mirror of
https://github.com/github/codeql.git
synced 2026-04-06 15:44:01 +02:00
30 lines
1.2 KiB
Plaintext
30 lines
1.2 KiB
Plaintext
/**
|
|
* @name Default version of SSL/TLS may be insecure
|
|
* @description Leaving the SSL/TLS version unspecified may result in an insecure
|
|
* default protocol being used.
|
|
* @id py/insecure-default-protocol
|
|
* @kind problem
|
|
* @problem.severity warning
|
|
* @security-severity 7.5
|
|
* @precision high
|
|
* @tags security
|
|
* external/cwe/cwe-327
|
|
*/
|
|
|
|
// Connections are generally created based on a context which controls the range of acceptable
|
|
// protocols. This query reports the deprecated way of creating connections without referring
|
|
// to a context (via `ssl.wrap_socket`). Doing this and not specifying which protocols are
|
|
// acceptable means that connections will be created with the insecure default settings.
|
|
//
|
|
// Detecting that a connection is created with a context that has not been suitably configured
|
|
// is handled by the data-flow query py/insecure-protocol.
|
|
import python
|
|
import semmle.python.ApiGraphs
|
|
|
|
from DataFlow::CallCfgNode call
|
|
where
|
|
call = API::moduleImport("ssl").getMember("wrap_socket").getACall() and
|
|
not exists(call.getArgByName("ssl_version"))
|
|
select call,
|
|
"Call to deprecated method ssl.wrap_socket does not specify a protocol, which may result in an insecure default being used."
|