Merge pull request #5255 from RasmusWL/port-flask-debug

yoff · web-flow · commit d17246ce2bca · 2021-03-05T09:39:14.000+01:00
Python: port py/flask-debug query
diff --git a/python/change-notes/2021-02-24-port-flask-debug.md b/python/change-notes/2021-02-24-port-flask-debug.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Updated _Flask app is run in debug mode_ (`py/flask-debug`) query to use the new type-tracking approach instead of points-to analysis. You may see differences in the results found by the query, but overall this change should result in a more robust and accurate analysis.
diff --git a/python/ql/src/Security/CWE-215/FlaskDebug.ql b/python/ql/src/Security/CWE-215/FlaskDebug.ql
@@ -11,12 +11,25 @@
  */
 
 import python
-import semmle.python.web.flask.General
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.ApiGraphs
+import semmle.python.frameworks.Flask
 
-from CallNode call, Value isTrue
+/** Gets a reference to a truthy literal. */
+private DataFlow::LocalSourceNode truthyLiteral(DataFlow::TypeTracker t) {
+  t.start() and
+  result.asExpr().(ImmutableLiteral).booleanValue() = true
+  or
+  exists(DataFlow::TypeTracker t2 | result = truthyLiteral(t2).track(t2, t))
+}
+
+/** Gets a reference to a truthy literal. */
+DataFlow::Node truthyLiteral() { truthyLiteral(DataFlow::TypeTracker::end()).flowsTo(result) }
+
+from DataFlow::CallCfgNode call, DataFlow::Node debugArg
 where
-  call = theFlaskClass().declaredAttribute("run").(FunctionValue).getACall() and
-  call.getArgByName("debug").pointsTo(isTrue) and
-  isTrue.getDefiniteBooleanValue() = true
+  call.getFunction() = Flask::FlaskApp::instance().getMember("run").getAUse() and
+  debugArg in [call.getArg(2), call.getArgByName("debug")] and
+  debugArg = truthyLiteral()
 select call,
   "A Flask app appears to be run in debug mode. This may allow an attacker to run arbitrary code through the debugger."
diff --git a/python/ql/test/query-tests/Security/CWE-215/FlaskDebug.expected b/python/ql/test/query-tests/Security/CWE-215/FlaskDebug.expected
@@ -2,3 +2,4 @@
 | test.py:25:1:25:20 | ControlFlowNode for Attribute() | A Flask app appears to be run in debug mode. This may allow an attacker to run arbitrary code through the debugger. |
 | test.py:29:1:29:20 | ControlFlowNode for Attribute() | A Flask app appears to be run in debug mode. This may allow an attacker to run arbitrary code through the debugger. |
 | test.py:37:1:37:18 | ControlFlowNode for runapp() | A Flask app appears to be run in debug mode. This may allow an attacker to run arbitrary code through the debugger. |
+| test.py:42:1:42:35 | ControlFlowNode for Attribute() | A Flask app appears to be run in debug mode. This may allow an attacker to run arbitrary code through the debugger. |
diff --git a/python/ql/test/query-tests/Security/CWE-215/settings.py b/python/ql/test/query-tests/Security/CWE-215/settings.py
@@ -0,0 +1 @@
+ALWAYS_TRUE = True
diff --git a/python/ql/test/query-tests/Security/CWE-215/test.py b/python/ql/test/query-tests/Security/CWE-215/test.py
@@ -22,16 +22,29 @@ def main():
 
 DEBUG = True
 
-app.run(debug=DEBUG)
+app.run(debug=DEBUG) # NOT OK
 
 DEBUG = 1
 
-app.run(debug=DEBUG)
+app.run(debug=DEBUG) # NOT OK
 
 if False:
     app.run(debug=True)
 
 
 
 runapp = app.run
-runapp(debug=True)
+runapp(debug=True) # NOT OK
+
+
+# imports from other module
+import settings
+app.run(debug=settings.ALWAYS_TRUE) # NOT OK
+
+
+# depending on environment values
+import os
+
+DEPENDS_ON_ENV = os.environ["ENV"] == "dev"
+
+app.run(debug=DEPENDS_ON_ENV) # OK

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+lgtm,codescanning`
	`2`	+* Updated _Flask app is run in debug mode_ (`py/flask-debug`) query to use the new type-tracking approach instead of points-to analysis. You may see differences in the results found by the query, but overall this change should result in a more robust and accurate analysis.