Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 37aa9b9

Browse files
RasmusWLRasmusWL
committed
Python: Add prefix sanitizer on URL redirect query
This doesn't cover 100% of what we want to, but matches what we used to.
1 parent d8bfa35 commit 37aa9b9

3 files changed

Lines changed: 11 additions & 10 deletions

File tree

‎python/ql/src/semmle/python/security/dataflow/UrlRedirect.qll‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,15 @@ class UrlRedirectConfiguration extends TaintTracking::Configuration {
2222
sink = any(HTTP::Server::HttpRedirectResponse e).getRedirectLocation()
2323
}
2424

25+
override predicate isSanitizer(DataFlow::Node node) {
26+
// Url redirection is a problem only if the user controls the prefix of the URL.
27+
// This is a copy of the taint-sanitizer from the old points-to query, which doesn't
28+
// cover formatting.
29+
exists(BinaryExprNode string_concat | string_concat.getOp() instanceof Add |
30+
string_concat.getRight() = node.asCfgNode()
31+
)
32+
}
33+
2534
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
2635
guard instanceof StringConstCompare
2736
}

‎python/ql/test/query-tests/Security/CWE-601/UrlRedirect.expected‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
edges
22
| test.py:7:14:7:25 | ControlFlowNode for Attribute | test.py:8:21:8:26 | ControlFlowNode for target |
3-
| test.py:15:17:15:28 | ControlFlowNode for Attribute | test.py:18:21:18:24 | ControlFlowNode for safe |
4-
| test.py:23:17:23:28 | ControlFlowNode for Attribute | test.py:25:21:25:24 | ControlFlowNode for safe |
53
| test.py:30:17:30:28 | ControlFlowNode for Attribute | test.py:32:21:32:24 | ControlFlowNode for safe |
64
| test.py:37:17:37:28 | ControlFlowNode for Attribute | test.py:39:21:39:24 | ControlFlowNode for safe |
75
| test.py:44:17:44:28 | ControlFlowNode for Attribute | test.py:46:21:46:24 | ControlFlowNode for safe |
@@ -12,10 +10,6 @@ edges
1210
nodes
1311
| test.py:7:14:7:25 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
1412
| test.py:8:21:8:26 | ControlFlowNode for target | semmle.label | ControlFlowNode for target |
15-
| test.py:15:17:15:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
16-
| test.py:18:21:18:24 | ControlFlowNode for safe | semmle.label | ControlFlowNode for safe |
17-
| test.py:23:17:23:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
18-
| test.py:25:21:25:24 | ControlFlowNode for safe | semmle.label | ControlFlowNode for safe |
1913
| test.py:30:17:30:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
2014
| test.py:32:21:32:24 | ControlFlowNode for safe | semmle.label | ControlFlowNode for safe |
2115
| test.py:37:17:37:28 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
@@ -32,8 +26,6 @@ nodes
3226
| test.py:76:21:76:26 | ControlFlowNode for unsafe | semmle.label | ControlFlowNode for unsafe |
3327
#select
3428
| test.py:8:21:8:26 | ControlFlowNode for target | test.py:7:14:7:25 | ControlFlowNode for Attribute | test.py:8:21:8:26 | ControlFlowNode for target | Untrusted URL redirection due to $@. | test.py:7:14:7:25 | ControlFlowNode for Attribute | A user-provided value |
35-
| test.py:18:21:18:24 | ControlFlowNode for safe | test.py:15:17:15:28 | ControlFlowNode for Attribute | test.py:18:21:18:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:15:17:15:28 | ControlFlowNode for Attribute | A user-provided value |
36-
| test.py:25:21:25:24 | ControlFlowNode for safe | test.py:23:17:23:28 | ControlFlowNode for Attribute | test.py:25:21:25:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:23:17:23:28 | ControlFlowNode for Attribute | A user-provided value |
3729
| test.py:32:21:32:24 | ControlFlowNode for safe | test.py:30:17:30:28 | ControlFlowNode for Attribute | test.py:32:21:32:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:30:17:30:28 | ControlFlowNode for Attribute | A user-provided value |
3830
| test.py:39:21:39:24 | ControlFlowNode for safe | test.py:37:17:37:28 | ControlFlowNode for Attribute | test.py:39:21:39:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:37:17:37:28 | ControlFlowNode for Attribute | A user-provided value |
3931
| test.py:46:21:46:24 | ControlFlowNode for safe | test.py:44:17:44:28 | ControlFlowNode for Attribute | test.py:46:21:46:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:44:17:44:28 | ControlFlowNode for Attribute | A user-provided value |

‎python/ql/test/query-tests/Security/CWE-601/test.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,14 @@ def ok():
1515
untrusted = request.args.get('target', '')
1616
safe = "https://safe.com/"
1717
safe += untrusted
18-
return redirect(safe, code=302) # FP
18+
return redirect(safe, code=302)
1919

2020

2121
@app.route('/ok2')
2222
def ok2():
2323
untrusted = request.args.get('target', '')
2424
safe = "https://safe.com/" + untrusted
25-
return redirect(safe, code=302) # FP
25+
return redirect(safe, code=302)
2626

2727

2828
@app.route('/ok3')

0 commit comments

Comments
 (0)