The current PAM auth bypass query which was contributed by me a few months back, alert on a vulenrable function but does not check if the function is actually function. This leads to a lot of fasle positives.
With this PR, I add a taint-tracking configuration to check if the username parameter can actually be supplied by an attacker.
This should bring the FP's significantly down.
Depending on `localFlowStep` meant that this predicate ended up being
recursive with itself (by way of flow summaries which depend on API
graphs, which in turn depend on import resolution).
Changing this to use the simple local flow step predicate that we use
for type tracking should fix this issue.
This was causing issues with imports with many "dots" in the name.
Previously, the test added in this commit would not have the desired
result for the `check` call.
This was due to bad manual magic: restricting the attribute name makes
sense when we're talking about submodules of a package, but it doesn't
when we're talking about reexported modules.
Also (hopefully) fixes the tests so that the Python 3-specific bits are
ignored under Python 2.
- Swaps `module_reference_in_scope` and `module_name_in_scope`.
- uses `AttrRead::accesses` instead of `getObject`, etc.
- Removes an errant `none()`.
- Expands the QLDoc for some of the predicates.
I could have sworn I added all of them to the batch, but somehow these slipped through.
Co-authored-by: yoff <lerchedahl@gmail.com>
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
A fairly complicated bit of modelling, mostly due to the quirks of
how imports are handled in Python.
A few notes:
- The handling of `__all__` is not actually needed (and perhaps not
desirable, as it only pertains to `import *`, though it does match
the current behaviour), but it might become useful at a later date,
so I left it in.
- Ideally, we would represent `foo as bar` in an `import` as a
`DefinitionNode` in the CFG. I opted _not_ to do this, as it would
also affect points-to, and I did not want to deal with any fallout
arising from that.
