Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2d9d292

Browse files
markshannonmarkshannon
committed
Python: Fix up pi-node handling in taint-tracking.
1 parent 955e54b commit 2d9d292

5 files changed

Lines changed: 41 additions & 17 deletions

File tree

‎python/ql/src/Security/CWE-022/TarSlip.ql‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,18 @@ class TarSlipConfiguration extends TaintTracking::Configuration {
187187
sanitizer instanceof ExcludeTarFilePy
188188
}
189189

190+
override predicate isBarrier(DataFlow::Node node) {
191+
// Avoid flow into the tarfile module
192+
exists(ParameterDefinition def |
193+
node.asVariable().getDefinition() = def
194+
or
195+
node.asCfgNode() = def.getDefiningNode()
196+
|
197+
def.getScope() = Value::named("tarfile.open").(CallableValue).getScope()
198+
or
199+
def.isSelf() and def.getScope().getEnclosingModule().getName() = "tarfile"
200+
)
201+
}
190202
}
191203

192204

‎python/ql/src/semmle/python/dataflow/Implementation.qll‎

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -288,17 +288,36 @@ class TaintTrackingImplementation extends string {
288288
/** Gets the boolean value that `test` evaluates to when `use` is tainted with `kind`
289289
* and `test` and `use` are part of a test in a branch.
290290
*/
291-
private boolean test_evaluates(ControlFlowNode test, ControlFlowNode use, TaintKind kind) {
291+
boolean testEvaluates(ControlFlowNode test, ControlFlowNode use, TaintKind kind) {
292292
boolean_filter(_, use) and
293293
kind.taints(use) and
294294
test = use and result = kind.booleanValue()
295295
or
296-
result = test_evaluates(not_operand(test), use, kind).booleanNot()
296+
result = testEvaluates(not_operand(test), use, kind).booleanNot()
297297
or
298298
exists(ControlFlowNode const |
299299
Filters::equality_test(test, use, result.booleanNot(), const) and
300300
const.getNode() instanceof ImmutableLiteral
301301
)
302+
or
303+
exists(ControlFlowNode c, ClassValue cls |
304+
Filters::isinstance(test, c, use) and
305+
c.pointsTo(cls)
306+
|
307+
kind.getType().getASuperType() = cls and result = true
308+
or
309+
not kind.getType().getASuperType() = cls and result = false
310+
)
311+
}
312+
313+
predicate testEvaluatesMaybe(ControlFlowNode test, ControlFlowNode use) {
314+
any(PyEdgeRefinement ref).getTest().getAChild*() = test and
315+
test.getAChild*() = use and
316+
not test.(UnaryExprNode).getNode().getOp() instanceof Not and
317+
not Filters::equality_test(test, use, _, _) and
318+
not Filters::isinstance(test, _, use)
319+
or
320+
testEvaluatesMaybe(not_operand(test), use)
302321
}
303322

304323
/** Gets the operand of a unary `not` expression. */
@@ -656,16 +675,9 @@ class TaintTrackingImplementation extends string {
656675
srcnode.asVariable() = defn.getInput() and
657676
not this.(TaintTracking::Configuration).isBarrierTest(defn.getTest(), defn.getSense())
658677
|
659-
exists(ControlFlowNode c, ClassValue cls |
660-
Filters::isinstance(defn.getTest(), c, defn.getInput().getSourceVariable().getAUse()) and
661-
c.pointsTo(cls)
662-
|
663-
defn.getSense() = true and kind.getType().getASuperType() = cls
664-
or
665-
defn.getSense() = false and not kind.getType().getASuperType() = cls
666-
)
678+
defn.getSense() = testEvaluates(defn.getTest(), defn.getInput().getSourceVariable().getAUse(), kind)
667679
or
668-
defn.getSense() = test_evaluates(defn.getTest(), defn.getInput().getSourceVariable().getAUse(), kind)
680+
testEvaluatesMaybe(defn.getTest(), defn.getInput().getSourceVariable().getAUse())
669681
)
670682
}
671683

‎python/ql/test/query-tests/Functions/general/ModificationOfParameterWithDefault.expected‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ edges
1212
| functions_test.py:300:26:300:26 | empty mutable value | functions_test.py:303:12:303:12 | empty mutable value |
1313
| functions_test.py:305:21:305:25 | empty mutable value | functions_test.py:306:12:306:16 | empty mutable value |
1414
#select
15-
| functions_test.py:40:5:40:5 | Taint sink | functions_test.py:39:9:39:9 | empty mutable value | functions_test.py:40:5:40:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:39:9:39:9 | mutable default value | Default value |
16-
| functions_test.py:239:5:239:5 | Taint sink | functions_test.py:238:15:238:15 | empty mutable value | functions_test.py:239:5:239:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:238:15:238:15 | mutable default value | Default value |
17-
| functions_test.py:291:5:291:5 | Taint sink | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:291:5:291:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | mutable default value | Default value |
18-
| functions_test.py:294:5:294:5 | Taint sink | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:294:5:294:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | mutable default value | Default value |
15+
| functions_test.py:40:5:40:5 | x | functions_test.py:39:9:39:9 | empty mutable value | functions_test.py:40:5:40:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:39:9:39:9 | x | Default value |
16+
| functions_test.py:239:5:239:5 | x | functions_test.py:238:15:238:15 | empty mutable value | functions_test.py:239:5:239:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:238:15:238:15 | x | Default value |
17+
| functions_test.py:291:5:291:5 | x | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:291:5:291:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | y | Default value |
18+
| functions_test.py:294:5:294:5 | x | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:294:5:294:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | y | Default value |

‎python/ql/test/query-tests/Security/CWE-327/TestNode.expected‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
WARNING: Predicate getNode has been deprecated and may be removed in future (TestNode.ql:9,25-32)
12
| Taint Crypto.Cipher.ARC4 | test_pycrypto.py:5:14:5:27 | test_pycrypto.py:5 | test_pycrypto.py:5:14:5:27 | Attribute() | |
23
| Taint Crypto.Cipher.ARC4 | test_pycrypto.py:6:12:6:17 | test_pycrypto.py:6 | test_pycrypto.py:6:12:6:17 | cipher | |
34
| Taint cryptography.Cipher.RC4 | test_cryptography.py:5:14:5:47 | test_cryptography.py:5 | test_cryptography.py:5:14:5:47 | Cipher() | |
@@ -8,7 +9,6 @@
89
| Taint sensitive.data | test_cryptography.py:4:17:4:28 | test_cryptography.py:4 | test_cryptography.py:4:17:4:28 | get_password | |
910
| Taint sensitive.data | test_cryptography.py:4:17:4:30 | test_cryptography.py:4 | test_cryptography.py:4:17:4:30 | get_password() | |
1011
| Taint sensitive.data | test_cryptography.py:7:29:7:37 | test_cryptography.py:7 | test_cryptography.py:7:29:7:37 | dangerous | |
11-
| Taint sensitive.data | test_cryptography.py:7:42:7:50 | test_cryptography.py:7 | test_cryptography.py:7:42:7:50 | encryptor | |
1212
| Taint sensitive.data | test_pycrypto.py:4:17:4:28 | test_pycrypto.py:4 | test_pycrypto.py:4:17:4:28 | get_password | |
1313
| Taint sensitive.data | test_pycrypto.py:4:17:4:30 | test_pycrypto.py:4 | test_pycrypto.py:4:17:4:30 | get_password() | |
1414
| Taint sensitive.data | test_pycrypto.py:6:27:6:35 | test_pycrypto.py:6 | test_pycrypto.py:6:27:6:35 | dangerous | |

‎python/ql/test/query-tests/Security/CWE-327/TestNode.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ import semmle.python.security.Crypto
77

88
from TaintedNode n, AstNode src
99
where src = n.getAstNode() and src.getLocation().getFile().getName().matches("%test%")
10-
select n.getTrackedValue(), n.getLocation(), src, n.getContext()
10+
select "Taint " + n.getTaintKind(), n.getLocation(), src, n.getContext()

0 commit comments

Comments
 (0)