Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9338374

Browse files
yoffyoff
committed
Python: Use more common name for concept
1 parent a76d276 commit 9338374

9 files changed

Lines changed: 36 additions & 38 deletions

File tree

‎python/ql/src/experimental/Security-new-dataflow/CWE-502/UnsafeDeserialization.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ class UnsafeDeserializationConfiguration extends TaintTracking::Configuration {
2424
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
2525

2626
override predicate isSink(DataFlow::Node sink) {
27-
exists(UnmarshalingFunction d |
27+
exists(Decoding d |
2828
d.unsafe() and
2929
sink = d.getAnInput()
3030
)

‎python/ql/src/experimental/semmle/python/Concepts.qll‎

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -40,17 +40,20 @@ module SystemCommandExecution {
4040
}
4141

4242
/**
43-
* A function that decodes data from a binary or textual format.
43+
* A data-flow node that decodes data from a binary or textual format. This
44+
* is intended to include deserialization, unmarshalling, decoding, unpickling,
45+
* unzipping, decrypting, parsing etc.
46+
*
4447
* Doing so should normally preserve taint, but it can also be a problem
45-
* in itself, e.g. if it performs deserialization in a potentially unsafe way.
48+
* in itself, e.g. if it allows code execution or could result in deinal-of-service.
4649
*
4750
* Extend this class to refine existing API models. If you want to model new APIs,
48-
* extend `UnmarshalingFunction::Range` instead.
51+
* extend `Decoding::Range` instead.
4952
*/
50-
class UnmarshalingFunction extends DataFlow::Node {
51-
UnmarshalingFunction::Range self;
53+
class Decoding extends DataFlow::Node {
54+
Decoding::Range self;
5255

53-
UnmarshalingFunction() { this = self }
56+
Decoding() { this = self }
5457

5558
/** Holds if this call is unsafe, e.g. if it may execute arbitrary code. */
5659
predicate unsafe() { self.unsafe() }
@@ -65,15 +68,18 @@ class UnmarshalingFunction extends DataFlow::Node {
6568
string getFormat() { result = self.getFormat() }
6669
}
6770

68-
/** Provides a class for modeling new unmarshaling/decoding/deserialization functions. */
69-
module UnmarshalingFunction {
71+
/** Provides a class for modeling new decoding mechanisms. */
72+
module Decoding {
7073
/**
71-
* A function that decodes data from a binary or textual format.
72-
* Doing so should normally preserve taint, but it can oalso be a problem
73-
* in itself, e.g. if it performs deserialization in a potentially unsafe way.
74+
* A data-flow node that decodes data from a binary or textual format. This
75+
* is intended to include deserialization, unmarshalling, decoding, unpickling,
76+
* unzipping, decrypting, parsing etc.
77+
*
78+
* Doing so should normally preserve taint, but it can also be a problem
79+
* in itself, e.g. if it allows code execution or could result in deinal-of-service.
7480
*
7581
* Extend this class to model new APIs. If you want to refine existing API models,
76-
* extend `UnmarshalingFunction` instead.
82+
* extend `Decoding` instead.
7783
*/
7884
abstract class Range extends DataFlow::Node {
7985
/** Holds if this call is unsafe, e.g. if it may execute arbitrary code. */

‎python/ql/src/experimental/semmle/python/frameworks/Dill.qll‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,8 @@ private module Dill {
4343
* See https://pypi.org/project/dill/ (which currently refers you
4444
* to https://docs.python.org/3/library/pickle.html#pickle.loads)
4545
*/
46-
private class DillLoadsCall extends UnmarshalingFunction::Range {
47-
DillLoadsCall() {
48-
this.asCfgNode().(CallNode).getFunction() = Dill::dill::loads().asCfgNode()
49-
}
46+
private class DillLoadsCall extends Decoding::Range {
47+
DillLoadsCall() { this.asCfgNode().(CallNode).getFunction() = Dill::dill::loads().asCfgNode() }
5048

5149
override predicate unsafe() { any() }
5250

‎python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -363,10 +363,8 @@ private module Stdlib {
363363
* A call to `marshal.loads`
364364
* See https://docs.python.org/3/library/marshal.html#marshal.loads
365365
*/
366-
private class MarshalLoadsCall extends UnmarshalingFunction::Range {
367-
MarshalLoadsCall() {
368-
this.asCfgNode().(CallNode).getFunction() = marshal::loads().asCfgNode()
369-
}
366+
private class MarshalLoadsCall extends Decoding::Range {
367+
MarshalLoadsCall() { this.asCfgNode().(CallNode).getFunction() = marshal::loads().asCfgNode() }
370368

371369
override predicate unsafe() { any() }
372370

@@ -416,10 +414,8 @@ private module Stdlib {
416414
* A call to `pickle.loads`
417415
* See https://docs.python.org/3/library/pickle.html#pickle.loads
418416
*/
419-
private class PickleLoadsCall extends UnmarshalingFunction::Range {
420-
PickleLoadsCall() {
421-
this.asCfgNode().(CallNode).getFunction() = pickle::loads().asCfgNode()
422-
}
417+
private class PickleLoadsCall extends Decoding::Range {
418+
PickleLoadsCall() { this.asCfgNode().(CallNode).getFunction() = pickle::loads().asCfgNode() }
423419

424420
override predicate unsafe() { any() }
425421

‎python/ql/src/experimental/semmle/python/frameworks/Yaml.qll‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,8 @@ private module Yaml {
4545
* This function was briefly thought safe until new exploits were found in 2020,
4646
* see https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation for details.
4747
*/
48-
private class YamlDeserialization extends UnmarshalingFunction::Range {
49-
YamlDeserialization() {
50-
this.asCfgNode().(CallNode).getFunction() = Yaml::yaml::load().asCfgNode()
51-
}
48+
private class YamlLoadCall extends Decoding::Range {
49+
YamlLoadCall() { this.asCfgNode().(CallNode).getFunction() = Yaml::yaml::load().asCfgNode() }
5250

5351
override predicate unsafe() {
5452
// If the `Loader` is not set to either `SafeLoader` or `BaseLoader` or not set at all,

python/ql/test/experimental/library-tests/frameworks/dill/UnmarshalFunction.py renamed to python/ql/test/experimental/library-tests/frameworks/dill/Decoding.py

File renamed without changes.

python/ql/test/experimental/library-tests/frameworks/stdlib/UnmarshalFunction.py renamed to python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py

File renamed without changes.

python/ql/test/experimental/library-tests/frameworks/yaml/UnmarshalFunction.py renamed to python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py

File renamed without changes.

‎python/ql/test/experimental/meta/ConceptsTest.qll‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -33,38 +33,38 @@ class SystemCommandExecutionTest extends InlineExpectationsTest {
3333
}
3434
}
3535

36-
class UnmarshalingFunctionTest extends InlineExpectationsTest {
37-
UnmarshalingFunctionTest() { this = "UnmarshalingFunctionTest" }
36+
class DecodingTest extends InlineExpectationsTest {
37+
DecodingTest() { this = "DecodingTest" }
3838

3939
override string getARelevantTag() { result in ["getAnInput", "getOutput", "getFormat"] }
4040

4141
override predicate hasActualResult(Location location, string element, string tag, string value) {
4242
exists(location.getFile().getRelativePath()) and
43-
exists(UnmarshalingFunction ds, string unsafe |
43+
exists(Decoding d, string unsafe |
4444
(
45-
ds.unsafe() and unsafe = "UNSAFE_"
45+
d.unsafe() and unsafe = "UNSAFE_"
4646
or
47-
not ds.unsafe() and unsafe = ""
47+
not d.unsafe() and unsafe = ""
4848
) and
4949
(
5050
exists(DataFlow::Node data |
5151
location = data.getLocation() and
5252
element = data.toString() and
5353
value = value_from_expr(data.asExpr()) and
5454
(
55-
data = ds.getAnInput() and
55+
data = d.getAnInput() and
5656
tag = unsafe + "getAnInput"
5757
or
58-
data = ds.getOutput() and
58+
data = d.getOutput() and
5959
tag = unsafe + "getOutput"
6060
)
6161
)
6262
or
6363
exists(string format |
64-
location = ds.getLocation() and
64+
location = d.getLocation() and
6565
element = format and
6666
value = format and
67-
format = ds.getFormat() and
67+
format = d.getFormat() and
6868
tag = unsafe + "getFormat"
6969
)
7070
)

0 commit comments

Comments
 (0)