hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-04 17:33:18 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
yoff/python-cfg-modelling-exceptions
codeql/python/ql/test/experimental/query-tests/Security/CWE-022-UnsafeUnpacking/UnsafeUnpack.expected
yoff 408ba6218f Python: switch dataflow library to new (shared) CFG + SSA 
Flips the Python dataflow trunk from the legacy CFG (semmle/python/Flow.qll)
and legacy ESSA SSA (semmle/python/essa/*) to the new shared CFG facade
(semmle.python.controlflow.internal.Cfg) and the new SSA adapter
(semmle.python.dataflow.new.internal.SsaImpl), both introduced
additively in the preceding PRs in this stack.

This is the trunk-flip equivalent of the original draft PR #21894 (kept
around as documentation), rebased on top of the four preparatory PRs:

  P1: Remove AstNode.getAFlowNode() and rewrite callers (#21919).
  P2: Qualify Flow.qll's AST references with Py:: prefix (#21920).
  P3: Add new shared-CFG-backed control flow graph (#21921).
  P4: Add new shared-SSA-backed SSA adapter (#21923).

The Python dataflow library (semmle/python/dataflow/new/) now imports
the new CFG facade and SSA adapter. All CFG-typed predicates
(ControlFlowNode, CallNode, BasicBlock, NameNode, AttrNode, ...) are
qualified with the Cfg:: prefix; SSA references switch from
EssaVariable/EssaDefinition to SsaImpl::Definition/SourceVariable.

GuardNode is redesigned to use the new CFG's outcome-node model
(isAfterTrue / isAfterFalse) instead of the legacy ConditionBlock +
flipped indirection. Only BarrierGuard<...> is preserved as public
API.

Framework files (Bottle, FastApi, Django, Tornado, Pyramid, Stdlib,
...) are updated to take CFG nodes from the new facade.

A handful of dataflow consistency tweaks for the new CFG:
- Augmented-assignment targets are treated as both load and store.
- 'from X import *' produces uncertain SSA writes for unknown names.
- CFG nodes are canonicalised so dataflow does not see equivalent
  pre/post-order pairs as distinct nodes.

Two AST tweaks for the new CFG:
- AstNodeImpl: omit PEP 695 type-parameter names from
  FunctionDefExpr / ClassDefExpr children.
- ImportResolution: drop the legacy essa import.

Test churn (~175 files): reblessed library- and query-test .expected
files reflect slightly different CFG granularity, different toString
output, and a handful of true alert deltas in security queries.

Verification: all 367 lib + src + consistency-queries compile clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-22 13:46:43 +00:00

209 lines
20 KiB
Plaintext
Raw Permalink Blame History

#select
| UnsafeUnpack.py:19:35:19:41 | tarpath | UnsafeUnpack.py:5:26:5:32 | After ImportMember | UnsafeUnpack.py:19:35:19:41 | tarpath | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:34:23:34:38 | local_ziped_path | UnsafeUnpack.py:33:50:33:65 | local_ziped_path | UnsafeUnpack.py:34:23:34:38 | local_ziped_path | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:48:23:48:37 | compressed_file | UnsafeUnpack.py:47:20:47:34 | compressed_file | UnsafeUnpack.py:48:23:48:37 | compressed_file | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:52:23:52:37 | compressed_file | UnsafeUnpack.py:51:19:51:36 | After Attribute() | UnsafeUnpack.py:52:23:52:37 | compressed_file | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:66:23:66:37 | compressed_file | UnsafeUnpack.py:65:19:65:31 | After Attribute | UnsafeUnpack.py:66:23:66:37 | compressed_file | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:87:23:87:29 | tarpath | UnsafeUnpack.py:79:16:79:28 | After Attribute | UnsafeUnpack.py:87:23:87:29 | tarpath | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:105:35:105:42 | savepath | UnsafeUnpack.py:103:32:103:44 | After Attribute | UnsafeUnpack.py:105:35:105:42 | savepath | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:112:35:112:43 | file_path | UnsafeUnpack.py:108:22:108:34 | After Attribute | UnsafeUnpack.py:112:35:112:43 | file_path | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:120:41:120:58 | uploaded_file_path | UnsafeUnpack.py:116:27:116:39 | After Attribute | UnsafeUnpack.py:120:41:120:58 | uploaded_file_path | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:142:49:142:51 | tar | UnsafeUnpack.py:140:23:140:35 | After Attribute | UnsafeUnpack.py:142:49:142:51 | tar | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:167:67:167:72 | result | UnsafeUnpack.py:158:32:158:44 | After Attribute | UnsafeUnpack.py:167:67:167:72 | result | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:176:1:176:34 | After Attribute() | UnsafeUnpack.py:79:16:79:28 | After Attribute | UnsafeUnpack.py:176:1:176:34 | After Attribute() | Unsafe extraction from a malicious tarball retrieved from a remote location. |
| UnsafeUnpack.py:201:29:201:36 | After Attribute | UnsafeUnpack.py:194:53:194:55 | tmp | UnsafeUnpack.py:201:29:201:36 | After Attribute | Unsafe extraction from a malicious tarball retrieved from a remote location. |
edges
| UnsafeUnpack.py:5:26:5:32 | After ImportMember | UnsafeUnpack.py:5:26:5:32 | request | provenance | |
| UnsafeUnpack.py:5:26:5:32 | request | UnsafeUnpack.py:11:18:11:24 | request | provenance | |
| UnsafeUnpack.py:11:7:11:14 | filename | UnsafeUnpack.py:13:24:13:58 | After Attribute() | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:11:18:11:24 | request | UnsafeUnpack.py:11:18:11:29 | After Attribute | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:11:18:11:29 | After Attribute | UnsafeUnpack.py:11:18:11:49 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:11:18:11:29 | After Attribute | UnsafeUnpack.py:11:18:11:49 | After Attribute() | provenance | dict.get |
| UnsafeUnpack.py:11:18:11:49 | After Attribute() | UnsafeUnpack.py:11:7:11:14 | filename | provenance | |
| UnsafeUnpack.py:13:13:13:20 | response | UnsafeUnpack.py:17:27:17:34 | response | provenance | |
| UnsafeUnpack.py:13:24:13:58 | After Attribute() | UnsafeUnpack.py:13:13:13:20 | response | provenance | |
| UnsafeUnpack.py:16:23:16:29 | tarpath | UnsafeUnpack.py:19:35:19:41 | tarpath | provenance | |
| UnsafeUnpack.py:17:19:17:19 | f | UnsafeUnpack.py:16:23:16:29 | tarpath | provenance | Config |
| UnsafeUnpack.py:17:27:17:34 | response | UnsafeUnpack.py:17:27:17:38 | After Attribute | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:17:27:17:34 | response | UnsafeUnpack.py:17:27:17:38 | After Attribute | provenance | Config |
| UnsafeUnpack.py:17:27:17:38 | After Attribute | UnsafeUnpack.py:17:27:17:45 | After Attribute() | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:17:27:17:38 | After Attribute | UnsafeUnpack.py:17:27:17:45 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:17:27:17:45 | After Attribute() | UnsafeUnpack.py:17:19:17:19 | f | provenance | Config |
| UnsafeUnpack.py:33:50:33:65 | local_ziped_path | UnsafeUnpack.py:34:23:34:38 | local_ziped_path | provenance | |
| UnsafeUnpack.py:47:20:47:34 | compressed_file | UnsafeUnpack.py:48:23:48:37 | compressed_file | provenance | |
| UnsafeUnpack.py:51:1:51:15 | compressed_file | UnsafeUnpack.py:52:23:52:37 | compressed_file | provenance | |
| UnsafeUnpack.py:51:19:51:36 | After Attribute() | UnsafeUnpack.py:51:1:51:15 | compressed_file | provenance | |
| UnsafeUnpack.py:65:1:65:15 | compressed_file | UnsafeUnpack.py:66:23:66:37 | compressed_file | provenance | |
| UnsafeUnpack.py:65:19:65:31 | After Attribute | UnsafeUnpack.py:65:1:65:15 | compressed_file | provenance | |
| UnsafeUnpack.py:79:1:79:12 | url_filename | UnsafeUnpack.py:81:12:81:50 | After Attribute() | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:79:1:79:12 | url_filename | UnsafeUnpack.py:171:12:171:50 | After Attribute() | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:79:16:79:28 | After Attribute | UnsafeUnpack.py:79:1:79:12 | url_filename | provenance | |
| UnsafeUnpack.py:81:1:81:8 | response | UnsafeUnpack.py:85:15:85:22 | response | provenance | |
| UnsafeUnpack.py:81:12:81:50 | After Attribute() | UnsafeUnpack.py:81:1:81:8 | response | provenance | |
| UnsafeUnpack.py:84:11:84:17 | tarpath | UnsafeUnpack.py:87:23:87:29 | tarpath | provenance | |
| UnsafeUnpack.py:85:7:85:7 | f | UnsafeUnpack.py:84:11:84:17 | tarpath | provenance | Config |
| UnsafeUnpack.py:85:15:85:22 | response | UnsafeUnpack.py:85:15:85:26 | After Attribute | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:85:15:85:22 | response | UnsafeUnpack.py:85:15:85:26 | After Attribute | provenance | Config |
| UnsafeUnpack.py:85:15:85:26 | After Attribute | UnsafeUnpack.py:85:15:85:33 | After Attribute() | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:85:15:85:26 | After Attribute | UnsafeUnpack.py:85:15:85:33 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:85:15:85:33 | After Attribute() | UnsafeUnpack.py:85:7:85:7 | f | provenance | Config |
| UnsafeUnpack.py:102:23:102:30 | savepath | UnsafeUnpack.py:105:35:105:42 | savepath | provenance | |
| UnsafeUnpack.py:103:23:103:27 | chunk | UnsafeUnpack.py:104:37:104:41 | chunk | provenance | |
| UnsafeUnpack.py:103:32:103:44 | After Attribute | UnsafeUnpack.py:103:32:103:54 | After Subscript | provenance | |
| UnsafeUnpack.py:103:32:103:54 | After Subscript | UnsafeUnpack.py:103:32:103:63 | After Attribute() [empty] | provenance | Config |
| UnsafeUnpack.py:103:32:103:63 | After Attribute() [empty] | UnsafeUnpack.py:103:23:103:27 | chunk | provenance | |
| UnsafeUnpack.py:104:25:104:29 | wfile | UnsafeUnpack.py:102:23:102:30 | savepath | provenance | Config |
| UnsafeUnpack.py:104:37:104:41 | chunk | UnsafeUnpack.py:104:25:104:29 | wfile | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:104:37:104:41 | chunk | UnsafeUnpack.py:104:25:104:29 | wfile | provenance | Config |
| UnsafeUnpack.py:108:13:108:18 | myfile | UnsafeUnpack.py:111:27:111:32 | myfile | provenance | |
| UnsafeUnpack.py:108:22:108:34 | After Attribute | UnsafeUnpack.py:108:22:108:48 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:108:22:108:34 | After Attribute | UnsafeUnpack.py:108:22:108:48 | After Attribute() | provenance | dict.get |
| UnsafeUnpack.py:108:22:108:48 | After Attribute() | UnsafeUnpack.py:108:13:108:18 | myfile | provenance | |
| UnsafeUnpack.py:110:18:110:26 | file_path | UnsafeUnpack.py:112:35:112:43 | file_path | provenance | |
| UnsafeUnpack.py:111:19:111:19 | f | UnsafeUnpack.py:110:18:110:26 | file_path | provenance | Config |
| UnsafeUnpack.py:111:27:111:32 | myfile | UnsafeUnpack.py:111:27:111:39 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:111:27:111:39 | After Attribute() | UnsafeUnpack.py:111:19:111:19 | f | provenance | Config |
| UnsafeUnpack.py:116:17:116:21 | ufile | UnsafeUnpack.py:118:38:118:42 | ufile | provenance | |
| UnsafeUnpack.py:116:27:116:39 | After Attribute | UnsafeUnpack.py:116:27:116:49 | After Attribute() [empty] | provenance | Config |
| UnsafeUnpack.py:116:27:116:49 | After Attribute() [empty] | UnsafeUnpack.py:116:17:116:21 | ufile | provenance | |
| UnsafeUnpack.py:118:19:118:26 | filename | UnsafeUnpack.py:119:48:119:55 | filename | provenance | |
| UnsafeUnpack.py:118:30:118:55 | After Attribute() | UnsafeUnpack.py:118:19:118:26 | filename | provenance | |
| UnsafeUnpack.py:118:38:118:42 | ufile | UnsafeUnpack.py:118:38:118:47 | After Attribute | provenance | Config |
| UnsafeUnpack.py:118:38:118:47 | After Attribute | UnsafeUnpack.py:118:30:118:55 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:119:19:119:36 | uploaded_file_path | UnsafeUnpack.py:120:41:120:58 | uploaded_file_path | provenance | |
| UnsafeUnpack.py:119:40:119:56 | After Attribute() | UnsafeUnpack.py:119:19:119:36 | uploaded_file_path | provenance | |
| UnsafeUnpack.py:119:48:119:55 | filename | UnsafeUnpack.py:119:40:119:56 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:140:1:140:19 | unsafe_filename_tar | UnsafeUnpack.py:141:22:141:40 | unsafe_filename_tar | provenance | |
| UnsafeUnpack.py:140:23:140:35 | After Attribute | UnsafeUnpack.py:140:1:140:19 | unsafe_filename_tar | provenance | |
| UnsafeUnpack.py:141:6:141:51 | After Attribute() | UnsafeUnpack.py:141:56:141:58 | tar | provenance | |
| UnsafeUnpack.py:141:22:141:40 | unsafe_filename_tar | UnsafeUnpack.py:141:6:141:51 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:141:56:141:58 | tar | UnsafeUnpack.py:142:49:142:51 | tar | provenance | |
| UnsafeUnpack.py:157:23:157:30 | savepath | UnsafeUnpack.py:161:38:161:45 | savepath | provenance | |
| UnsafeUnpack.py:158:23:158:27 | chunk | UnsafeUnpack.py:159:37:159:41 | chunk | provenance | |
| UnsafeUnpack.py:158:32:158:44 | After Attribute | UnsafeUnpack.py:158:32:158:54 | After Subscript | provenance | |
| UnsafeUnpack.py:158:32:158:54 | After Subscript | UnsafeUnpack.py:158:32:158:63 | After Attribute() [empty] | provenance | Config |
| UnsafeUnpack.py:158:32:158:63 | After Attribute() [empty] | UnsafeUnpack.py:158:23:158:27 | chunk | provenance | |
| UnsafeUnpack.py:159:25:159:29 | wfile | UnsafeUnpack.py:157:23:157:30 | savepath | provenance | Config |
| UnsafeUnpack.py:159:37:159:41 | chunk | UnsafeUnpack.py:159:25:159:29 | wfile | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:159:37:159:41 | chunk | UnsafeUnpack.py:159:25:159:29 | wfile | provenance | Config |
| UnsafeUnpack.py:161:19:161:21 | tar | UnsafeUnpack.py:163:33:163:35 | After tar [empty] | provenance | |
| UnsafeUnpack.py:161:25:161:46 | After Attribute() | UnsafeUnpack.py:161:19:161:21 | tar | provenance | |
| UnsafeUnpack.py:161:38:161:45 | savepath | UnsafeUnpack.py:161:25:161:46 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:161:38:161:45 | savepath | UnsafeUnpack.py:161:25:161:46 | After Attribute() | provenance | MaD:1 |
| UnsafeUnpack.py:163:23:163:28 | member | UnsafeUnpack.py:164:26:164:31 | member | provenance | |
| UnsafeUnpack.py:163:33:163:35 | After tar [empty] | UnsafeUnpack.py:163:23:163:28 | member | provenance | |
| UnsafeUnpack.py:164:26:164:31 | member | UnsafeUnpack.py:166:37:166:42 | member | provenance | |
| UnsafeUnpack.py:166:23:166:28 | [post] result | UnsafeUnpack.py:167:67:167:72 | result | provenance | |
| UnsafeUnpack.py:166:37:166:42 | member | UnsafeUnpack.py:166:23:166:28 | [post] result | provenance | list.append |
| UnsafeUnpack.py:171:1:171:8 | response | UnsafeUnpack.py:174:15:174:22 | response | provenance | |
| UnsafeUnpack.py:171:12:171:50 | After Attribute() | UnsafeUnpack.py:171:1:171:8 | response | provenance | |
| UnsafeUnpack.py:173:11:173:17 | tarpath | UnsafeUnpack.py:176:17:176:23 | tarpath | provenance | |
| UnsafeUnpack.py:174:7:174:7 | f | UnsafeUnpack.py:173:11:173:17 | tarpath | provenance | Config |
| UnsafeUnpack.py:174:15:174:22 | response | UnsafeUnpack.py:174:15:174:26 | After Attribute | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:174:15:174:22 | response | UnsafeUnpack.py:174:15:174:26 | After Attribute | provenance | Config |
| UnsafeUnpack.py:174:15:174:26 | After Attribute | UnsafeUnpack.py:174:15:174:33 | After Attribute() | provenance | AdditionalTaintStep |
| UnsafeUnpack.py:174:15:174:26 | After Attribute | UnsafeUnpack.py:174:15:174:33 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:174:15:174:33 | After Attribute() | UnsafeUnpack.py:174:7:174:7 | f | provenance | Config |
| UnsafeUnpack.py:176:17:176:23 | tarpath | UnsafeUnpack.py:176:1:176:34 | After Attribute() | provenance | Config |
| UnsafeUnpack.py:194:53:194:55 | tmp | UnsafeUnpack.py:201:29:201:31 | tmp | provenance | |
| UnsafeUnpack.py:201:29:201:31 | tmp | UnsafeUnpack.py:201:29:201:36 | After Attribute | provenance | Config |
models
| 1 | Summary: tarfile; Member[open]; Argument[0,name:,2,fileobj:]; ReturnValue; taint |
nodes
| UnsafeUnpack.py:5:26:5:32 | After ImportMember | semmle.label | After ImportMember |
| UnsafeUnpack.py:5:26:5:32 | request | semmle.label | request |
| UnsafeUnpack.py:11:7:11:14 | filename | semmle.label | filename |
| UnsafeUnpack.py:11:18:11:24 | request | semmle.label | request |
| UnsafeUnpack.py:11:18:11:29 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:11:18:11:49 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:13:13:13:20 | response | semmle.label | response |
| UnsafeUnpack.py:13:24:13:58 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:16:23:16:29 | tarpath | semmle.label | tarpath |
| UnsafeUnpack.py:17:19:17:19 | f | semmle.label | f |
| UnsafeUnpack.py:17:27:17:34 | response | semmle.label | response |
| UnsafeUnpack.py:17:27:17:38 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:17:27:17:45 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:19:35:19:41 | tarpath | semmle.label | tarpath |
| UnsafeUnpack.py:33:50:33:65 | local_ziped_path | semmle.label | local_ziped_path |
| UnsafeUnpack.py:34:23:34:38 | local_ziped_path | semmle.label | local_ziped_path |
| UnsafeUnpack.py:47:20:47:34 | compressed_file | semmle.label | compressed_file |
| UnsafeUnpack.py:48:23:48:37 | compressed_file | semmle.label | compressed_file |
| UnsafeUnpack.py:51:1:51:15 | compressed_file | semmle.label | compressed_file |
| UnsafeUnpack.py:51:19:51:36 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:52:23:52:37 | compressed_file | semmle.label | compressed_file |
| UnsafeUnpack.py:65:1:65:15 | compressed_file | semmle.label | compressed_file |
| UnsafeUnpack.py:65:19:65:31 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:66:23:66:37 | compressed_file | semmle.label | compressed_file |
| UnsafeUnpack.py:79:1:79:12 | url_filename | semmle.label | url_filename |
| UnsafeUnpack.py:79:16:79:28 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:81:1:81:8 | response | semmle.label | response |
| UnsafeUnpack.py:81:12:81:50 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:84:11:84:17 | tarpath | semmle.label | tarpath |
| UnsafeUnpack.py:85:7:85:7 | f | semmle.label | f |
| UnsafeUnpack.py:85:15:85:22 | response | semmle.label | response |
| UnsafeUnpack.py:85:15:85:26 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:85:15:85:33 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:87:23:87:29 | tarpath | semmle.label | tarpath |
| UnsafeUnpack.py:102:23:102:30 | savepath | semmle.label | savepath |
| UnsafeUnpack.py:103:23:103:27 | chunk | semmle.label | chunk |
| UnsafeUnpack.py:103:32:103:44 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:103:32:103:54 | After Subscript | semmle.label | After Subscript |
| UnsafeUnpack.py:103:32:103:63 | After Attribute() [empty] | semmle.label | After Attribute() [empty] |
| UnsafeUnpack.py:104:25:104:29 | wfile | semmle.label | wfile |
| UnsafeUnpack.py:104:37:104:41 | chunk | semmle.label | chunk |
| UnsafeUnpack.py:105:35:105:42 | savepath | semmle.label | savepath |
| UnsafeUnpack.py:108:13:108:18 | myfile | semmle.label | myfile |
| UnsafeUnpack.py:108:22:108:34 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:108:22:108:48 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:110:18:110:26 | file_path | semmle.label | file_path |
| UnsafeUnpack.py:111:19:111:19 | f | semmle.label | f |
| UnsafeUnpack.py:111:27:111:32 | myfile | semmle.label | myfile |
| UnsafeUnpack.py:111:27:111:39 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:112:35:112:43 | file_path | semmle.label | file_path |
| UnsafeUnpack.py:116:17:116:21 | ufile | semmle.label | ufile |
| UnsafeUnpack.py:116:27:116:39 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:116:27:116:49 | After Attribute() [empty] | semmle.label | After Attribute() [empty] |
| UnsafeUnpack.py:118:19:118:26 | filename | semmle.label | filename |
| UnsafeUnpack.py:118:30:118:55 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:118:38:118:42 | ufile | semmle.label | ufile |
| UnsafeUnpack.py:118:38:118:47 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:119:19:119:36 | uploaded_file_path | semmle.label | uploaded_file_path |
| UnsafeUnpack.py:119:40:119:56 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:119:48:119:55 | filename | semmle.label | filename |
| UnsafeUnpack.py:120:41:120:58 | uploaded_file_path | semmle.label | uploaded_file_path |
| UnsafeUnpack.py:140:1:140:19 | unsafe_filename_tar | semmle.label | unsafe_filename_tar |
| UnsafeUnpack.py:140:23:140:35 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:141:6:141:51 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:141:22:141:40 | unsafe_filename_tar | semmle.label | unsafe_filename_tar |
| UnsafeUnpack.py:141:56:141:58 | tar | semmle.label | tar |
| UnsafeUnpack.py:142:49:142:51 | tar | semmle.label | tar |
| UnsafeUnpack.py:157:23:157:30 | savepath | semmle.label | savepath |
| UnsafeUnpack.py:158:23:158:27 | chunk | semmle.label | chunk |
| UnsafeUnpack.py:158:32:158:44 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:158:32:158:54 | After Subscript | semmle.label | After Subscript |
| UnsafeUnpack.py:158:32:158:63 | After Attribute() [empty] | semmle.label | After Attribute() [empty] |
| UnsafeUnpack.py:159:25:159:29 | wfile | semmle.label | wfile |
| UnsafeUnpack.py:159:37:159:41 | chunk | semmle.label | chunk |
| UnsafeUnpack.py:161:19:161:21 | tar | semmle.label | tar |
| UnsafeUnpack.py:161:25:161:46 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:161:38:161:45 | savepath | semmle.label | savepath |
| UnsafeUnpack.py:163:23:163:28 | member | semmle.label | member |
| UnsafeUnpack.py:163:33:163:35 | After tar [empty] | semmle.label | After tar [empty] |
| UnsafeUnpack.py:164:26:164:31 | member | semmle.label | member |
| UnsafeUnpack.py:166:23:166:28 | [post] result | semmle.label | [post] result |
| UnsafeUnpack.py:166:37:166:42 | member | semmle.label | member |
| UnsafeUnpack.py:167:67:167:72 | result | semmle.label | result |
| UnsafeUnpack.py:171:1:171:8 | response | semmle.label | response |
| UnsafeUnpack.py:171:12:171:50 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:173:11:173:17 | tarpath | semmle.label | tarpath |
| UnsafeUnpack.py:174:7:174:7 | f | semmle.label | f |
| UnsafeUnpack.py:174:15:174:22 | response | semmle.label | response |
| UnsafeUnpack.py:174:15:174:26 | After Attribute | semmle.label | After Attribute |
| UnsafeUnpack.py:174:15:174:33 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:176:1:176:34 | After Attribute() | semmle.label | After Attribute() |
| UnsafeUnpack.py:176:17:176:23 | tarpath | semmle.label | tarpath |
| UnsafeUnpack.py:194:53:194:55 | tmp | semmle.label | tmp |
| UnsafeUnpack.py:201:29:201:31 | tmp | semmle.label | tmp |
| UnsafeUnpack.py:201:29:201:36 | After Attribute | semmle.label | After Attribute |
subpaths
Reference in New Issue View Git Blame Copy Permalink