mirror of
https://github.com/github/codeql.git
synced 2025-12-20 02:44:30 +01:00
3e7dc12246
The meat of this PR is described in the new python/ql/test/experimental/meta/InlineTaintTest.qll file: > Defines a InlineExpectationsTest for checking whether any arguments in > `ensure_tainted` and `ensure_not_tainted` calls are tainted. > > Also defines query predicates to ensure that: > - if any arguments to `ensure_not_tainted` are tainted, their annotation is marked with `SPURIOUS`. > - if any arguments to `ensure_tainted` are not tainted, their annotation is marked with `MISSING`. > > The functionality of this module is tested in `ql/test/experimental/meta/inline-taint-test-demo`.
55 lines
1.6 KiB
Python
55 lines
1.6 KiB
Python
import sys; import os; sys.path.append(os.path.dirname(os.path.dirname((__file__))))
|
|
from taintlib import *
|
|
|
|
# Various instances where flow is undesirable
|
|
|
|
|
|
# A global variable that starts out being not tainted, but gets tainted through a later assignment.
|
|
# In this case, we do not want flow from the tainting assignment back to the place where the value
|
|
# was used in a potentially unsafe manner.
|
|
|
|
tainted_later = NOT_TAINTED
|
|
ensure_not_tainted(tainted_later)
|
|
|
|
def write_global():
|
|
global tainted_later
|
|
tainted_later = TAINTED_STRING
|
|
|
|
|
|
# A global variable that starts out tainted, and is subsequently reassigned to be untainted.
|
|
# In this case we don't want flow from the first assignment to any of its uses.
|
|
|
|
initially_tainted = TAINTED_STRING
|
|
len(initially_tainted) # Some call that _could_ potentially modify `initially_tainted`
|
|
initially_tainted = NOT_TAINTED
|
|
ensure_not_tainted(initially_tainted)
|
|
|
|
def use_of_initially_tainted():
|
|
ensure_not_tainted(initially_tainted) # $ SPURIOUS: tainted
|
|
|
|
|
|
# A very similar case to the above, but here we _do_ want taint flow, because the initially tainted
|
|
# value is actually used before it gets reassigned to an untainted value.
|
|
|
|
def use_of_initially_tainted2():
|
|
ensure_tainted(initially_tainted2) # $ tainted
|
|
|
|
initially_tainted2 = TAINTED_STRING
|
|
use_of_initially_tainted2()
|
|
initially_tainted2 = NOT_TAINTED
|
|
ensure_not_tainted(initially_tainted2)
|
|
|
|
|
|
# Flow via global assignment
|
|
|
|
def write_tainted():
|
|
global g
|
|
g = TAINTED_STRING
|
|
|
|
def sink_global():
|
|
ensure_tainted(g) # $ tainted
|
|
|
|
write_global()
|
|
write_tainted()
|
|
sink_global()
|