mirror of
https://github.com/github/codeql.git
synced 2026-02-17 23:43:42 +01:00
32 lines
1004 B
Plaintext
32 lines
1004 B
Plaintext
/**
|
|
* Provides classes modeling security-relevant aspects of the `jsonpickle` PyPI package.
|
|
* See https://pypi.org/project/jsonpickle/.
|
|
*/
|
|
|
|
private import python
|
|
private import semmle.python.dataflow.new.RemoteFlowSources
|
|
private import semmle.python.Concepts
|
|
private import semmle.python.ApiGraphs
|
|
|
|
/**
|
|
* Provides models for the `jsonpickle` PyPI package.
|
|
* See https://pypi.org/project/jsonpickle/.
|
|
*/
|
|
private module Jsonpickle {
|
|
/**
|
|
* A Call to `jsonpickle.decode`.
|
|
* See https://jsonpickle.readthedocs.io/en/latest/api.html#jsonpickle.decode
|
|
*/
|
|
private class JsonpickleDecode extends Decoding::Range, API::CallNode {
|
|
JsonpickleDecode() { this = API::moduleImport("jsonpickle").getMember("decode").getACall() }
|
|
|
|
override predicate mayExecuteInput() { any() }
|
|
|
|
override DataFlow::Node getAnInput() { result = this.getParameter(0, "string").asSink() }
|
|
|
|
override DataFlow::Node getOutput() { result = this }
|
|
|
|
override string getFormat() { result = "pickle" }
|
|
}
|
|
}
|