Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9b3509f

Browse files
RasmusWLRasmusWL
committed
Python: Highlight problem with missing use-use flow
1 parent 428c2a3 commit 9b3509f

2 files changed

Lines changed: 34 additions & 0 deletions

File tree

‎python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078/CommandInjection.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ edges
33
| command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr |
44
| command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | command_injection.py:25:23:25:25 | ControlFlowNode for cmd |
55
| command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr |
6+
| command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:39:15:39:21 | ControlFlowNode for command |
7+
| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:53:15:53:21 | ControlFlowNode for command |
68
nodes
79
| command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
810
| command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
@@ -12,8 +14,14 @@ nodes
1214
| command_injection.py:25:23:25:25 | ControlFlowNode for cmd | semmle.label | ControlFlowNode for cmd |
1315
| command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
1416
| command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
17+
| command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
18+
| command_injection.py:39:15:39:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
19+
| command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
20+
| command_injection.py:53:15:53:21 | ControlFlowNode for command | semmle.label | ControlFlowNode for command |
1521
#select
1622
| command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | command_injection.py:12:15:12:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:10:13:10:24 | ControlFlowNode for Attribute | a user-provided value |
1723
| command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr | command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | command_injection.py:19:22:19:34 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:17:13:17:24 | ControlFlowNode for Attribute | a user-provided value |
1824
| command_injection.py:25:23:25:25 | ControlFlowNode for cmd | command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | command_injection.py:25:23:25:25 | ControlFlowNode for cmd | This command depends on $@. | command_injection.py:24:11:24:22 | ControlFlowNode for Attribute | a user-provided value |
1925
| command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | command_injection.py:32:14:32:26 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:30:13:30:24 | ControlFlowNode for Attribute | a user-provided value |
26+
| command_injection.py:39:15:39:21 | ControlFlowNode for command | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | command_injection.py:39:15:39:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:36:15:36:26 | ControlFlowNode for Attribute | a user-provided value |
27+
| command_injection.py:53:15:53:21 | ControlFlowNode for command | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | command_injection.py:53:15:53:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:52:15:52:26 | ControlFlowNode for Attribute | a user-provided value |

‎python/ql/test/experimental/query-tests/Security-new-dataflow/CWE-078/command_injection.py‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,5 +31,31 @@ def others():
3131
# Don't let files be `; rm -rf /`
3232
os.popen("ls " + files)
3333

34+
@app.route("/multiple")
35+
def multiple():
36+
command = request.args.get('command', '')
37+
# We should mark flow to both calls here, which conflicts with removing flow out of
38+
# a sink due to use-use flow.
39+
os.system(command)
40+
os.system(command)
41+
42+
43+
@app.route("/not-into-sink-impl")
44+
def not_into_sink_impl():
45+
"""When there is flow to a sink such as `os.popen(cmd)`, we don't want to highlight that there is also
46+
flow through the actual `popen` function to the internal call to `subprocess.Popen` -- we would usually
47+
see that flow since we extract the `os.py` file from the standard library.
48+
49+
os.popen implementation:
50+
https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/os.py#L974
51+
"""
52+
command = request.args.get('command', '')
53+
os.system(command)
54+
os.popen(command)
55+
subprocess.call(command)
56+
subprocess.check_call(command)
57+
subprocess.run(command)
58+
59+
3460
# TODO: popen2 module for Python 2 only https://devdocs.io/python~2.7/library/popen2
3561
# (deprecated since Python 2.6, but still functional in Python 2.7.17)

0 commit comments

Comments
 (0)