Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Better handling of IfExp (ternary)#179

Merged
bcaller merged 1 commit into
python-security:masterfrom
bcaller:ifexp
Oct 30, 2018
Merged

Better handling of IfExp (ternary)#179
bcaller merged 1 commit into
python-security:masterfrom
bcaller:ifexp

Conversation

@bcaller
Copy link
Copy Markdown
Collaborator

@bcaller bcaller commented Oct 29, 2018

Reduces false positives.

As an example:

result = "a" if TAINT else "c"

In AST, the assignment value is IfExp(test=TAINT, body="a", orelse="c").

Even though TAINT is inside the assignment of result, it can't
actually taint result as it is part of the boolean test expression.

Previously, result would have been tainted, which was a false
positive.

We don't want to completely ignore the test though in case it contains a
sink function.

Therefore, if the test contains expressions we transform it as so:

result = "a" if b(c) + 2 else "d"

to the multi line:

__if_exp_0 = b(c) + 2
result = "a" if __if_exp_0 else "d"

This way if b is a sink and c is tainted we see a vulnerability, but
even if c is tainted we don't taint result.

Reduces false positives.

As an example:

result = "a" if TAINT else "c"

In AST, the assignment value is `IfExp(test=TAINT, body="a", orelse="c")`.

Even though `TAINT` is inside the assignment of `result`, it can't
actually taint `result` as it is part of the boolean test expression.

Previously, `result` would have been tainted, which was a false
positive.

We don't want to completely ignore the test though in case it contains a
sink function.

Therefore, if the test contains expressions we transform it as so:

result = "a" if b(c) + 2 else "d"

to the multi line:

__if_exp_0 = b(c) + 2
result = "a" if __if_exp_0 else "d"

This way if `b` is a sink and `c` is tainted we see a vulnerability, but
even if `c` is tainted we don't taint `result`.
@bcaller bcaller requested a review from KevinHock October 29, 2018 15:56
Copy link
Copy Markdown
Collaborator

@KevinHock KevinHock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Beautiful :D

@bcaller bcaller merged commit 0932cc9 into python-security:master Oct 30, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants