diff --git a/python/ql/src/Security/CWE-022/PathInjection.ql b/python/ql/src/Security/CWE-022/PathInjection.ql index ac1c768d4e3..dce99581973 100644 --- a/python/ql/src/Security/CWE-022/PathInjection.ql +++ b/python/ql/src/Security/CWE-022/PathInjection.ql @@ -14,7 +14,18 @@ * external/cwe/cwe-036 * external/cwe/cwe-073 * external/cwe/cwe-099 - * + */ + +import python +import semmle.python.dataflow.new.DataFlow +import semmle.python.dataflow.new.DataFlow2 +import semmle.python.dataflow.new.TaintTracking +import semmle.python.dataflow.new.TaintTracking2 +import semmle.python.Concepts +import semmle.python.dataflow.new.RemoteFlowSources +import ChainedConfigs12 + +/* * The query detects cases where a user-controlled path is used in an unsafe manner, * meaning it is not both normalized and _afterwards_ checked. * @@ -36,15 +47,6 @@ * to a sink. */ -import python -import semmle.python.dataflow.new.DataFlow -import semmle.python.dataflow.new.DataFlow2 -import semmle.python.dataflow.new.TaintTracking -import semmle.python.dataflow.new.TaintTracking2 -import semmle.python.Concepts -import semmle.python.dataflow.new.RemoteFlowSources -import ChainedConfigs12 - // --------------------------------------------------------------------------- // Case 1. The path is never normalized. // ---------------------------------------------------------------------------