Add an additional taint step

Sim4n6 · Sim4n6 · commit 25a7fcffc0dd · 2022-10-19T16:01:34.000+01:00
diff --git a/python/ql/src/experimental/Security/CWE-022bis/TarSlipImprov.ql b/python/ql/src/experimental/Security/CWE-022bis/TarSlipImprov.ql
@@ -55,7 +55,7 @@ class AllTarfileOpens extends API::CallNode {
 class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "TarSlip" }
 
-  override predicate isSource(DataFlow::Node source) { source instanceof AllTarfileOpens }
+  override predicate isSource(DataFlow::Node source) { source = tarfileOpen().getACall() }
 
   override predicate isSink(DataFlow::Node sink) {
     // A sink capturing method calls to `extractall` without `members` argument.
@@ -99,6 +99,13 @@ class Configuration extends TaintTracking::Configuration {
       nodeFrom = call.getObject() and
       nodeTo = call
     )
+    or
+    exists(DataFlow::CallCfgNode closing |
+      closing = API::moduleImport("contextlib").getMember("closing").getACall() and
+      nodeFrom = closing.getArg(0) and
+      nodeFrom = tarfileOpen().getACall() and
+      nodeTo = closing
+    )
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,7 @@ class AllTarfileOpens extends API::CallNode {`
`55`	`55`	`class Configuration extends TaintTracking::Configuration {`
`56`	`56`	`Configuration() { this = "TarSlip" }`
`57`	`57`
`58`		`- override predicate isSource(DataFlow::Node source) { source instanceof AllTarfileOpens }`
	`58`	`+ override predicate isSource(DataFlow::Node source) { source = tarfileOpen().getACall() }`
`59`	`59`
`60`	`60`	`override predicate isSink(DataFlow::Node sink) {`
`61`	`61`	// A sink capturing method calls to `extractall` without `members` argument.
`@@ -99,6 +99,13 @@ class Configuration extends TaintTracking::Configuration {`
`99`	`99`	`nodeFrom = call.getObject() and`
`100`	`100`	`nodeTo = call`
`101`	`101`	`)`
	`102`	`+ or`
	`103`	`+ exists(DataFlow::CallCfgNode closing \|`
	`104`	`+ closing = API::moduleImport("contextlib").getMember("closing").getACall() and`
	`105`	`+ nodeFrom = closing.getArg(0) and`
	`106`	`+ nodeFrom = tarfileOpen().getACall() and`
	`107`	`+ nodeTo = closing`
	`108`	`+ )`
`102`	`109`	`}`
`103`	`110`	`}`
`104`	`111`