Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2bccb67

Browse files
yoffyoff
committed
Python, doc: Make first batch of examples runnable
python queries.
1 parent aaaf909 commit 2bccb67

1 file changed

Lines changed: 36 additions & 29 deletions

File tree

‎docs/codeql/codeql-language-guides/analyzing-data-flow-in-python.rst‎

Lines changed: 36 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -79,55 +79,62 @@ For example, you can find taint propagation from a parameter ``source`` to an ex
7979
Examples
8080
~~~~~~~~
8181

82-
This query finds the filename passed to ``System.IO.File.Open``:
82+
This query finds the filename passed to ``os.open``:
8383

8484
.. code-block:: ql
8585
86-
import csharp
86+
import python
87+
import semmle.python.dataflow.new.DataFlow
88+
import semmle.python.ApiGraphs
8789
88-
from Method fileOpen, MethodCall call
89-
where fileOpen.hasQualifiedName("System.IO.File.Open")
90-
and call.getTarget() = fileOpen
91-
select call.getArgument(0)
90+
from DataFlow::CallCfgNode call
91+
where
92+
call = API::moduleImport("os").getMember("open").getACall()
93+
select call.getArg(0)
9294
9395
Unfortunately this will only give the expression in the argument, not the values which could be passed to it. So we use local data flow to find all expressions that flow into the argument:
9496

9597
.. code-block:: ql
9698
97-
import csharp
99+
import python
100+
import semmle.python.dataflow.new.DataFlow
101+
import semmle.python.ApiGraphs
98102
99-
from Method fileOpen, MethodCall call, Expr src
100-
where fileOpen.hasQualifiedName("System.IO.File.Open")
101-
and call.getTarget() = fileOpen
102-
and DataFlow::localFlow(DataFlow::exprNode(src), DataFlow::exprNode(call.getArgument(0)))
103-
select src
103+
from DataFlow::CallCfgNode call, DataFlow::ExprNode expr
104+
where
105+
call = API::moduleImport("os").getMember("open").getACall()
106+
and DataFlow::localFlow(expr, call.getArg(0))
107+
select expr
104108
105-
Then we can make the source more specific, for example an access to a public parameter. This query finds instances where a public parameter is used to open a file:
109+
Then we can make the source more specific, for example a parameter to a function or method. This query finds instances where a parameter is used as the name when opening a file:
106110

107111
.. code-block:: ql
108112
109-
import csharp
113+
import python
114+
import semmle.python.dataflow.new.DataFlow
115+
import semmle.python.ApiGraphs
110116
111-
from Method fileOpen, MethodCall call, Parameter p
112-
where fileOpen.hasQualifiedName("System.IO.File.Open")
113-
and call.getTarget() = fileOpen
114-
and DataFlow::localFlow(DataFlow::parameterNode(p), DataFlow::exprNode(call.getArgument(0)))
115-
and call.getEnclosingCallable().(Member).isPublic()
116-
select p, "Opening a file from a public method."
117+
from DataFlow::CallCfgNode call, DataFlow::ParameterNode p
118+
where
119+
call = API::moduleImport("os").getMember("open").getACall()
120+
and DataFlow::localFlow(p, call.getArg(0))
121+
select p, "Opening a file based on parameter."
117122
118-
This query finds calls to ``String.Format`` where the format string isn't hard-coded:
123+
Using the exact name in the parameter may be too strict. If we want to know if the parameter influences
124+
the file name, we can use taint tracking instead of data flow.
125+
This query finds calls to ``os.open`` where the filename is derived from a parameter:
119126

120127
.. code-block:: ql
121128
122-
import csharp
129+
import python
130+
import semmle.python.dataflow.new.TaintTracking
131+
import semmle.python.ApiGraphs
123132
124-
from Method format, MethodCall call, Expr formatString
125-
where format.hasQualifiedName("System.String.Format")
126-
and call.getTarget() = format
127-
and formatString = call.getArgument(0)
128-
and formatString.getType() instanceof StringType
129-
and not exists(StringLiteral source | DataFlow::localFlow(DataFlow::exprNode(source), DataFlow::exprNode(formatString)))
130-
select call, "Argument to 'string.Format' isn't hard-coded."
133+
from DataFlow::CallCfgNode call, DataFlow::ParameterNode p
134+
where
135+
call = API::moduleImport("os").getMember("open").getACall()
136+
and TaintTracking::localTaint(p, call.getArg(0))
137+
select p, "Opening a file based on parameter."
131138
132139
Exercises
133140
~~~~~~~~~

0 commit comments

Comments
 (0)