Extend ldap3's start_tls and fix tests

jorgectf · jorgectf · commit b03e75e3d192 · 2021-07-22T18:42:41.000+02:00
diff --git a/python/ql/src/experimental/semmle/python/frameworks/LDAP.qll b/python/ql/src/experimental/semmle/python/frameworks/LDAP.qll
@@ -219,6 +219,11 @@ private module LDAP {
               .(DataFlow::LocalSourceNode)
               .flowsTo([serverCall.getArg(2), serverCall.getArgByName("use_ssl")])
         )
+        or
+        exists(DataFlow::AttrRead startTLS |
+          startTLS.getAttributeName().matches("%start_tls%") and
+          startTLS.getObject().getALocalSource() = this
+        )
       }
     }
 
diff --git a/python/ql/test/experimental/query-tests/Security/CWE-522/ldap3_remote.py b/python/ql/test/experimental/query-tests/Security/CWE-522/ldap3_remote.py
@@ -48,7 +48,7 @@ def three():
 def four():
     host = "ldap://" + remote_host
 
-    srv = Server(host, port=1337, True)
+    srv = Server(host, 1337, True)
     conn = Connection(srv, "dn", "password")
     conn.search("dn", "search_filter")
     return conn.response
@@ -87,7 +87,7 @@ def six():
 def seven():
     host = schema + request.args['host']
 
-    srv = Server(host, port=1337, True)
+    srv = Server(host, 1337, True)
     conn = Connection(srv, "dn", "password")
     conn.search("dn", "search_filter")
     return conn.response
@@ -112,7 +112,7 @@ def eight():
 @app.route("/nine")
 def nine():
     host = schema + "somethingon.theinternet.com"
-    srv = Server(host, port=1337, False)
+    srv = Server(host, 1337, False)
     conn = Connection(srv, "dn", "password")
     conn.search("dn", "search_filter")
     return conn.response

Original file line number	Diff line number	Diff line change
`@@ -219,6 +219,11 @@ private module LDAP {`
`219`	`219`	`.(DataFlow::LocalSourceNode)`
`220`	`220`	`.flowsTo([serverCall.getArg(2), serverCall.getArgByName("use_ssl")])`
`221`	`221`	`)`
	`222`	`+ or`
	`223`	`+ exists(DataFlow::AttrRead startTLS \|`
	`224`	`+ startTLS.getAttributeName().matches("%start_tls%") and`
	`225`	`+ startTLS.getObject().getALocalSource() = this`
	`226`	`+ )`
`222`	`227`	`}`
`223`	`228`	`}`
`224`	`229`