Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 36e27f2

Browse files
yoffyoff
committed
Python: Remove promoted code:
- queries (`py/regex-injection`) - concepts (RegexExecution, RegexEscape) - library models (Stdlib::Re)
1 parent abbd1d1 commit 36e27f2

7 files changed

Lines changed: 0 additions & 314 deletions

File tree

‎python/ql/src/experimental/Security/CWE-730/RegexInjection.qhelp‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎python/ql/src/experimental/Security/CWE-730/RegexInjection.ql‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎python/ql/src/experimental/Security/CWE-730/re_bad.py‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎python/ql/src/experimental/Security/CWE-730/re_good.py‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎python/ql/src/experimental/semmle/python/Concepts.qll‎

Lines changed: 0 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -14,73 +14,6 @@ private import semmle.python.dataflow.new.RemoteFlowSources
1414
private import semmle.python.dataflow.new.TaintTracking
1515
private import experimental.semmle.python.Frameworks
1616

17-
/** Provides classes for modeling Regular Expression-related APIs. */
18-
module RegexExecution {
19-
/**
20-
* A data-flow node that executes a regular expression.
21-
*
22-
* Extend this class to model new APIs. If you want to refine existing API models,
23-
* extend `RegexExecution` instead.
24-
*/
25-
abstract class Range extends DataFlow::Node {
26-
/**
27-
* Gets the argument containing the executed expression.
28-
*/
29-
abstract DataFlow::Node getRegexNode();
30-
31-
/**
32-
* Gets the library used to execute the regular expression.
33-
*/
34-
abstract string getRegexModule();
35-
}
36-
}
37-
38-
/**
39-
* A data-flow node that executes a regular expression.
40-
*
41-
* Extend this class to refine existing API models. If you want to model new APIs,
42-
* extend `RegexExecution::Range` instead.
43-
*/
44-
class RegexExecution extends DataFlow::Node {
45-
RegexExecution::Range range;
46-
47-
RegexExecution() { this = range }
48-
49-
DataFlow::Node getRegexNode() { result = range.getRegexNode() }
50-
51-
string getRegexModule() { result = range.getRegexModule() }
52-
}
53-
54-
/** Provides classes for modeling Regular Expression escape-related APIs. */
55-
module RegexEscape {
56-
/**
57-
* A data-flow node that escapes a regular expression.
58-
*
59-
* Extend this class to model new APIs. If you want to refine existing API models,
60-
* extend `RegexEscape` instead.
61-
*/
62-
abstract class Range extends DataFlow::Node {
63-
/**
64-
* Gets the argument containing the escaped expression.
65-
*/
66-
abstract DataFlow::Node getRegexNode();
67-
}
68-
}
69-
70-
/**
71-
* A data-flow node that escapes a regular expression.
72-
*
73-
* Extend this class to refine existing API models. If you want to model new APIs,
74-
* extend `RegexEscape::Range` instead.
75-
*/
76-
class RegexEscape extends DataFlow::Node {
77-
RegexEscape::Range range;
78-
79-
RegexEscape() { this = range }
80-
81-
DataFlow::Node getRegexNode() { result = range.getRegexNode() }
82-
}
83-
8417
/** Provides classes for modeling LDAP query execution-related APIs. */
8518
module LDAPQuery {
8619
/**

‎python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll‎

Lines changed: 0 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -9,91 +9,3 @@ private import semmle.python.dataflow.new.TaintTracking
99
private import semmle.python.dataflow.new.RemoteFlowSources
1010
private import experimental.semmle.python.Concepts
1111
private import semmle.python.ApiGraphs
12-
13-
/**
14-
* Provides models for Python's `re` library.
15-
*
16-
* See https://docs.python.org/3/library/re.html
17-
*/
18-
private module Re {
19-
/**
20-
* List of `re` methods immediately executing an expression.
21-
*
22-
* See https://docs.python.org/3/library/re.html#module-contents
23-
*/
24-
private class RegexExecutionMethods extends string {
25-
RegexExecutionMethods() {
26-
this in ["match", "fullmatch", "search", "split", "findall", "finditer", "sub", "subn"]
27-
}
28-
}
29-
30-
/**
31-
* A class to find `re` methods immediately executing an expression.
32-
*
33-
* See `RegexExecutionMethods`
34-
*/
35-
private class DirectRegex extends DataFlow::CallCfgNode, RegexExecution::Range {
36-
DataFlow::Node regexNode;
37-
38-
DirectRegex() {
39-
this = API::moduleImport("re").getMember(any(RegexExecutionMethods m)).getACall() and
40-
regexNode = this.getArg(0)
41-
}
42-
43-
override DataFlow::Node getRegexNode() { result = regexNode }
44-
45-
override string getRegexModule() { result = "re" }
46-
}
47-
48-
/**
49-
* A class to find `re` methods immediately executing a compiled expression by `re.compile`.
50-
*
51-
* Given the following example:
52-
*
53-
* ```py
54-
* pattern = re.compile(input)
55-
* pattern.match(s)
56-
* ```
57-
*
58-
* This class will identify that `re.compile` compiles `input` and afterwards
59-
* executes `re`'s `match`. As a result, `this` will refer to `pattern.match(s)`
60-
* and `this.getRegexNode()` will return the node for `input` (`re.compile`'s first argument)
61-
*
62-
*
63-
* See `RegexExecutionMethods`
64-
*
65-
* See https://docs.python.org/3/library/re.html#regular-expression-objects
66-
*/
67-
private class CompiledRegex extends DataFlow::MethodCallNode, RegexExecution::Range {
68-
DataFlow::Node regexNode;
69-
70-
CompiledRegex() {
71-
exists(DataFlow::MethodCallNode patternCall |
72-
patternCall = API::moduleImport("re").getMember("compile").getACall() and
73-
patternCall.flowsTo(this.getObject()) and
74-
this.getMethodName() instanceof RegexExecutionMethods and
75-
regexNode = patternCall.getArg(0)
76-
)
77-
}
78-
79-
override DataFlow::Node getRegexNode() { result = regexNode }
80-
81-
override string getRegexModule() { result = "re" }
82-
}
83-
84-
/**
85-
* A class to find `re` methods escaping an expression.
86-
*
87-
* See https://docs.python.org/3/library/re.html#re.escape
88-
*/
89-
class ReEscape extends DataFlow::CallCfgNode, RegexEscape::Range {
90-
DataFlow::Node regexNode;
91-
92-
ReEscape() {
93-
this = API::moduleImport("re").getMember("escape").getACall() and
94-
regexNode = this.getArg(0)
95-
}
96-
97-
override DataFlow::Node getRegexNode() { result = regexNode }
98-
}
99-
}

‎python/ql/src/experimental/semmle/python/security/injection/RegexInjection.qll‎

Lines changed: 0 additions & 53 deletions
This file was deleted.

0 commit comments

Comments
 (0)