mirror of
https://github.com/github/codeql.git
synced 2026-04-09 17:15:44 +02:00
1cc5e54357
I've added 2 queries: - one that detects full SSRF, where an attacker can control the full URL, which is always bad - and one for partial SSRF, where an attacker can control parts of an URL (such as the path, query parameters, or fragment), which is not a big problem in many cases (but might still be exploitable) full SSRF should run by default, and partial SSRF should not (but makes it easy to see the other results). Some elements of the full SSRF queries needs a bit more polishing, like being able to detect `"https://" + user_input` is in fact controlling the full URL.
23 lines
714 B
Plaintext
23 lines
714 B
Plaintext
/**
|
|
* @name Full server-side request forgery
|
|
* @description Making a network request to a URL that is fully user-controlled allows for request forgery attacks.
|
|
* @kind path-problem
|
|
* @problem.severity error
|
|
* @security-severity 9.1
|
|
* @precision high
|
|
* @id py/full-ssrf
|
|
* @tags security
|
|
* external/cwe/cwe-918
|
|
*/
|
|
|
|
import python
|
|
import semmle.python.security.dataflow.ServerSideRequestForgery
|
|
import DataFlow::PathGraph
|
|
|
|
from
|
|
FullServerSideRequestForgery::Configuration config, DataFlow::PathNode source,
|
|
DataFlow::PathNode sink
|
|
where config.hasFlowPath(source, sink)
|
|
select sink.getNode(), source, sink, "The full URL of this request depends on $@.",
|
|
source.getNode(), "a user-provided value"
|