Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 831d522

Browse files
KwstubbsKwstubbs
committed
First round feedback
1 parent c60f459 commit 831d522

5 files changed

Lines changed: 26 additions & 50 deletions

File tree

‎python/ql/lib/semmle/python/Concepts.qll‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1422,18 +1422,18 @@ module Http {
14221422
/**
14231423
* Gets the string corresponding to the middleware
14241424
*/
1425-
string middleware_name() { result = super.middleware_name() }
1425+
string getMiddlewareName() { result = super.getMiddlewareName() }
14261426

14271427
/**
14281428
* Gets the dataflow node corresponding to the allowed CORS origins
14291429
*/
1430-
DataFlow::Node allowed_origins() { result = super.allowed_origins() }
1430+
DataFlow::Node getOrigins() { result = super.getOrigins() }
14311431

14321432
/**
14331433
* Gets the boolean value corresponding to if CORS credentials is enabled
14341434
* (`true`) or disabled (`false`) by this node.
14351435
*/
1436-
DataFlow::Node allowed_credentials() { result = super.allowed_credentials() }
1436+
DataFlow::Node getCredentialsAllowed() { result = super.getCredentialsAllowed() }
14371437
}
14381438

14391439
/** Provides a class for modeling new CORS middleware APIs. */
@@ -1447,20 +1447,20 @@ module Http {
14471447
*/
14481448
abstract class Range extends DataFlow::Node {
14491449
/**
1450-
* Gets the string corresponding to the middleware
1450+
* Gets the name corresponding to the middleware
14511451
*/
1452-
abstract string middleware_name();
1452+
abstract string getMiddlewareName();
14531453

14541454
/**
14551455
* Gets the boolean value corresponding to if CORS credentials is enabled
14561456
* (`true`) or disabled (`false`) by this node.
14571457
*/
1458-
abstract DataFlow::Node allowed_credentials();
1458+
abstract DataFlow::Node getCredentialsAllowed();
14591459

14601460
/**
14611461
* Gets the strings corresponding to the origins allowed by the cors policy
14621462
*/
1463-
abstract DataFlow::Node allowed_origins();
1463+
abstract DataFlow::Node getOrigins();
14641464
}
14651465
}
14661466

‎python/ql/lib/semmle/python/frameworks/FastApi.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ module FastApi {
3939
/**
4040
* Gets the string corresponding to the middleware
4141
*/
42-
string middleware_name() { result = this.getArg(0).asExpr().(Name).toString() }
42+
string getMiddlewareName() { result = this.getArg(0).asExpr().(Name).getId() }
4343
}
4444

4545
/**
@@ -49,18 +49,18 @@ module FastApi {
4949
/**
5050
* Gets the string corresponding to the middleware
5151
*/
52-
override string middleware_name() { result = this.getArg(0).asExpr().(Name).toString() }
52+
override string getMiddlewareName() { result = this.getArg(0).asExpr().(Name).getId() }
5353

5454
/**
5555
* Gets the dataflow node corresponding to the allowed CORS origins
5656
*/
57-
override DataFlow::Node allowed_origins() { result = this.getArgByName("allow_origins") }
57+
override DataFlow::Node getOrigins() { result = this.getArgByName("allow_origins") }
5858

5959
/**
6060
* Gets the boolean value corresponding to if CORS credentials is enabled
6161
* (`true`) or disabled (`false`) by this node.
6262
*/
63-
override DataFlow::Node allowed_credentials() {
63+
override DataFlow::Node getCredentialsAllowed() {
6464
result = this.getArgByName("allow_credentials")
6565
}
6666

‎python/ql/lib/semmle/python/frameworks/Starlette.qll‎

Lines changed: 6 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ module Starlette {
3333
API::Node cls() { result = API::moduleImport("starlette").getMember("app") }
3434

3535
/** Gets a reference to a Starlette application (an instance of `starlette.app`). */
36-
API::Node instance() { result = cls().getReturn() }
36+
API::Node instance() { result = cls().getAnInstance() }
3737
}
3838

3939
/**
@@ -47,7 +47,7 @@ module Starlette {
4747
/**
4848
* Gets the string corresponding to the middleware
4949
*/
50-
string middleware_name() { result = this.getArg(0).asExpr().(Name).toString() }
50+
string getMiddlewareName() { result = this.getArg(0).asExpr().(Name).getId() }
5151
}
5252

5353
/**
@@ -57,11 +57,11 @@ module Starlette {
5757
/**
5858
* Gets the string corresponding to the middleware
5959
*/
60-
override string middleware_name() { result = this.getArg(0).asExpr().(Name).toString() }
60+
override string getMiddlewareName() { result = this.getArg(0).asExpr().(Name).getId() }
6161

62-
override DataFlow::Node allowed_origins() { result = this.getArgByName("allow_origins") }
62+
override DataFlow::Node getOrigins() { result = this.getArgByName("allow_origins") }
6363

64-
override DataFlow::Node allowed_credentials() {
64+
override DataFlow::Node getCredentialsAllowed() {
6565
result = this.getArgByName("allow_credentials")
6666
}
6767

@@ -89,32 +89,8 @@ module Starlette {
8989
result = ModelOutput::getATypeNode("starlette.middleware.Middleware~Subclass").getASubclass*()
9090
}
9191

92-
/**
93-
* A source of instances of `starlette.middleware.Middleware`, extend this class to model new instances.
94-
*
95-
* This can include instantiations of the class, return values from function
96-
* calls, or a special parameter that will be set when functions are called by an external
97-
* library.
98-
*
99-
* Use the predicate `Middleware::instance()` to get references to instances of `starlette.middleware.middleware`.
100-
*/
101-
abstract class InstanceSource extends DataFlow::LocalSourceNode { }
102-
103-
/** A direct instantiation of `starlette.middleware.Middleware`. */
104-
class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
105-
ClassInstantiation() { this = classRef().getACall() }
106-
}
107-
108-
/** Gets a reference to an instance of `starlette.middleware.Middleware`. */
109-
private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {
110-
t.start() and
111-
result instanceof InstanceSource
112-
or
113-
exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
114-
}
115-
11692
/** Gets a reference to an instance of `starlette.middleware.Middleware`. */
117-
DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
93+
DataFlow::Node instance() { result = classRef().getACall() }
11894
}
11995

12096
/**

‎python/ql/src/experimental/Security/CWE-942/CorsMisconfigurationMiddleware.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@
1919
meaning that Peer B can send a request to Peer A that will include the cookies as if the request was executed by the user.
2020
</p>
2121
<p>
22-
That can have dangerous effects if Peer B origin is not restricted correctly.
23-
An example of a dangerous scenario is when <code>Access-Control-Allow-Origin</code> header is set to a value gotten from the Peer B's request
22+
That can have dangerous effects if the origin of Peer B is not restricted correctly.
23+
An example of a dangerous scenario is when <code>Access-Control-Allow-Origin</code> header is set to a value obtained from the request made by Peer B
2424
(and not correctly validated), or is set to special values such as <code>*</code> or <code>null</code>.
2525
The above values can allow any Peer B to send requests to the misconfigured Peer A on behalf of the user.
2626
</p>

‎python/ql/src/experimental/Security/CWE-942/CorsMisconfigurationMiddleware.ql‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
* @problem.severity warning
77
* @security-severity 8.8
88
* @precision high
9-
* @id py/insecure-cors-setting
9+
* @id py/cors-misconfiguration-with-credentials
1010
* @tags security
1111
* external/cwe/cwe-942
1212
*/
@@ -17,23 +17,23 @@ private import semmle.python.dataflow.new.DataFlow
1717

1818
predicate containsStar(DataFlow::Node array) {
1919
array.asExpr() instanceof List and
20-
array.asExpr().getASubExpression().(StringLiteral).getText() = ["*", "null"]
20+
array.asExpr().getASubExpression().(StringLiteral).getText() in ["*", "null"]
2121
or
22-
array.asExpr().(StringLiteral).getText() = ["*", "null"]
22+
array.asExpr().(StringLiteral).getText() in ["*", "null"]
2323
}
2424

2525
predicate isCorsMiddleware(Http::Server::CorsMiddleware middleware) {
26-
middleware.middleware_name().matches("CORSMiddleware")
26+
middleware.getMiddlewareName() = "CORSMiddleware"
2727
}
2828

2929
predicate credentialsAllowed(Http::Server::CorsMiddleware middleware) {
30-
middleware.allowed_credentials().asExpr() instanceof True
30+
middleware.getCredentialsAllowed().asExpr() instanceof True
3131
}
3232

3333
from Http::Server::CorsMiddleware a
3434
where
3535
credentialsAllowed(a) and
36-
containsStar(a.allowed_origins().getALocalSource()) and
36+
containsStar(a.getOrigins().getALocalSource()) and
3737
isCorsMiddleware(a)
3838
select a,
39-
"This CORS middleware uses a vulnerable configuration that leaves it open to attacks from arbitrary websites"
39+
"This CORS middleware uses a vulnerable configuration that allows arbitrary websites to make authenticated cross-site requests"

0 commit comments

Comments
 (0)