Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit efe3067

Browse files
erik-krogherik-krogh
committed
move path-injection MaD to PathInjectionCustomizations.qll
1 parent 2292dc5 commit efe3067

4 files changed

Lines changed: 16 additions & 18 deletions

File tree

‎python/ql/lib/semmle/python/Concepts.qll‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -62,14 +62,6 @@ module FileSystemAccess {
6262
/** Gets an argument to this file system access that is interpreted as a path. */
6363
abstract DataFlow::Node getAPathArgument();
6464
}
65-
66-
private import semmle.python.frameworks.data.ModelsAsData
67-
68-
private class DataAsFileAccess extends Range {
69-
DataAsFileAccess() { this = ModelOutput::getASinkNode("file-access").getARhs() }
70-
71-
override DataFlow::Node getAPathArgument() { result = this }
72-
}
7365
}
7466

7567
/**

‎python/ql/lib/semmle/python/frameworks/Asyncpg.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ private module Asyncpg {
3838
"asyncpg;~Connection;Member[copy_from_query,execute,fetch,fetchrow,fetchval].Argument[0,query:];sql-injection",
3939
"asyncpg;~Connection;Member[executemany].Argument[0,command:];sql-injection",
4040
// A model of `Connection` and `ConnectionPool`, which provide some methods that access the file system.
41-
"asyncpg;~Connection;Member[copy_from_query,copy_from_table].Argument[output:];file-access",
42-
"asyncpg;~Connection;Member[copy_to_table].Argument[source:];file-access",
41+
"asyncpg;~Connection;Member[copy_from_query,copy_from_table].Argument[output:];path-injection",
42+
"asyncpg;~Connection;Member[copy_to_table].Argument[source:];path-injection",
4343
// the `PreparedStatement` class in `asyncpg`.
4444
"asyncpg;Connection;Member[prepare].Argument[0,query:];sql-injection",
4545
]

‎python/ql/lib/semmle/python/security/dataflow/PathInjectionCustomizations.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@ module PathInjection {
5959
FileSystemAccessAsSink() { this = any(FileSystemAccess e).getAPathArgument() }
6060
}
6161

62+
private import semmle.python.frameworks.data.ModelsAsData
63+
64+
private class DataAsFileSink extends Sink {
65+
DataAsFileSink() { this = ModelOutput::getASinkNode("path-injection").getARhs() }
66+
}
67+
6268
/**
6369
* A comparison with a constant string, considered as a sanitizer-guard.
6470
*/

‎python/ql/test/library-tests/frameworks/asyncpg/test.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@ async def test_connection():
77
try:
88
# The file-like object is passed in as a keyword-only argument.
99
# See https://magicstack.github.io/asyncpg/current/api/index.html#asyncpg.connection.Connection.copy_from_query
10-
await conn.copy_from_query("sql", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__file-access="filepath" getAPathArgument="filepath"
11-
await conn.copy_from_query("sql", "arg1", "arg2", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__file-access="filepath" getAPathArgument="filepath"
10+
await conn.copy_from_query("sql", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__path-injection="filepath"
11+
await conn.copy_from_query("sql", "arg1", "arg2", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__path-injection="filepath"
1212

13-
await conn.copy_from_table("table", output="filepath") # $ mad-sink__file-access="filepath" getAPathArgument="filepath"
14-
await conn.copy_to_table("table", source="filepath") # $ mad-sink__file-access="filepath" getAPathArgument="filepath"
13+
await conn.copy_from_table("table", output="filepath") # $ mad-sink__path-injection="filepath"
14+
await conn.copy_to_table("table", source="filepath") # $ mad-sink__path-injection="filepath"
1515

1616
await conn.execute("sql") # $ mad-sink__sql-injection="sql"
1717
await conn.executemany("sql") # $ mad-sink__sql-injection="sql"
@@ -69,10 +69,10 @@ async def test_connection_pool():
6969
pool = await asyncpg.create_pool()
7070

7171
try:
72-
await pool.copy_from_query("sql", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__file-access="filepath" getAPathArgument="filepath"
73-
await pool.copy_from_query("sql", "arg1", "arg2", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__file-access="filepath" getAPathArgument="filepath"
74-
await pool.copy_from_table("table", output="filepath") # $ mad-sink__file-access="filepath" getAPathArgument="filepath"
75-
await pool.copy_to_table("table", source="filepath") # $ mad-sink__file-access="filepath" getAPathArgument="filepath"
72+
await pool.copy_from_query("sql", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__path-injection="filepath"
73+
await pool.copy_from_query("sql", "arg1", "arg2", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__path-injection="filepath"
74+
await pool.copy_from_table("table", output="filepath") # $ mad-sink__path-injection="filepath"
75+
await pool.copy_to_table("table", source="filepath") # $ mad-sink__path-injection="filepath"
7676

7777
await pool.execute("sql") # $ mad-sink__sql-injection="sql"
7878
await pool.executemany("sql") # $ mad-sink__sql-injection="sql"

0 commit comments

Comments
 (0)