mirror of
https://github.com/github/codeql.git
synced 2025-12-26 21:56:39 +01:00
74345b1c05
Following the setup I invented for library-tests/taint/unpacking. TestStep is still a bit annoying, since the output is not easy to eyeball; but for now I guess we can live with it :) I honestly didn't get the point of DistinctStringKinds.ql, other than showing we can handle multiple taint kinds
19 lines
636 B
Plaintext
19 lines
636 B
Plaintext
import python
|
|
import semmle.python.security.TaintTracking
|
|
import Taint
|
|
|
|
from Call call, Expr arg, string taint_string
|
|
where
|
|
call.getLocation().getFile().getShortName() = "test.py" and
|
|
call.getFunc().(Name).getId() = "test" and
|
|
arg = call.getAnArg() and
|
|
(
|
|
not exists(TaintedNode tainted | tainted.getAstNode() = arg) and
|
|
taint_string = "NO TAINT"
|
|
or
|
|
exists(TaintedNode tainted | tainted.getAstNode() = arg |
|
|
taint_string = tainted.getTaintKind().toString()
|
|
)
|
|
)
|
|
select arg.getLocation().toString(), call.getScope().(Function).getName(), arg.toString(), taint_string
|