Python: Handle kwarg in PyYAML

RasmusWL · RasmusWL · commit cd6d73d553cc · 2021-10-26T17:48:10.000+02:00
Really surprised that we didn't already :|
diff --git a/python/ql/lib/semmle/python/frameworks/Yaml.qll b/python/ql/lib/semmle/python/frameworks/Yaml.qll
@@ -9,7 +9,6 @@
 
 private import python
 private import semmle.python.dataflow.new.DataFlow
-private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
 
@@ -63,7 +62,7 @@ private module Yaml {
       )
     }
 
-    override DataFlow::Node getAnInput() { result = this.getArg(0) }
+    override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("stream")] }
 
     override DataFlow::Node getOutput() { result = this }
 
diff --git a/python/ql/test/library-tests/frameworks/yaml/Decoding.py b/python/ql/test/library-tests/frameworks/yaml/Decoding.py
@@ -2,6 +2,7 @@
 
 # Unsafe:
 yaml.load(payload)  # $decodeInput=payload decodeOutput=yaml.load(..) decodeFormat=YAML decodeMayExecuteInput
+yaml.load(stream=payload)  # $decodeInput=payload decodeOutput=yaml.load(..) decodeFormat=YAML decodeMayExecuteInput
 yaml.load(payload, yaml.Loader)  # $decodeInput=payload decodeOutput=yaml.load(..) decodeFormat=YAML decodeMayExecuteInput
 yaml.unsafe_load(payload) # $ decodeInput=payload decodeOutput=yaml.unsafe_load(..) decodeFormat=YAML decodeMayExecuteInput
 yaml.full_load(payload) # $ decodeInput=payload decodeOutput=yaml.full_load(..) decodeFormat=YAML decodeMayExecuteInput

Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,6 @@`
`9`	`9`
`10`	`10`	`private import python`
`11`	`11`	`private import semmle.python.dataflow.new.DataFlow`
`12`		`-private import semmle.python.dataflow.new.RemoteFlowSources`
`13`	`12`	`private import semmle.python.Concepts`
`14`	`13`	`private import semmle.python.ApiGraphs`
`15`	`14`
`@@ -63,7 +62,7 @@ private module Yaml {`
`63`	`62`	`)`
`64`	`63`	`}`
`65`	`64`
`66`		`- override DataFlow::Node getAnInput() { result = this.getArg(0) }`
	`65`	`+ override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("stream")] }`
`67`	`66`
`68`	`67`	`override DataFlow::Node getOutput() { result = this }`
`69`	`68`