Skip to content

Commit d3ee658

Browse files
asgerfasgerf
committed
Python: resolve remaining TODOs
1 parent 975ce06 commit d3ee658

File tree

8 files changed

+33
-50
lines changed

8 files changed

+33
-50
lines changed

‎python/ql/lib/semmle/python/security/dataflow/LdapInjectionQuery.qll

+2-12
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,7 @@ private module LdapInjectionDnConfig implements DataFlow::ConfigSig {
2020

2121
predicate isBarrier(DataFlow::Node node) { node instanceof DnSanitizer }
2222

23-
predicate observeDiffInformedIncrementalMode() {
24-
// TODO(diff-informed): Manually verify if config can be diff-informed.
25-
// ql/src/Security/CWE-090/LdapInjection.ql:26: Column 1 does not select a source or sink originating from the flow call on line 21
26-
// ql/src/Security/CWE-090/LdapInjection.ql:27: Column 5 does not select a source or sink originating from the flow call on line 21
27-
none()
28-
}
23+
predicate observeDiffInformedIncrementalMode() { any() }
2924
}
3025

3126
/** Global taint-tracking for detecting "LDAP injection via the distinguished name (DN) parameter" vulnerabilities. */
@@ -38,12 +33,7 @@ private module LdapInjectionFilterConfig implements DataFlow::ConfigSig {
3833

3934
predicate isBarrier(DataFlow::Node node) { node instanceof FilterSanitizer }
4035

41-
predicate observeDiffInformedIncrementalMode() {
42-
// TODO(diff-informed): Manually verify if config can be diff-informed.
43-
// ql/src/Security/CWE-090/LdapInjection.ql:26: Column 1 does not select a source or sink originating from the flow call on line 24
44-
// ql/src/Security/CWE-090/LdapInjection.ql:27: Column 5 does not select a source or sink originating from the flow call on line 24
45-
none()
46-
}
36+
predicate observeDiffInformedIncrementalMode() { any() }
4737
}
4838

4939
/** Global taint-tracking for detecting "LDAP injection via the filter parameter" vulnerabilities. */

‎python/ql/lib/semmle/python/security/dataflow/RegexInjectionQuery.qll

+6-4
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,12 @@ private module RegexInjectionConfig implements DataFlow::ConfigSig {
1919

2020
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
2121

22-
predicate observeDiffInformedIncrementalMode() {
23-
// TODO(diff-informed): Manually verify if config can be diff-informed.
24-
// ql/src/Security/CWE-730/RegexInjection.ql:29: Column 7 selects sink.getRegexExecution
25-
none()
22+
predicate observeDiffInformedIncrementalMode() { any() }
23+
24+
Location getASelectedSinkLocation(DataFlow::Node sink) {
25+
result = sink.(Sink).getLocation()
26+
or
27+
result = sink.(Sink).getRegexExecution().getLocation()
2628
}
2729
}
2830

‎python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll

+12-9
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,12 @@ private module FullServerSideRequestForgeryConfig implements DataFlow::ConfigSig
3030
node instanceof FullUrlControlSanitizer
3131
}
3232

33-
predicate observeDiffInformedIncrementalMode() {
34-
// TODO(diff-informed): Manually verify if config can be diff-informed.
35-
// ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll:47: Flow call outside 'select' clause
36-
// ql/src/Security/CWE-918/FullServerSideRequestForgery.ql:24: Column 1 selects sink.getRequest
37-
none()
33+
predicate observeDiffInformedIncrementalMode() { any() }
34+
35+
Location getASelectedSinkLocation(DataFlow::Node sink) {
36+
result = sink.(Sink).getLocation()
37+
or
38+
result = sink.(Sink).getRequest().getLocation()
3839
}
3940
}
4041

@@ -66,10 +67,12 @@ private module PartialServerSideRequestForgeryConfig implements DataFlow::Config
6667

6768
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
6869

69-
predicate observeDiffInformedIncrementalMode() {
70-
// TODO(diff-informed): Manually verify if config can be diff-informed.
71-
// ql/src/Security/CWE-918/PartialServerSideRequestForgery.ql:24: Column 1 selects sink.getRequest
72-
none()
70+
predicate observeDiffInformedIncrementalMode() { any() }
71+
72+
Location getASelectedSinkLocation(DataFlow::Node sink) {
73+
result = sink.(Sink).getLocation()
74+
or
75+
result = sink.(Sink).getRequest().getLocation()
7376
}
7477
}
7578

‎python/ql/lib/semmle/python/security/dataflow/UnsafeShellCommandConstructionQuery.qll

+8-5
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,14 @@ module UnsafeShellCommandConstructionConfig implements DataFlow::ConfigSig {
2929
// override to require the path doesn't have unmatched return steps
3030
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
3131

32-
predicate observeDiffInformedIncrementalMode() {
33-
// TODO(diff-informed): Manually verify if config can be diff-informed.
34-
// ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql:27: Column 1 selects sink.getStringConstruction
35-
// ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql:29: Column 7 selects sink.getCommandExecution
36-
none()
32+
predicate observeDiffInformedIncrementalMode() { any() }
33+
34+
Location getASelectedSinkLocation(DataFlow::Node sink) {
35+
result = sink.(Sink).getLocation()
36+
or
37+
result = sink.(Sink).getStringConstruction().getLocation()
38+
or
39+
result = sink.(Sink).getCommandExecution().getLocation()
3740
}
3841
}
3942

‎python/ql/lib/semmle/python/security/dataflow/WeakSensitiveDataHashingQuery.qll

+2-10
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,7 @@ module NormalHashFunction {
3434
sensitiveDataExtraStepForCalls(node1, node2)
3535
}
3636

37-
predicate observeDiffInformedIncrementalMode() {
38-
// TODO(diff-informed): Manually verify if config can be diff-informed.
39-
// ql/lib/semmle/python/security/dataflow/WeakSensitiveDataHashingQuery.qll:88: Flow call outside 'select' clause
40-
none()
41-
}
37+
predicate observeDiffInformedIncrementalMode() { any() }
4238
}
4339

4440
/** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on sensitive data" vulnerabilities. */
@@ -70,11 +66,7 @@ module ComputationallyExpensiveHashFunction {
7066
sensitiveDataExtraStepForCalls(node1, node2)
7167
}
7268

73-
predicate observeDiffInformedIncrementalMode() {
74-
// TODO(diff-informed): Manually verify if config can be diff-informed.
75-
// ql/lib/semmle/python/security/dataflow/WeakSensitiveDataHashingQuery.qll:95: Flow call outside 'select' clause
76-
none()
77-
}
69+
predicate observeDiffInformedIncrementalMode() { any() }
7870
}
7971

8072
/** Global taint-tracking for detecting "use of a broken or weak cryptographic hashing algorithm on passwords" vulnerabilities. */

‎python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll

+1-4
Original file line numberDiff line numberDiff line change
@@ -173,10 +173,7 @@ private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
173173
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
174174

175175
predicate observeDiffInformedIncrementalMode() {
176-
// TODO(diff-informed): Manually verify if config can be diff-informed.
177-
// ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll:181: Flow call outside 'select' clause
178-
// ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll:184: Flow call outside 'select' clause
179-
none()
176+
none() // Not used for PR analysis
180177
}
181178
}
182179

‎python/ql/src/Security/CWE-327/FluentApiModel.qll

+1-3
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,7 @@ module InsecureContextConfiguration implements DataFlow::StateConfigSig {
112112
}
113113

114114
predicate observeDiffInformedIncrementalMode() {
115-
// TODO(diff-informed): Manually verify if config can be diff-informed.
116-
// ql/src/Security/CWE-327/FluentApiModel.qll:130: Flow call outside 'select' clause
117-
none()
115+
none() // Too complicated, but might be possible after some refactoring.
118116
}
119117
}
120118

‎python/ql/src/experimental/semmle/python/libraries/SmtpLib.qll

+1-3
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,7 @@ module SmtpLib {
4040
}
4141

4242
predicate observeDiffInformedIncrementalMode() {
43-
// TODO(diff-informed): Manually verify if config can be diff-informed.
44-
// ql/src/experimental/semmle/python/libraries/SmtpLib.qll:91: Flow call outside 'select' clause
45-
none()
43+
none() // Used in library model
4644
}
4745
}
4846

0 commit comments

Comments
 (0)