diff --git a/python/ql/src/experimental/semmle/python/Concepts.qll b/python/ql/src/experimental/semmle/python/Concepts.qll index 01d6707e6ce..ec9fa570b71 100644 --- a/python/ql/src/experimental/semmle/python/Concepts.qll +++ b/python/ql/src/experimental/semmle/python/Concepts.qll @@ -42,7 +42,7 @@ module SystemCommandExecution { /** * A data-flow node that decodes data from a binary or textual format. This * is intended to include deserialization, unmarshalling, decoding, unpickling, - * unzipping, decrypting, parsing etc. + * decompressing, decrypting, parsing etc. * * Doing so should normally preserve taint, but it can also be a problem * in itself, e.g. if it allows code execution or could result in deinal-of-service. diff --git a/python/ql/test/experimental/library-tests/frameworks/dill/Decoding.py b/python/ql/test/experimental/library-tests/frameworks/dill/Decoding.py index 523f9a0a346..cff3a8292d4 100644 --- a/python/ql/test/experimental/library-tests/frameworks/dill/Decoding.py +++ b/python/ql/test/experimental/library-tests/frameworks/dill/Decoding.py @@ -1,4 +1,3 @@ import dill -dill.loads(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=dill $decodeUnsafe= -dill.loads(payload, encoding='latin1') # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=dill $decodeUnsafe= +dill.loads(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=dill $decodeUnsafe diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py b/python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py index 41bd019e6f0..8c25a253a99 100644 --- a/python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py +++ b/python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py @@ -10,6 +10,5 @@ app = Flask(__name__) @app.route("/") def hello(): payload = request.args.get("payload") - pickle.loads(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=pickle $decodeUnsafe= - pickle.loads(payload, encoding='latin1') # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=pickle $decodeUnsafe= - marshal.loads(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=pickle $decodeUnsafe= + pickle.loads(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=pickle $decodeUnsafe + marshal.loads(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=pickle $decodeUnsafe diff --git a/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py b/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py index 201e0e3c0a6..5503e53ac4a 100644 --- a/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py +++ b/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py @@ -10,5 +10,5 @@ app = Flask(__name__) @app.route("/") def hello(): payload = request.args.get("payload") - yaml.load(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=YAML $decodeUnsafe= + yaml.load(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=YAML $decodeUnsafe yaml.load(payload, Loader=SafeLoader) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=YAML