Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f473a0a

Browse files
aschackmullaschackmull
committed
Python: Deprecate and replace BarrierGuard class.
1 parent 87d5305 commit f473a0a

41 files changed

Lines changed: 186 additions & 131 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎python/ql/lib/semmle/python/Concepts.qll‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -119,16 +119,21 @@ module Path {
119119
}
120120

121121
/** A data-flow node that checks that a path is safe to access. */
122-
class SafeAccessCheck extends DataFlow::BarrierGuard instanceof SafeAccessCheck::Range {
123-
override predicate checks(ControlFlowNode node, boolean branch) {
124-
SafeAccessCheck::Range.super.checks(node, branch)
125-
}
122+
class SafeAccessCheck extends DataFlow::ExprNode {
123+
SafeAccessCheck() { this = DataFlow::BarrierGuard<safeAccessCheck/3>::getABarrierNode() }
124+
}
125+
126+
private predicate safeAccessCheck(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
127+
g.(SafeAccessCheck::Range).checks(node, branch)
126128
}
127129

128130
/** Provides a class for modeling new path safety checks. */
129131
module SafeAccessCheck {
130132
/** A data-flow node that checks that a path is safe to access. */
131-
abstract class Range extends DataFlow::BarrierGuard { }
133+
abstract class Range extends DataFlow::GuardNode {
134+
/** Holds if this guard validates `node` upon evaluating to `branch`. */
135+
abstract predicate checks(ControlFlowNode node, boolean branch);
136+
}
132137
}
133138
}
134139

‎python/ql/lib/semmle/python/dataflow/new/BarrierGuards.qll‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,44 @@
33
private import python
44
private import semmle.python.dataflow.new.DataFlow
55

6+
private predicate stringConstCompare(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
7+
exists(CompareNode cn | cn = g |
8+
exists(StrConst str_const, Cmpop op |
9+
op = any(Eq eq) and branch = true
10+
or
11+
op = any(NotEq ne) and branch = false
12+
|
13+
cn.operands(str_const.getAFlowNode(), op, node)
14+
or
15+
cn.operands(node, op, str_const.getAFlowNode())
16+
)
17+
or
18+
exists(IterableNode str_const_iterable, Cmpop op |
19+
op = any(In in_) and branch = true
20+
or
21+
op = any(NotIn ni) and branch = false
22+
|
23+
forall(ControlFlowNode elem | elem = str_const_iterable.getAnElement() |
24+
elem.getNode() instanceof StrConst
25+
) and
26+
cn.operands(node, op, str_const_iterable)
27+
)
28+
)
29+
}
30+
631
/** A validation of unknown node by comparing with a constant string value. */
7-
class StringConstCompare extends DataFlow::BarrierGuard, CompareNode {
32+
class StringConstCompareBarrier extends DataFlow::Node {
33+
StringConstCompareBarrier() {
34+
this = DataFlow::BarrierGuard<stringConstCompare/3>::getABarrierNode()
35+
}
36+
}
37+
38+
/**
39+
* DEPRECATED: Use `StringConstCompareBarrier` instead.
40+
*
41+
* A validation of unknown node by comparing with a constant string value.
42+
*/
43+
deprecated class StringConstCompare extends DataFlow::BarrierGuard, CompareNode {
844
ControlFlowNode checked_node;
945
boolean safe_branch;
1046

‎python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -540,6 +540,35 @@ class GuardNode extends ControlFlowNode {
540540
}
541541

542542
/**
543+
* Holds if the guard `g` validates `node` upon evaluating to `branch`.
544+
*
545+
* The expression `e` is expected to be a syntactic part of the guard `g`.
546+
* For example, the guard `g` might be a call `isSafe(x)` and the expression `e`
547+
* the argument `x`.
548+
*/
549+
signature predicate guardChecksSig(GuardNode g, ControlFlowNode node, boolean branch);
550+
551+
/**
552+
* Provides a set of barrier nodes for a guard that validates a node.
553+
*
554+
* This is expected to be used in `isBarrier`/`isSanitizer` definitions
555+
* in data flow and taint tracking.
556+
*/
557+
module BarrierGuard<guardChecksSig/3 guardChecks> {
558+
/** Gets a node that is safely guarded by the given guard check. */
559+
ExprNode getABarrierNode() {
560+
exists(GuardNode g, EssaDefinition def, ControlFlowNode node, boolean branch |
561+
AdjacentUses::useOfDef(def, node) and
562+
guardChecks(g, node, branch) and
563+
AdjacentUses::useOfDef(def, result.asCfgNode()) and
564+
g.controlsBlock(result.asCfgNode().getBasicBlock(), branch)
565+
)
566+
}
567+
}
568+
569+
/**
570+
* DEPRECATED: Use `BarrierGuard` module instead.
571+
*
543572
* A guard that validates some expression.
544573
*
545574
* To use this in a configuration, extend the class and provide a
@@ -548,7 +577,7 @@ class GuardNode extends ControlFlowNode {
548577
*
549578
* It is important that all extending classes in scope are disjoint.
550579
*/
551-
class BarrierGuard extends GuardNode {
580+
deprecated class BarrierGuard extends GuardNode {
552581
/** Holds if this guard validates `node` upon evaluating to `branch`. */
553582
abstract predicate checks(ControlFlowNode node, boolean branch);
554583

‎python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,6 @@ private import semmle.python.ApiGraphs
1010
*/
1111
predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
1212

13-
/**
14-
* Holds if `guard` should be a sanitizer guard in all global taint flow configurations
15-
* but not in local taint.
16-
*/
17-
predicate defaultTaintSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
18-
1913
/**
2014
* Holds if default `TaintTracking::Configuration`s should allow implicit reads
2115
* of `c` at sinks and inputs to additional taint steps.

‎python/ql/lib/semmle/python/security/dataflow/CodeInjectionCustomizations.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,11 @@ module CodeInjection {
3232
abstract class Sanitizer extends DataFlow::Node { }
3333

3434
/**
35+
* DEPRECATED: Use `Sanitizer` instead.
36+
*
3537
* A sanitizer guard for "code injection" vulnerabilities.
3638
*/
37-
abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
39+
abstract deprecated class SanitizerGuard extends DataFlow::BarrierGuard { }
3840

3941
/**
4042
* A source of remote user input, considered as a flow source.

‎python/ql/lib/semmle/python/security/dataflow/CodeInjectionQuery.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class Configuration extends TaintTracking::Configuration {
2323

2424
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
2525

26-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
26+
deprecated override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
2727
guard instanceof SanitizerGuard
2828
}
2929
}

‎python/ql/lib/semmle/python/security/dataflow/CommandInjectionCustomizations.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,11 @@ module CommandInjection {
3232
abstract class Sanitizer extends DataFlow::Node { }
3333

3434
/**
35+
* DEPRECATED: Use `Sanitizer` instead.
36+
*
3537
* A sanitizer guard for "command injection" vulnerabilities.
3638
*/
37-
abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
39+
abstract deprecated class SanitizerGuard extends DataFlow::BarrierGuard { }
3840

3941
/**
4042
* A source of remote user input, considered as a flow source.
@@ -83,5 +85,5 @@ module CommandInjection {
8385
/**
8486
* A comparison with a constant string, considered as a sanitizer-guard.
8587
*/
86-
class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
88+
class StringConstCompareAsSanitizerGuard extends Sanitizer, StringConstCompareBarrier { }
8789
}

‎python/ql/lib/semmle/python/security/dataflow/CommandInjectionQuery.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class Configuration extends TaintTracking::Configuration {
2323

2424
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
2525

26-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
26+
deprecated override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
2727
guard instanceof SanitizerGuard
2828
}
2929
}

‎python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,18 @@ module LdapInjection {
4242
abstract class FilterSanitizer extends DataFlow::Node { }
4343

4444
/**
45+
* DEPRECATED: Use `DnSanitizer` instead.
46+
*
4547
* A sanitizer guard for "ldap injection" vulnerabilities.
4648
*/
47-
abstract class DnSanitizerGuard extends DataFlow::BarrierGuard { }
49+
abstract deprecated class DnSanitizerGuard extends DataFlow::BarrierGuard { }
4850

4951
/**
52+
* DEPRECATED: Use `FilterSanitizer` instead.
53+
*
5054
* A sanitizer guard for "ldap injection" vulnerabilities.
5155
*/
52-
abstract class FilterSanitizerGuard extends DataFlow::BarrierGuard { }
56+
abstract deprecated class FilterSanitizerGuard extends DataFlow::BarrierGuard { }
5357

5458
/**
5559
* A source of remote user input, considered as a flow source.
@@ -73,12 +77,12 @@ module LdapInjection {
7377
/**
7478
* A comparison with a constant string, considered as a sanitizer-guard.
7579
*/
76-
class StringConstCompareAsDnSanitizerGuard extends DnSanitizerGuard, StringConstCompare { }
80+
class StringConstCompareAsDnSanitizerGuard extends DnSanitizer, StringConstCompareBarrier { }
7781

7882
/**
7983
* A comparison with a constant string, considered as a sanitizer-guard.
8084
*/
81-
class StringConstCompareAsFilterSanitizerGuard extends FilterSanitizerGuard, StringConstCompare {
85+
class StringConstCompareAsFilterSanitizerGuard extends FilterSanitizer, StringConstCompareBarrier {
8286
}
8387

8488
/**

‎python/ql/lib/semmle/python/security/dataflow/LdapInjectionQuery.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ class DnConfiguration extends TaintTracking::Configuration {
2626

2727
override predicate isSanitizer(DataFlow::Node node) { node instanceof DnSanitizer }
2828

29-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
29+
deprecated override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
3030
guard instanceof DnSanitizerGuard
3131
}
3232
}
@@ -44,7 +44,7 @@ class FilterConfiguration extends TaintTracking::Configuration {
4444

4545
override predicate isSanitizer(DataFlow::Node node) { node instanceof FilterSanitizer }
4646

47-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
47+
deprecated override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
4848
guard instanceof FilterSanitizerGuard
4949
}
5050
}

0 commit comments

Comments
 (0)