sink.getNode(), "Cookie is constructed from a", source.getNode(), "user-supplied input",
insecure
then insecure = ",and its " + sink.getNode().(CookieSink).getFlag() + " flag is not properly set."
else insecure = "."
select sink.getNode(), source, sink, "Cookie is constructed from a $@" + insecure, source.getNode(),
"user-supplied input"