Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit eb5ed23

Browse files
yoffyoff
committed
Python: Add TaintTracking2
1 parent da77cbb commit eb5ed23

4 files changed

Lines changed: 143 additions & 2 deletions

File tree

‎config/identical-files.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@
4141
"csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll",
4242
"java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
4343
"java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
44-
"python/ql/src/experimental/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
44+
"python/ql/src/experimental/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
45+
"python/ql/src/experimental/dataflow/internal/tainttracking2/TaintTrackingImpl.qll"
4546
],
4647
"DataFlow Java/C++/C#/Python Consistency checks": [
4748
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
@@ -401,4 +402,4 @@
401402
"javascript/ql/src/Comments/CommentedOutCodeReferences.qhelp",
402403
"python/ql/src/Lexical/CommentedOutCodeReferences.qhelp"
403404
]
404-
}
405+
}

‎python/ql/src/experimental/dataflow/TaintTracking2.qll‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Provides classes for performing local (intra-procedural) and
3+
* global (inter-procedural) taint-tracking analyses.
4+
*
5+
* To use global (interprocedural) taint tracking, extend the class
6+
* `TaintTracking::Configuration` as documented on that class. To use local
7+
* (intraprocedural) taint tracking, call `TaintTracking::localTaint` or
8+
* `TaintTracking::localTaintStep` with arguments of type `DataFlow::Node`.
9+
*/
10+
11+
private import python
12+
13+
/**
14+
* Provides classes for performing local (intra-procedural) and
15+
* global (inter-procedural) taint-tracking analyses.
16+
*/
17+
module TaintTracking2 {
18+
import experimental.dataflow.internal.tainttracking2.TaintTrackingImpl
19+
}

‎python/ql/src/experimental/dataflow/internal/tainttracking2/TaintTrackingImpl.qll‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
/**
2+
* Provides an implementation of global (interprocedural) taint tracking.
3+
* This file re-exports the local (intraprocedural) taint-tracking analysis
4+
* from `TaintTrackingParameter::Public` and adds a global analysis, mainly
5+
* exposed through the `Configuration` class. For some languages, this file
6+
* exists in several identical copies, allowing queries to use multiple
7+
* `Configuration` classes that depend on each other without introducing
8+
* mutual recursion among those configurations.
9+
*/
10+
11+
import TaintTrackingParameter::Public
12+
private import TaintTrackingParameter::Private
13+
14+
/**
15+
* A configuration of interprocedural taint tracking analysis. This defines
16+
* sources, sinks, and any other configurable aspect of the analysis. Each
17+
* use of the taint tracking library must define its own unique extension of
18+
* this abstract class.
19+
*
20+
* A taint-tracking configuration is a special data flow configuration
21+
* (`DataFlow::Configuration`) that allows for flow through nodes that do not
22+
* necessarily preserve values but are still relevant from a taint tracking
23+
* perspective. (For example, string concatenation, where one of the operands
24+
* is tainted.)
25+
*
26+
* To create a configuration, extend this class with a subclass whose
27+
* characteristic predicate is a unique singleton string. For example, write
28+
*
29+
* ```ql
30+
* class MyAnalysisConfiguration extends TaintTracking::Configuration {
31+
* MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
32+
* // Override `isSource` and `isSink`.
33+
* // Optionally override `isSanitizer`.
34+
* // Optionally override `isSanitizerIn`.
35+
* // Optionally override `isSanitizerOut`.
36+
* // Optionally override `isSanitizerGuard`.
37+
* // Optionally override `isAdditionalTaintStep`.
38+
* }
39+
* ```
40+
*
41+
* Then, to query whether there is flow between some `source` and `sink`,
42+
* write
43+
*
44+
* ```ql
45+
* exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
46+
* ```
47+
*
48+
* Multiple configurations can coexist, but it is unsupported to depend on
49+
* another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
50+
* overridden predicates that define sources, sinks, or additional steps.
51+
* Instead, the dependency should go to a `TaintTracking2::Configuration` or a
52+
* `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
53+
*/
54+
abstract class Configuration extends DataFlow::Configuration {
55+
bindingset[this]
56+
Configuration() { any() }
57+
58+
/**
59+
* Holds if `source` is a relevant taint source.
60+
*
61+
* The smaller this predicate is, the faster `hasFlow()` will converge.
62+
*/
63+
// overridden to provide taint-tracking specific qldoc
64+
abstract override predicate isSource(DataFlow::Node source);
65+
66+
/**
67+
* Holds if `sink` is a relevant taint sink.
68+
*
69+
* The smaller this predicate is, the faster `hasFlow()` will converge.
70+
*/
71+
// overridden to provide taint-tracking specific qldoc
72+
abstract override predicate isSink(DataFlow::Node sink);
73+
74+
/** Holds if the node `node` is a taint sanitizer. */
75+
predicate isSanitizer(DataFlow::Node node) { none() }
76+
77+
final override predicate isBarrier(DataFlow::Node node) {
78+
isSanitizer(node) or
79+
defaultTaintSanitizer(node)
80+
}
81+
82+
/** Holds if taint propagation into `node` is prohibited. */
83+
predicate isSanitizerIn(DataFlow::Node node) { none() }
84+
85+
final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
86+
87+
/** Holds if taint propagation out of `node` is prohibited. */
88+
predicate isSanitizerOut(DataFlow::Node node) { none() }
89+
90+
final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
91+
92+
/** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
93+
predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
94+
95+
final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }
96+
97+
/**
98+
* Holds if the additional taint propagation step from `node1` to `node2`
99+
* must be taken into account in the analysis.
100+
*/
101+
predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
102+
103+
final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
104+
isAdditionalTaintStep(node1, node2) or
105+
defaultAdditionalTaintStep(node1, node2)
106+
}
107+
108+
/**
109+
* Holds if taint may flow from `source` to `sink` for this configuration.
110+
*/
111+
// overridden to provide taint-tracking specific qldoc
112+
override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
113+
super.hasFlow(source, sink)
114+
}
115+
}

‎python/ql/src/experimental/dataflow/internal/tainttracking2/TaintTrackingParameter.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import experimental.dataflow.internal.TaintTrackingPublic as Public
2+
3+
module Private {
4+
import experimental.dataflow.DataFlow2::DataFlow2 as DataFlow
5+
import experimental.dataflow.internal.TaintTrackingPrivate
6+
}

0 commit comments

Comments
 (0)