mirror of
https://github.com/github/codeql.git
synced 2026-04-14 19:44:03 +02:00
4f74d421b9
Looking at the results of the the previous DCA run, there was a bunch of false positives where `bind` was being used with a `AF_UNIX` socket (a filesystem path encoded as a string), not a `(host, port)` tuple. These results should be excluded from the query, as they are not vulnerable. Ideally, we would just add `.TupleElement[0]` to the MaD sink, except we don't actually support this in Python MaD... So, instead I opted for a more low-tech solution: check that the argument in question flows from a tuple in the local scope. This eliminates a bunch of false positives on `python/cpython` leaving behind four true positive results.
63 lines
2.1 KiB
Python
63 lines
2.1 KiB
Python
import socket
|
|
|
|
# binds to all interfaces, insecure
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
# binds to all interfaces, insecure
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.bind(('', 4040)) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
# binds only to a dedicated interface, secure
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.bind(('84.68.10.12', 8080))
|
|
|
|
# binds to all interfaces, insecure
|
|
ALL_LOCALS = "0.0.0.0" # $ Source
|
|
s.bind((ALL_LOCALS, 9090)) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
# binds to all interfaces, insecure
|
|
tup = (ALL_LOCALS, 8080)
|
|
s.bind(tup) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
|
|
# IPv6
|
|
s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
|
|
s.bind(("::", 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
|
|
# FN cases from https://github.com/github/codeql/issues/21582
|
|
|
|
# Address stored in a class attribute
|
|
class Server:
|
|
def __init__(self):
|
|
self.bind_addr = '0.0.0.0' # $ Source
|
|
self.port = 31137
|
|
|
|
def start(self):
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.bind((self.bind_addr, self.port)) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
server = Server()
|
|
server.start()
|
|
|
|
# os.environ.get with insecure default
|
|
import os
|
|
host = os.environ.get('APP_HOST', '0.0.0.0') # $ Source
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.bind((host, 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
# gevent.socket (alternative socket module)
|
|
from gevent import socket as gsocket
|
|
gs = gsocket.socket(gsocket.AF_INET, gsocket.SOCK_STREAM)
|
|
gs.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
# eventlet.green.socket (another alternative socket module)
|
|
from eventlet.green import socket as esocket
|
|
es = esocket.socket(esocket.AF_INET, esocket.SOCK_STREAM)
|
|
es.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
|
|
|
|
# AF_UNIX socket binding should not be flagged
|
|
us = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
|
|
us.bind('')
|