hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2888 from RasmusWL/python-tarslip-sanitizer

Browse Source 
Python: Improve tarslip sanitizer
This commit is contained in:
Taus
2020-03-24 12:59:20 +01:00
committed by GitHub
parent 4c9a6b73ee dcfc9a8796
commit fe00d1cbf4
3 changed files with 49 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
python/ql/src/Security/CWE-022/TarSlip.ql
View File

@@ -121,9 +121,19 @@ class ExtractMembersSink extends TaintSink {
class TarFileInfoSanitizer extends Sanitizer {
TarFileInfoSanitizer() { this = "TarInfo sanitizer" }
/** The test `if <path_sanitizing_test>:` clears taint on its `false` edge. */
override predicate sanitizingEdge(TaintKind taint, PyEdgeRefinement test) {
path_sanitizing_test(test.getTest()) and
taint instanceof TarFileInfo
taint instanceof TarFileInfo and
clears_taint_on_false_edge(test.getTest(), test.getSense())
}
private predicate clears_taint_on_false_edge(ControlFlowNode test, boolean sense) {
path_sanitizing_test(test) and
sense = false
or
// handle `not` (also nested)
test.(UnaryExprNode).getNode().getOp() instanceof Not and
clears_taint_on_false_edge(test.(UnaryExprNode).getOperand(), sense.booleanNot())
}
}