Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e45288e

Browse files
RasmusWLRasmusWL
committed
Python: => XMLParsingVulnerabilityKind
Since there are other XML vulnerabilities that are not about parsing, this is more correct.
1 parent e005a5c commit e45288e

6 files changed

Lines changed: 20 additions & 20 deletions

File tree

‎python/ql/lib/semmle/python/Concepts.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -556,8 +556,8 @@ module XML {
556556
*
557557
* See overview of kinds at https://pypi.org/project/defusedxml/#python-xml-libraries
558558
*/
559-
class XMLVulnerabilityKind extends string {
560-
XMLVulnerabilityKind() {
559+
class XMLParsingVulnerabilityKind extends string {
560+
XMLParsingVulnerabilityKind() {
561561
this in ["Billion Laughs", "Quadratic Blowup", "XXE", "DTD retrieval"]
562562
}
563563

@@ -589,7 +589,7 @@ module XML {
589589
/**
590590
* Holds if this XML parsing is vulnerable to `kind`.
591591
*/
592-
predicate vulnerableTo(XMLVulnerabilityKind kind) { super.vulnerableTo(kind) }
592+
predicate vulnerableTo(XMLParsingVulnerabilityKind kind) { super.vulnerableTo(kind) }
593593
}
594594

595595
/** Provides classes for modeling XML parsing APIs. */
@@ -609,7 +609,7 @@ module XML {
609609
/**
610610
* Holds if this XML parsing is vulnerable to `kind`.
611611
*/
612-
abstract predicate vulnerableTo(XMLVulnerabilityKind kind);
612+
abstract predicate vulnerableTo(XMLParsingVulnerabilityKind kind);
613613
}
614614
}
615615
}

‎python/ql/src/experimental/Security/CWE-611/SimpleXmlRpcServer.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ from DataFlow::CallCfgNode call, string kinds
1717
where
1818
call = API::moduleImport("xmlrpc").getMember("server").getMember("SimpleXMLRPCServer").getACall() and
1919
kinds =
20-
strictconcat(ExperimentalXML::XMLVulnerabilityKind kind |
20+
strictconcat(ExperimentalXML::XMLParsingVulnerabilityKind kind |
2121
kind.isBillionLaughs() or kind.isQuadraticBlowup()
2222
|
2323
kind, ", "

‎python/ql/src/experimental/semmle/python/frameworks/Xml.qll‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ private module XmlEtree {
6666

6767
override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("data")] }
6868

69-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
69+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
7070
kind.isBillionLaughs() or kind.isQuadraticBlowup()
7171
}
7272
}
@@ -103,7 +103,7 @@ private module XmlEtree {
103103
]
104104
}
105105

106-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
106+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
107107
// note: it does not matter what `xml.etree` parser you are using, you cannot
108108
// change the security features anyway :|
109109
kind.isBillionLaughs() or kind.isQuadraticBlowup()
@@ -218,7 +218,7 @@ private module SaxBasedParsing {
218218

219219
override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("source")] }
220220

221-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
221+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
222222
// always vuln to these
223223
(kind.isBillionLaughs() or kind.isQuadraticBlowup())
224224
or
@@ -251,7 +251,7 @@ private module SaxBasedParsing {
251251
]
252252
}
253253

254-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
254+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
255255
// always vuln to these
256256
(kind.isBillionLaughs() or kind.isQuadraticBlowup())
257257
or
@@ -290,7 +290,7 @@ private module SaxBasedParsing {
290290

291291
DataFlow::Node getParserArg() { result in [this.getArg(1), this.getArgByName("parser")] }
292292

293-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
293+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
294294
this.getParserArg() = saxParserWithFeatureExternalGesTurnedOn() and
295295
(kind.isXxe() or kind.isDtdRetrieval())
296296
or
@@ -317,7 +317,7 @@ private module Lxml {
317317
*/
318318
abstract class InstanceSource extends DataFlow::LocalSourceNode {
319319
/** Holds if this instance is vulnerable to `kind`. */
320-
abstract predicate vulnerableTo(XML::XMLVulnerabilityKind kind);
320+
abstract predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind);
321321
}
322322

323323
/**
@@ -331,7 +331,7 @@ private module Lxml {
331331
}
332332

333333
// NOTE: it's not possible to change settings of a parser after constructing it
334-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
334+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
335335
kind.isXxe() and
336336
(
337337
// resolve_entities has default True
@@ -361,7 +361,7 @@ private module Lxml {
361361
API::moduleImport("lxml").getMember("etree").getMember("get_default_parser").getACall()
362362
}
363363

364-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
364+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
365365
// as highlighted by
366366
// https://lxml.de/apidoc/lxml.etree.html?highlight=xmlparser#lxml.etree.XMLParser
367367
// by default XXE is allow. so as long as the default parser has not been
@@ -385,7 +385,7 @@ private module Lxml {
385385
}
386386

387387
/** Gets a reference to an `lxml.etree` parser instance, that is vulnerable to `kind`. */
388-
DataFlow::Node instanceVulnerableTo(XML::XMLVulnerabilityKind kind) {
388+
DataFlow::Node instanceVulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
389389
exists(InstanceSource origin | result = instance(origin) and origin.vulnerableTo(kind))
390390
}
391391

@@ -397,7 +397,7 @@ private module Lxml {
397397

398398
override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("data")] }
399399

400-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
400+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
401401
this.calls(instanceVulnerableTo(kind), "feed")
402402
}
403403
}
@@ -436,7 +436,7 @@ private module Lxml {
436436

437437
DataFlow::Node getParserArg() { result in [this.getArg(1), this.getArgByName("parser")] }
438438

439-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
439+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
440440
this.getParserArg() = XMLParser::instanceVulnerableTo(kind)
441441
or
442442
kind.isXxe() and
@@ -456,7 +456,7 @@ private module Xmltodict {
456456
result in [this.getArg(0), this.getArgByName("xml_input")]
457457
}
458458

459-
override predicate vulnerableTo(XML::XMLVulnerabilityKind kind) {
459+
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
460460
(kind.isBillionLaughs() or kind.isQuadraticBlowup()) and
461461
this.getArgByName("disable_entities").getALocalSource().asExpr() = any(False f)
462462
}

‎python/ql/src/experimental/semmle/python/security/dataflow/XmlBombCustomizations.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ module XmlBomb {
4141
*/
4242
class XmlParsingWithEntityResolution extends Sink {
4343
XmlParsingWithEntityResolution() {
44-
exists(XML::XMLParsing parsing, XML::XMLVulnerabilityKind kind |
44+
exists(XML::XMLParsing parsing, XML::XMLParsingVulnerabilityKind kind |
4545
(kind.isBillionLaughs() or kind.isQuadraticBlowup()) and
4646
parsing.vulnerableTo(kind) and
4747
this = parsing.getAnInput()

‎python/ql/src/experimental/semmle/python/security/dataflow/XxeCustomizations.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ module Xxe {
4141
*/
4242
class XmlParsingWithExternalEntityResolution extends Sink {
4343
XmlParsingWithExternalEntityResolution() {
44-
exists(XML::XMLParsing parsing, XML::XMLVulnerabilityKind kind |
44+
exists(XML::XMLParsing parsing, XML::XMLParsingVulnerabilityKind kind |
4545
kind.isXxe() and
4646
parsing.vulnerableTo(kind) and
4747
this = parsing.getAnInput()

‎python/ql/test/experimental/library-tests/frameworks/XML/ExperimentalXmlConceptsTests.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ class XmlParsingTest extends InlineExpectationsTest {
2121
tag = "input"
2222
)
2323
or
24-
exists(XML::XMLVulnerabilityKind kind |
24+
exists(XML::XMLParsingVulnerabilityKind kind |
2525
parsing.vulnerableTo(kind) and
2626
location = parsing.getLocation() and
2727
element = parsing.toString() and

0 commit comments

Comments
 (0)