@@ -5,14 +5,13 @@ import semmle.python.ApiGraphs
55import semmle.python.dataflow.new.RemoteFlowSources
66import semmle.python.dataflow.new.internal.DataFlowPublic
77import FileAndFormRemoteFlowSource:: FileAndFormRemoteFlowSource
8+ import codeql.util.Unit
89
910module DecompressionBomb {
1011 /**
1112 * The additional taint steps that need for creating taint tracking or dataflow.
1213 */
13- abstract class AdditionalTaintStep extends string {
14- AdditionalTaintStep ( ) { this = "AdditionalTaintStep" }
15-
14+ class AdditionalTaintStep extends Unit {
1615 /**
1716 * Holds if there is a additional taint step between pred and succ.
1817 */
@@ -98,8 +97,6 @@ module ZipFile {
9897 * ```
9998 */
10099 class DecompressionAdditionalTaintStep extends DecompressionBomb:: AdditionalTaintStep {
101- DecompressionAdditionalTaintStep ( ) { this = "AdditionalTaintStep" }
102-
103100 override predicate isAdditionalTaintStep ( DataFlow:: Node nodeFrom , DataFlow:: Node nodeTo ) {
104101 exists ( API:: Node zipFileInstance | zipFileInstance = zipFileClass ( ) |
105102 nodeFrom =
@@ -172,8 +169,6 @@ module TarFile {
172169 * The Additional taint steps that are necessary for data flow query
173170 */
174171 class DecompressionAdditionalTaintStep extends DecompressionBomb:: AdditionalTaintStep {
175- DecompressionAdditionalTaintStep ( ) { this = "AdditionalTaintStep" }
176-
177172 override predicate isAdditionalTaintStep ( DataFlow:: Node nodeFrom , DataFlow:: Node nodeTo ) {
178173 exists ( API:: Node tarfileInstance | tarfileInstance = tarfileExtractMember ( ) |
179174 nodeFrom = tarfileInstance .getACall ( ) .getParameter ( 0 , "name" ) .asSink ( ) and
0 commit comments