|
12 | 12 | */ |
13 | 13 |
|
14 | 14 | import go |
15 | | -import MultipartAndFormRemoteSource |
16 | 15 | import experimental.frameworks.DecompressionBombs |
| 16 | +import DecompressionBomb::Flow::PathGraph |
17 | 17 |
|
18 | | -module Config implements DataFlow::StateConfigSig { |
19 | | - class FlowState = DecompressionBombs::FlowState; |
20 | | - |
21 | | - predicate isSource(DataFlow::Node source, FlowState state) { |
22 | | - source instanceof UntrustedFlowSource and |
23 | | - state = "" |
24 | | - } |
25 | | - |
26 | | - predicate isSink(DataFlow::Node sink, FlowState state) { |
27 | | - sink instanceof DecompressionBombs::Sink and |
28 | | - state = |
29 | | - [ |
30 | | - "ZstdNewReader", "XzNewReader", "GzipNewReader", "PgzipNewReader", "S2NewReader", |
31 | | - "SnappyNewReader", "ZlibNewReader", "FlateNewReader", "Bzip2NewReader", "ZipOpenReader", |
32 | | - "ZipKlauspost" |
33 | | - ] |
34 | | - } |
35 | | - |
36 | | - predicate isAdditionalFlowStep(DataFlow::Node fromNode, DataFlow::Node toNode) { |
37 | | - exists(DecompressionBombs::AdditionalTaintStep addStep | |
38 | | - addStep.isAdditionalFlowStep(fromNode, toNode) |
39 | | - ) |
40 | | - } |
41 | | - |
42 | | - predicate isAdditionalFlowStep( |
43 | | - DataFlow::Node fromNode, FlowState fromState, DataFlow::Node toNode, FlowState toState |
44 | | - ) { |
45 | | - exists(DecompressionBombs::AdditionalTaintStep addStep | |
46 | | - addStep.isAdditionalFlowStep(fromNode, fromState, toNode, toState) |
47 | | - ) |
48 | | - } |
49 | | -} |
50 | | - |
51 | | -module Flow = TaintTracking::GlobalWithState<Config>; |
52 | | - |
53 | | -import Flow::PathGraph |
54 | | - |
55 | | -from Flow::PathNode source, Flow::PathNode sink |
56 | | -where Flow::flowPath(source, sink) |
| 18 | +from DecompressionBomb::Flow::PathNode source, DecompressionBomb::Flow::PathNode sink |
| 19 | +where DecompressionBomb::Flow::flowPath(source, sink) |
57 | 20 | select sink.getNode(), source, sink, "This decompression is $@.", source.getNode(), |
58 | 21 | "decompressing compressed data without managing output size" |
0 commit comments