Skip to content

Python: Rewrite type trackers #10634

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
codeql-ci merged 2 commits into from
Sep 30, 2022
Merged

Python: Rewrite type trackers #10634

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0654e39
python: rewrite type tracker for compiled regexes
yoff Sep 29, 2022
84ab860
python: rewrite type tracker for ldap operations
yoff Sep 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 12 additions & 19 deletions python/ql/lib/semmle/python/frameworks/Stdlib.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2842,26 +2842,15 @@ private module StdlibPrivate {
override string getName() { result = "re." + method }
}

/** Helper module for tracking compiled regexes. */
private module CompiledRegexes {
private DataFlow::TypeTrackingNode compiledRegex(DataFlow::TypeTracker t, DataFlow::Node regex) {
t.start() and
result = API::moduleImport("re").getMember("compile").getACall() and
regex in [
result.(DataFlow::CallCfgNode).getArg(0),
result.(DataFlow::CallCfgNode).getArgByName("pattern")
]
or
exists(DataFlow::TypeTracker t2 | result = compiledRegex(t2, regex).track(t2, t))
}

DataFlow::Node compiledRegex(DataFlow::Node regex) {
compiledRegex(DataFlow::TypeTracker::end(), regex).flowsTo(result)
}
API::Node compiledRegex(API::Node regex) {
exists(API::CallNode compilation |
compilation = API::moduleImport("re").getMember("compile").getACall()
|
result = compilation.getReturn() and
regex = compilation.getParameter(0, "pattern")
)
}

private import CompiledRegexes

/**
* A call on compiled regular expression (obtained via `re.compile`) executing a
* regular expression.
Expand All @@ -2886,7 +2875,11 @@ private module StdlibPrivate {
DataFlow::Node regexNode;
RegexExecutionMethod method;

CompiledRegexExecution() { this.calls(compiledRegex(regexNode), method) }
CompiledRegexExecution() {
exists(API::Node regex | regexNode = regex.asSink() |
this.calls(compiledRegex(regex).getAValueReachableFromSource(), method)
)
}

override DataFlow::Node getRegex() { result = regexNode }

Expand Down
28 changes: 4 additions & 24 deletions python/ql/src/experimental/semmle/python/frameworks/LDAP.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,8 @@ private module Ldap {
API::Node ldapInitialize() { result = ldap().getMember("initialize") }

/** Gets a reference to a `ldap` operation. */
private DataFlow::TypeTrackingNode ldapOperation(DataFlow::TypeTracker t) {
t.start() and
result.(DataFlow::AttrRead).getObject().getALocalSource() = ldapInitialize().getACall()
or
exists(DataFlow::TypeTracker t2 | result = ldapOperation(t2).track(t2, t))
private API::Node ldapOperation(string name) {
result = ldapInitialize().getReturn().getMember(name)
}

/**
Expand All @@ -44,24 +41,13 @@ private module Ldap {
}
}

/** Gets a reference to a `ldap` operation. */
private DataFlow::Node ldapOperation() {
ldapOperation(DataFlow::TypeTracker::end()).flowsTo(result)
}

/** Gets a reference to a `ldap` query. */
private DataFlow::Node ldapQuery() {
result = ldapOperation() and
result.(DataFlow::AttrRead).getAttributeName() instanceof Ldap2QueryMethods
}

/**
* A class to find `ldap` methods executing a query.
*
* See `LDAP2QueryMethods`
*/
private class Ldap2Query extends DataFlow::CallCfgNode, LdapQuery::Range {
Ldap2Query() { this.getFunction() = ldapQuery() }
Ldap2Query() { this = ldapOperation(any(Ldap2QueryMethods m)).getACall() }

override DataFlow::Node getQuery() {
result in [this.getArg(0), this.getArg(2), this.getArgByName("filterstr")]
Expand All @@ -82,12 +68,6 @@ private module Ldap {
}
}

/** Gets a reference to a `ldap` bind. */
private DataFlow::Node ldapBind() {
result = ldapOperation() and
result.(DataFlow::AttrRead).getAttributeName() instanceof Ldap2BindMethods
}

/**List of SSL-demanding options */
private class LdapSslOptions extends DataFlow::Node {
LdapSslOptions() {
Expand All @@ -101,7 +81,7 @@ private module Ldap {
* See `LDAP2BindMethods`
*/
private class Ldap2Bind extends DataFlow::CallCfgNode, LdapBind::Range {
Ldap2Bind() { this.getFunction() = ldapBind() }
Ldap2Bind() { this = ldapOperation(any(Ldap2BindMethods m)).getACall() }

override DataFlow::Node getPassword() {
result in [this.getArg(1), this.getArgByName("cred")]
Expand Down