Python: Reorganise code a bit to minimize diff for PR.

markshannon · markshannon · commit 91aefab7aa72 · 2019-08-29T10:31:50.000+01:00
diff --git a/python/ql/src/Security/CWE-089/SqlInjection.ql b/python/ql/src/Security/CWE-089/SqlInjection.ql
@@ -26,9 +26,7 @@ class SQLInjectionConfiguration extends TaintTracking::Configuration {
 
     SQLInjectionConfiguration() { this = "SQL injection configuration" }
 
-    override predicate isSource(TaintTracking::Source source) {
-        source instanceof HttpRequestTaintSource
-    }
+    override predicate isSource(TaintTracking::Source source) { source instanceof HttpRequestTaintSource }
 
     override predicate isSink(TaintTracking::Sink sink) { sink instanceof SqlInjectionSink }
 
diff --git a/python/ql/src/Security/CWE-209/StackTraceExposure.ql b/python/ql/src/Security/CWE-209/StackTraceExposure.ql
@@ -33,6 +33,3 @@ class StackTraceExposureConfiguration extends TaintTracking::Configuration {
 from StackTraceExposureConfiguration config, TaintedPathSource src, TaintedPathSink sink
 where config.hasFlowPath(src, sink)
 select sink.getSink(), src, sink, "$@ may be exposed to an external user", src.getSource(), "Error information"
-
-
-
diff --git a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql
@@ -16,9 +16,7 @@ class BrokenCryptoConfiguration extends TaintTracking::Configuration {
 
     BrokenCryptoConfiguration() { this = "Broken crypto configuration" }
 
-    override predicate isSource(TaintTracking::Source source) { 
-        source instanceof SensitiveDataSource
-    }
+    override predicate isSource(TaintTracking::Source source) { source instanceof SensitiveDataSource }
 
     override predicate isSink(TaintTracking::Sink sink) {
         sink instanceof WeakCryptoSink
diff --git a/python/ql/src/semmle/python/dataflow/Implementation.qll b/python/ql/src/semmle/python/dataflow/Implementation.qll
@@ -2,7 +2,6 @@ import python
 import semmle.python.security.TaintTracking
 private import semmle.python.objects.ObjectInternal
 private import semmle.python.pointsto.Filters as Filters
-private import semmle.python.dataflow.Presentation
 
 newtype TTaintTrackingContext =
     TNoParam()
diff --git a/python/ql/src/semmle/python/dataflow/Paths.qll b/python/ql/src/semmle/python/dataflow/Paths.qll
diff --git a/python/ql/src/semmle/python/dataflow/Presentation.qll b/python/ql/src/semmle/python/dataflow/Presentation.qll
diff --git a/python/ql/src/semmle/python/security/Paths.qll b/python/ql/src/semmle/python/security/Paths.qll
@@ -1 +1,20 @@
-import semmle.python.dataflow.Paths
+import semmle.python.dataflow.Implementation
+
+module TaintTrackingPaths {
+
+
+    predicate edge(TaintTrackingNode src, TaintTrackingNode dest, string label) {
+        exists(TaintTrackingNode source, TaintTrackingNode sink |
+            source.getConfiguration().hasFlowPath(source, sink) and
+            source.getASuccessor*() = src and
+            src.getASuccessor(label) = dest and
+            dest.getASuccessor*() = sink
+        )
+    }
+
+}
+
+
+query predicate edges(TaintTrackingNode fromnode, TaintTrackingNode tonode) {
+    TaintTrackingPaths::edge(fromnode, tonode, _)
+}
