Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 72e6a14

Browse files
RasmusWLRasmusWL
committed
Python: Add taint-steps for MultiDictProxy
1 parent e76f02b commit 72e6a14

5 files changed

Lines changed: 85 additions & 5 deletions

File tree

‎docs/codeql/support/reusables/frameworks.rst‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,9 @@ Python built-in support
161161
simplejson, Serialization
162162
ujson, Serialization
163163
fabric, Utility library
164-
invoke, Utility library
165164
idna, Utility library
165+
invoke, Utility library
166+
multidict, Utility library
166167
mysql-connector-python, Database
167168
MySQLdb, Database
168169
psycopg2, Database

‎python/ql/src/semmle/python/Frameworks.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ private import semmle.python.frameworks.Fabric
1313
private import semmle.python.frameworks.Flask
1414
private import semmle.python.frameworks.Idna
1515
private import semmle.python.frameworks.Invoke
16+
private import semmle.python.frameworks.Multidict
1617
private import semmle.python.frameworks.MysqlConnectorPython
1718
private import semmle.python.frameworks.MySQLdb
1819
private import semmle.python.frameworks.Psycopg2

‎python/ql/src/semmle/python/frameworks/Aiohttp.qll‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ private import semmle.python.dataflow.new.TaintTracking
1010
private import semmle.python.Concepts
1111
private import semmle.python.ApiGraphs
1212
private import semmle.python.frameworks.internal.PoorMansFunctionResolution
13+
private import semmle.python.frameworks.Multidict
1314

1415
/**
1516
* INTERNAL: Do not use.
@@ -241,5 +242,10 @@ module AiohttpWebModel {
241242
}
242243
}
243244

244-
245+
class AiohttpRequestMultiDictProxyInstances extends Multidict::MultiDictProxy::InstanceSource {
246+
AiohttpRequestMultiDictProxyInstances() {
247+
this.(DataFlow::AttrRead).getObject() = Request::instance() and
248+
this.(DataFlow::AttrRead).getAttributeName() in ["query", "headers"]
249+
}
250+
}
245251
}

‎python/ql/src/semmle/python/frameworks/Multidict.qll‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `multidict` PyPI package.
3+
* See https://multidict.readthedocs.io/en/stable/.
4+
*/
5+
6+
private import python
7+
private import semmle.python.dataflow.new.DataFlow
8+
private import semmle.python.dataflow.new.TaintTracking
9+
private import semmle.python.Concepts
10+
private import semmle.python.ApiGraphs
11+
12+
/**
13+
* INTERNAL: Do not use.
14+
*
15+
* Provides models for the `multidict` PyPI package.
16+
* See https://multidict.readthedocs.io/en/stable/.
17+
*/
18+
module Multidict {
19+
/**
20+
* Provides models for a `MultiDictProxy` class:
21+
* - `multidict.MultiDictProxy`
22+
* - `multidict.CIMultiDictProxy`
23+
*
24+
* See https://multidict.readthedocs.io/en/stable/multidict.html#multidictproxy
25+
*/
26+
module MultiDictProxy {
27+
/**
28+
* A source of instances of `multidict.MultiDictProxy`, extend this class to model
29+
* new instances.
30+
*
31+
* This can include instantiations of the class, return values from function
32+
* calls, or a special parameter that will be set when functions are called by an external
33+
* library.
34+
*
35+
* Use `MultiDictProxy::instance()` predicate to get
36+
* references to instances of `multidict.MultiDictProxy`.
37+
*/
38+
abstract class InstanceSource extends DataFlow::LocalSourceNode { }
39+
40+
/** Gets a reference to an instance of `multidict.MultiDictProxy`. */
41+
private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
42+
t.start() and
43+
result instanceof InstanceSource
44+
or
45+
exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
46+
}
47+
48+
/** Gets a reference to an instance of `multidict.MultiDictProxy`. */
49+
DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
50+
51+
/**
52+
* Taint propagation for `multidict.MultiDictProxy`.
53+
*
54+
* See https://multidict.readthedocs.io/en/stable/multidict.html#multidictproxy
55+
*/
56+
class MultiDictProxyAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
57+
override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
58+
// Methods
59+
//
60+
// TODO: When we have tools that make it easy, model these properly to handle
61+
// `meth = obj.meth; meth()`. Until then, we'll use this more syntactic approach
62+
// (since it allows us to at least capture the most common cases).
63+
nodeFrom = instance() and
64+
exists(DataFlow::AttrRead attr | attr.getObject() = nodeFrom |
65+
// methods (non-async)
66+
attr.getAttributeName() in ["getone", "getall"] and
67+
nodeTo.(DataFlow::CallCfgNode).getFunction() = attr
68+
)
69+
}
70+
}
71+
}
72+
}

‎python/ql/test/library-tests/frameworks/aiohttp/taint_test.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ async def test_taint(request: web.Request): # $ requestHandler
3232
request.query, # $ tainted
3333
request.query["key"], # $ tainted
3434
request.query.get("key"), # $ tainted
35-
request.query.getone("key"), # $ MISSING: tainted
36-
request.query.getall("key"), # $ MISSING: tainted
35+
request.query.getone("key"), # $ tainted
36+
request.query.getall("key"), # $ tainted
3737
request.query.keys(), # $ MISSING: tainted
3838
request.query.values(), # $ tainted
3939
request.query.items(), # $ tainted
@@ -47,7 +47,7 @@ async def test_taint(request: web.Request): # $ requestHandler
4747
# an instance of the right class, and have the actual taint_test for that in a
4848
# different file!
4949
request.headers, # $ tainted
50-
request.headers.getone("key"), # $ MISSING: tainted
50+
request.headers.getone("key"), # $ tainted
5151

5252
# https://docs.python.org/3/library/asyncio-protocol.html#asyncio-transport
5353
# TODO

0 commit comments

Comments
 (0)