Python: Fix tornado and twisted request attribute tracking; 'path' attribute can be trusted, but 'uri' and 'arguments' cannot.

markshannon · markshannon · commit b841ecbb7c9f · 2019-01-28T11:26:00.000Z
diff --git a/python/ql/src/semmle/python/web/tornado/Request.qll b/python/ql/src/semmle/python/web/tornado/Request.qll
@@ -15,16 +15,22 @@ class TornadoRequest extends TaintKind {
         result instanceof ExternalStringDictKind and
         (
             name = "headers" or
-            name = "arguments" or
             name = "cookies"
         )
         or
         result instanceof ExternalStringKind and
         (
-            name = "path" or
+            name = "uri" or
             name = "query" or
             name = "body"
         )
+        or
+        result instanceof ExternalStringSequenceDictKind and
+        (
+            name = "arguments" or
+            name = "query_arguments" or
+            name = "body_arguments"
+        )
     }
 
 }
diff --git a/python/ql/src/semmle/python/web/twisted/Request.qll b/python/ql/src/semmle/python/web/twisted/Request.qll
@@ -19,8 +19,7 @@ class TwistedRequest extends TaintKind {
         or
         result instanceof ExternalStringKind and
         (
-            name = "uri" or
-            name = "path"
+            name = "uri"
         )
     }
 

Original file line number	Diff line number	Diff line change
`@@ -15,16 +15,22 @@ class TornadoRequest extends TaintKind {`
`15`	`15`	`result instanceof ExternalStringDictKind and`
`16`	`16`	`(`
`17`	`17`	`name = "headers" or`
`18`		`- name = "arguments" or`
`19`	`18`	`name = "cookies"`
`20`	`19`	`)`
`21`	`20`	`or`
`22`	`21`	`result instanceof ExternalStringKind and`
`23`	`22`	`(`
`24`		`- name = "path" or`
	`23`	`+ name = "uri" or`
`25`	`24`	`name = "query" or`
`26`	`25`	`name = "body"`
`27`	`26`	`)`
	`27`	`+ or`
	`28`	`+ result instanceof ExternalStringSequenceDictKind and`
	`29`	`+ (`
	`30`	`+ name = "arguments" or`
	`31`	`+ name = "query_arguments" or`
	`32`	`+ name = "body_arguments"`
	`33`	`+ )`
`28`	`34`	`}`
`29`	`35`
`30`	`36`	`}`
Original file line number	Diff line number	Diff line change
`@@ -19,8 +19,7 @@ class TwistedRequest extends TaintKind {`
`19`	`19`	`or`
`20`	`20`	`result instanceof ExternalStringKind and`
`21`	`21`	`(`
`22`		`- name = "uri" or`
`23`		`- name = "path"`
	`22`	`+ name = "uri"`
`24`	`23`	`)`
`25`	`24`	`}`
`26`	`25`