Skip to content
This repository was archived by the owner on Apr 4, 2025. It is now read-only.

Commit a4f273f

Browse files
GeekMasherGeekMasher
authored
Merge branch 'main' into securingdev-java-cwe-326-update-dataflow
2 parents 9ca530e + 11ce02e commit a4f273f

7 files changed

Lines changed: 53 additions & 77 deletions

File tree

‎java/CWE-094/CVE-2021-44228.ql‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎python/CWE-078/CommandInjectionLocal.ql‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -21,26 +21,22 @@ import semmle.python.dataflow.new.TaintTracking
2121
import semmle.python.Concepts
2222
import semmle.python.dataflow.new.BarrierGuards
2323
import semmle.python.ApiGraphs
24-
import DataFlow::PathGraph
2524
import github.LocalSources
2625
private import semmle.python.security.dataflow.CommandInjectionCustomizations
2726

28-
/**
29-
* This configuration is used to find local command injection vulnerabilities.
30-
*/
31-
class CommandInjectionConfiguration extends TaintTracking::Configuration {
32-
CommandInjectionConfiguration() { this = "LocalCommandInjectionConfiguration" }
33-
34-
override predicate isSource(DataFlow::Node source) { source instanceof LocalSources::Range }
27+
private module CommandInjectionConfiguration implements DataFlow::ConfigSig {
28+
predicate isSource(DataFlow::Node source) { source instanceof LocalSources::Range }
3529

36-
override predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjection::Sink }
30+
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjection::Sink }
3731

38-
override predicate isSanitizer(DataFlow::Node node) {
39-
node instanceof CommandInjection::Sanitizer
40-
}
32+
predicate isBarrier(DataFlow::Node node) { node instanceof CommandInjection::Sanitizer }
4133
}
4234

43-
from CommandInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
44-
where config.hasFlowPath(source, sink)
35+
module CommandInjectionFlows = TaintTracking::Global<CommandInjectionConfiguration>;
36+
37+
import CommandInjectionFlows::PathGraph
38+
39+
from CommandInjectionFlows::PathNode source, CommandInjectionFlows::PathNode sink
40+
where CommandInjectionFlows::flowPath(source, sink)
4541
select sink.getNode(), source, sink, "This command depends on $@.", source.getNode(),
4642
"a user-provided value"

‎python/CWE-094/CodeInjectionLocal.ql‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,24 +22,22 @@ import semmle.python.dataflow.new.TaintTracking
2222
import semmle.python.Concepts
2323
import semmle.python.dataflow.new.RemoteFlowSources
2424
import semmle.python.dataflow.new.BarrierGuards
25-
import DataFlow::PathGraph
2625
import github.LocalSources
2726
private import semmle.python.security.dataflow.CodeInjectionCustomizations
2827

29-
/**
30-
* A taint-tracking configuration for detecting code injection vulnerabilities.
31-
*/
32-
class CodeInjectionConfiguration extends TaintTracking::Configuration {
33-
CodeInjectionConfiguration() { this = "CodeInjectionConfiguration" }
34-
35-
override predicate isSource(DataFlow::Node source) { source instanceof LocalSources::Range }
28+
private module CodeInjectionConfiguration implements DataFlow::ConfigSig {
29+
predicate isSource(DataFlow::Node source) { source instanceof LocalSources::Range }
3630

37-
override predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjection::Sink }
31+
predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjection::Sink }
3832

39-
override predicate isSanitizer(DataFlow::Node node) { node instanceof CodeInjection::Sanitizer }
33+
predicate isBarrier(DataFlow::Node node) { node instanceof CodeInjection::Sanitizer }
4034
}
4135

42-
from CodeInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
43-
where config.hasFlowPath(source, sink)
44-
select sink.getNode(), source, sink, "$@ flows to here and is interpreted as code.",
45-
source.getNode(), "A user-provided value"
36+
module CodeInjectionFlows = TaintTracking::Global<CodeInjectionConfiguration>;
37+
38+
import CodeInjectionFlows::PathGraph
39+
40+
from CodeInjectionFlows::PathNode source, CodeInjectionFlows::PathNode sink
41+
where CodeInjectionFlows::flowPath(source, sink)
42+
select sink.getNode(), source, sink, "This $@ is written to a log file.", source.getNode(),
43+
"potentially sensitive information"

‎tests/python-tests/CWE-094/local/CodeInjectionLocal.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
edges
2+
| codei.py:3:5:3:28 | ControlFlowNode for input() | codei.py:6:6:6:6 | ControlFlowNode for i |
3+
| codei.py:9:6:9:29 | ControlFlowNode for Subscript | codei.py:10:6:10:7 | ControlFlowNode for e1 |
4+
| codei.py:12:6:12:33 | ControlFlowNode for Attribute() | codei.py:13:6:13:7 | ControlFlowNode for e2 |
5+
nodes
6+
| codei.py:3:5:3:28 | ControlFlowNode for input() | semmle.label | ControlFlowNode for input() |
7+
| codei.py:6:6:6:6 | ControlFlowNode for i | semmle.label | ControlFlowNode for i |
8+
| codei.py:9:6:9:29 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
9+
| codei.py:10:6:10:7 | ControlFlowNode for e1 | semmle.label | ControlFlowNode for e1 |
10+
| codei.py:12:6:12:33 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
11+
| codei.py:13:6:13:7 | ControlFlowNode for e2 | semmle.label | ControlFlowNode for e2 |
12+
subpaths
13+
#select
14+
| codei.py:6:6:6:6 | ControlFlowNode for i | codei.py:3:5:3:28 | ControlFlowNode for input() | codei.py:6:6:6:6 | ControlFlowNode for i | This $@ is written to a log file. | codei.py:3:5:3:28 | ControlFlowNode for input() | potentially sensitive information |
15+
| codei.py:10:6:10:7 | ControlFlowNode for e1 | codei.py:9:6:9:29 | ControlFlowNode for Subscript | codei.py:10:6:10:7 | ControlFlowNode for e1 | This $@ is written to a log file. | codei.py:9:6:9:29 | ControlFlowNode for Subscript | potentially sensitive information |
16+
| codei.py:13:6:13:7 | ControlFlowNode for e2 | codei.py:12:6:12:33 | ControlFlowNode for Attribute() | codei.py:13:6:13:7 | ControlFlowNode for e2 | This $@ is written to a log file. | codei.py:12:6:12:33 | ControlFlowNode for Attribute() | potentially sensitive information |

‎tests/python-tests/CWE-094/local/CodeInjectionLocal.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
CWE-094/CodeInjectionLocal.ql

‎tests/python-tests/CWE-094/local/codei.py‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import os
2+
3+
i = input("Enter command: ")
4+
5+
# direct input
6+
exec(i)
7+
8+
# Env variable
9+
e1 = os.environ["LOCAL_DATA"]
10+
exec(e1)
11+
12+
e2 = os.environ.get("LOCAL_DATA")
13+
exec(e2)

‎tests/python-tests/CWE-094/local/options‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
semmle-extractor-options: --max-import-depth=0

0 commit comments

Comments
 (0)