Python: Generalize turbogear response sinks to allow for internally sourced strings.

markshannon · markshannon · commit a480da6ed51f · 2019-02-26T18:31:06.000Z
diff --git a/python/ql/src/semmle/python/security/strings/Basic.qll b/python/ql/src/semmle/python/security/strings/Basic.qll
@@ -115,3 +115,14 @@ private predicate os_path_join(ControlFlowNode fromnode, CallNode tonode) {
         tonode = path_join.getACall() and tonode.getAnArg() = fromnode 
     )
 }
+
+/** A kind of "taint", representing a dictionary mapping str->"taint" */
+class StringDictKind extends DictKind {
+
+    StringDictKind() {
+        this.getValue() instanceof StringKind
+    }
+
+}
+
+
diff --git a/python/ql/src/semmle/python/web/turbogears/Response.qll b/python/ql/src/semmle/python/web/turbogears/Response.qll
@@ -1,7 +1,7 @@
 import python
 
 import semmle.python.security.TaintTracking
-import semmle.python.security.strings.Untrusted
+import semmle.python.security.strings.Basic
 
 import TurboGears
 
@@ -17,7 +17,7 @@ class ControllerMethodReturnValue extends TaintSink {
     }
 
     override predicate sinks(TaintKind kind) {
-        kind instanceof ExternalStringKind
+        kind instanceof StringKind
     }
 
 }
@@ -32,7 +32,7 @@ class ControllerMethodTemplatedReturnValue extends TaintSink {
     }
 
     override predicate sinks(TaintKind kind) {
-        kind instanceof ExternalStringDictKind
+        kind instanceof StringDictKind
     }
 
-}
+}

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`import python`
`2`	`2`
`3`	`3`	`import semmle.python.security.TaintTracking`
`4`		`-import semmle.python.security.strings.Untrusted`
	`4`	`+import semmle.python.security.strings.Basic`
`5`	`5`
`6`	`6`	`import TurboGears`
`7`	`7`
`@@ -17,7 +17,7 @@ class ControllerMethodReturnValue extends TaintSink {`
`17`	`17`	`}`
`18`	`18`
`19`	`19`	`override predicate sinks(TaintKind kind) {`
`20`		`- kind instanceof ExternalStringKind`
	`20`	`+ kind instanceof StringKind`
`21`	`21`	`}`
`22`	`22`
`23`	`23`	`}`
`@@ -32,7 +32,7 @@ class ControllerMethodTemplatedReturnValue extends TaintSink {`
`32`	`32`	`}`
`33`	`33`
`34`	`34`	`override predicate sinks(TaintKind kind) {`
`35`		`- kind instanceof ExternalStringDictKind`
	`35`	`+ kind instanceof StringDictKind`
`36`	`36`	`}`
`37`	`37`
`38`		`-}`
	`38`	`+}`