Skip to content

Commit 09d4fb7

Browse files
author
Alvaro Muñoz
authored
Merge pull request #36 from GitHubSecurityLab/python-update
Python: Bump dependencies and versions for Python
2 parents 362912c + 63d62f3 commit 09d4fb7

File tree

12 files changed

+101
-72
lines changed

12 files changed

+101
-72
lines changed

‎python/lib/codeql-pack.lock.yml

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,21 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.0.3
5+
version: 0.1.5
66
codeql/mad:
7-
version: 0.1.4
7+
version: 0.2.5
88
codeql/python-all:
9-
version: 0.10.4
9+
version: 0.11.5
1010
codeql/regex:
11-
version: 0.1.4
11+
version: 0.2.5
1212
codeql/ssa:
13-
version: 0.1.4
13+
version: 0.2.5
1414
codeql/tutorial:
15-
version: 0.1.4
15+
version: 0.2.5
16+
codeql/typetracking:
17+
version: 0.2.5
1618
codeql/util:
17-
version: 0.1.4
19+
version: 0.2.5
1820
codeql/yaml:
19-
version: 0.1.4
21+
version: 0.2.5
2022
compiled: false

‎python/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
library: true
22
name: githubsecuritylab/codeql-python-libs
3-
version: 0.0.1
3+
version: 0.1.0
44
dependencies:
55
codeql/python-all: '*'

‎python/src/audit/CWE-079/XssFlaskAudit.ql

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
*/
1515

1616
import python
17-
import DataFlow::PathGraph
1817
import semmle.python.Concepts
1918
import semmle.python.ApiGraphs
2019
import semmle.python.dataflow.new.DataFlow
@@ -33,17 +32,19 @@ class DynamicTemplate extends DataFlow::Node {
3332
}
3433
}
3534

36-
class Configuration extends TaintTracking::Configuration {
37-
Configuration() { this = "AuditXSSJinja2" }
35+
module Configuration implements DataFlow::ConfigSig {
36+
predicate isSource(DataFlow::Node source) { source instanceof ReflectedXss::Source }
3837

39-
override predicate isSource(DataFlow::Node source) { source instanceof ReflectedXss::Source }
38+
predicate isSink(DataFlow::Node sink) { sink instanceof DynamicTemplate }
4039

41-
override predicate isSink(DataFlow::Node sink) { sink instanceof DynamicTemplate }
42-
43-
override predicate isSanitizer(DataFlow::Node node) { node instanceof ReflectedXss::Sanitizer }
40+
predicate isBarrier(DataFlow::Node node) { node instanceof ReflectedXss::Sanitizer }
4441
}
4542

46-
from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
47-
where config.hasFlowPath(source, sink)
43+
module ConfigurationFlow = TaintTracking::Global<Configuration>;
44+
45+
import ConfigurationFlow::PathGraph //importing the path graph from the module
46+
47+
from ConfigurationFlow::PathNode source, ConfigurationFlow::PathNode sink
48+
where ConfigurationFlow::flowPath(source, sink)
4849
select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to a $@.",
4950
source.getNode(), "user-provided value"

‎python/src/audit/CWE-089/SqlInjectionAudit.ql

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,25 +17,25 @@ import semmle.python.dataflow.new.TaintTracking
1717
import semmle.python.Concepts
1818
import semmle.python.dataflow.new.BarrierGuards
1919
import semmle.python.ApiGraphs
20-
import DataFlow::PathGraph
2120
private import semmle.python.security.dataflow.SqlInjectionCustomizations
22-
//
2321
import ghsl.Utils
2422

2523
/**
2624
* A taint-tracking configuration for detecting SQL injection vulnerabilities.
2725
*/
28-
class SqlInjectionHeuristic extends TaintTracking::Configuration {
29-
SqlInjectionHeuristic() { this = "SqlInjectionHeuristic" }
26+
module SqlInjectionHeuristicConfig implements DataFlow::ConfigSig {
27+
predicate isSource(DataFlow::Node source) { source instanceof DynamicStrings }
3028

31-
override predicate isSource(DataFlow::Node source) { source instanceof DynamicStrings }
29+
predicate isSink(DataFlow::Node sink) { sink instanceof SqlInjection::Sink }
3230

33-
override predicate isSink(DataFlow::Node sink) { sink instanceof SqlInjection::Sink }
34-
35-
override predicate isSanitizer(DataFlow::Node node) { node instanceof SqlInjection::Sanitizer }
31+
predicate isBarrier(DataFlow::Node node) { node instanceof SqlInjection::Sanitizer }
3632
}
3733

38-
from SqlInjectionHeuristic config, DataFlow::PathNode source, DataFlow::PathNode sink
39-
where config.hasFlowPath(source, sink)
40-
select sink.getNode(), source, sink, "This SQL query depends on $@.", source.getNode(),
41-
"a user-provided value"
34+
module SqlInjectionHeuristicFlow = TaintTracking::Global<SqlInjectionHeuristicConfig>;
35+
36+
import SqlInjectionHeuristicFlow::PathGraph //importing the path graph from the module
37+
38+
from SqlInjectionHeuristicFlow::PathNode source, SqlInjectionHeuristicFlow::PathNode sink
39+
where SqlInjectionHeuristicFlow::flowPath(source, sink)
40+
select sink.getNode(), source, sink, "This SQL query depends on a $@.", source.getNode(),
41+
"user-provided value"

‎python/src/codeql-pack.lock.yml

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,21 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.0.3
5+
version: 0.1.5
66
codeql/mad:
7-
version: 0.1.4
7+
version: 0.2.5
88
codeql/python-all:
9-
version: 0.10.4
9+
version: 0.11.5
1010
codeql/regex:
11-
version: 0.1.4
11+
version: 0.2.5
1212
codeql/ssa:
13-
version: 0.1.4
13+
version: 0.2.5
1414
codeql/tutorial:
15-
version: 0.1.4
15+
version: 0.2.5
16+
codeql/typetracking:
17+
version: 0.2.5
1618
codeql/util:
17-
version: 0.1.4
19+
version: 0.2.5
1820
codeql/yaml:
19-
version: 0.1.4
21+
version: 0.2.5
2022
compiled: false

‎python/src/qlpack.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
library: false
22
name: githubsecuritylab/codeql-python-queries
3-
version: 0.0.3
3+
version: 0.0.4
44
suites: suites
55
defaultSuiteFile: suites/python.qls
66
dependencies:
77
codeql/python-all: '*'
8-
githubsecuritylab/codeql-python-libs: 0.0.1
8+
githubsecuritylab/codeql-python-libs: 0.0.2

‎python/test/audit/CWE-079/XssFlaskAudit.expected

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,13 @@
11
edges
22
| app.py:1:26:1:32 | ControlFlowNode for ImportMember | app.py:1:26:1:32 | GSSA Variable request |
33
| app.py:1:26:1:32 | GSSA Variable request | app.py:12:16:12:22 | ControlFlowNode for request |
4-
| app.py:12:16:12:22 | ControlFlowNode for request | app.py:12:16:12:27 | ControlFlowNode for Attribute |
5-
| app.py:12:16:12:27 | ControlFlowNode for Attribute | app.py:12:16:12:39 | ControlFlowNode for Subscript |
6-
| app.py:12:16:12:39 | ControlFlowNode for Subscript | app.py:14:51:14:58 | ControlFlowNode for username |
4+
| app.py:12:5:12:12 | SSA variable username | app.py:14:51:14:58 | ControlFlowNode for username |
5+
| app.py:12:16:12:22 | ControlFlowNode for request | app.py:12:5:12:12 | SSA variable username |
76
nodes
87
| app.py:1:26:1:32 | ControlFlowNode for ImportMember | semmle.label | ControlFlowNode for ImportMember |
98
| app.py:1:26:1:32 | GSSA Variable request | semmle.label | GSSA Variable request |
9+
| app.py:12:5:12:12 | SSA variable username | semmle.label | SSA variable username |
1010
| app.py:12:16:12:22 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
11-
| app.py:12:16:12:27 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
12-
| app.py:12:16:12:39 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
1311
| app.py:14:51:14:58 | ControlFlowNode for username | semmle.label | ControlFlowNode for username |
1412
subpaths
1513
#select

‎python/test/audit/CWE-089/SqlInjectionAudit.expected

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,28 @@
11
edges
2-
| sqli.py:17:9:17:60 | ControlFlowNode for Fstring | sqli.py:18:16:18:20 | ControlFlowNode for query |
3-
| sqli.py:21:9:21:68 | ControlFlowNode for Attribute() | sqli.py:22:16:22:20 | ControlFlowNode for query |
4-
| sqli.py:25:9:25:60 | ControlFlowNode for BinaryExpr | sqli.py:26:16:26:20 | ControlFlowNode for query |
5-
| sqli.py:30:9:30:58 | ControlFlowNode for BinaryExpr | sqli.py:31:16:31:20 | ControlFlowNode for query |
2+
| sqli.py:17:1:17:5 | GSSA Variable query | sqli.py:18:16:18:20 | ControlFlowNode for query |
3+
| sqli.py:17:9:17:60 | ControlFlowNode for Fstring | sqli.py:17:1:17:5 | GSSA Variable query |
4+
| sqli.py:21:1:21:5 | GSSA Variable query | sqli.py:22:16:22:20 | ControlFlowNode for query |
5+
| sqli.py:21:9:21:68 | ControlFlowNode for Attribute() | sqli.py:21:1:21:5 | GSSA Variable query |
6+
| sqli.py:25:1:25:5 | GSSA Variable query | sqli.py:26:16:26:20 | ControlFlowNode for query |
7+
| sqli.py:25:9:25:60 | ControlFlowNode for BinaryExpr | sqli.py:25:1:25:5 | GSSA Variable query |
8+
| sqli.py:30:1:30:5 | GSSA Variable query | sqli.py:31:16:31:20 | ControlFlowNode for query |
9+
| sqli.py:30:9:30:58 | ControlFlowNode for BinaryExpr | sqli.py:30:1:30:5 | GSSA Variable query |
610
nodes
11+
| sqli.py:17:1:17:5 | GSSA Variable query | semmle.label | GSSA Variable query |
712
| sqli.py:17:9:17:60 | ControlFlowNode for Fstring | semmle.label | ControlFlowNode for Fstring |
813
| sqli.py:18:16:18:20 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
14+
| sqli.py:21:1:21:5 | GSSA Variable query | semmle.label | GSSA Variable query |
915
| sqli.py:21:9:21:68 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
1016
| sqli.py:22:16:22:20 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
17+
| sqli.py:25:1:25:5 | GSSA Variable query | semmle.label | GSSA Variable query |
1118
| sqli.py:25:9:25:60 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
1219
| sqli.py:26:16:26:20 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
20+
| sqli.py:30:1:30:5 | GSSA Variable query | semmle.label | GSSA Variable query |
1321
| sqli.py:30:9:30:58 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
1422
| sqli.py:31:16:31:20 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
1523
subpaths
1624
#select
17-
| sqli.py:18:16:18:20 | ControlFlowNode for query | sqli.py:17:9:17:60 | ControlFlowNode for Fstring | sqli.py:18:16:18:20 | ControlFlowNode for query | This SQL query depends on $@. | sqli.py:17:9:17:60 | ControlFlowNode for Fstring | a user-provided value |
18-
| sqli.py:22:16:22:20 | ControlFlowNode for query | sqli.py:21:9:21:68 | ControlFlowNode for Attribute() | sqli.py:22:16:22:20 | ControlFlowNode for query | This SQL query depends on $@. | sqli.py:21:9:21:68 | ControlFlowNode for Attribute() | a user-provided value |
19-
| sqli.py:26:16:26:20 | ControlFlowNode for query | sqli.py:25:9:25:60 | ControlFlowNode for BinaryExpr | sqli.py:26:16:26:20 | ControlFlowNode for query | This SQL query depends on $@. | sqli.py:25:9:25:60 | ControlFlowNode for BinaryExpr | a user-provided value |
20-
| sqli.py:31:16:31:20 | ControlFlowNode for query | sqli.py:30:9:30:58 | ControlFlowNode for BinaryExpr | sqli.py:31:16:31:20 | ControlFlowNode for query | This SQL query depends on $@. | sqli.py:30:9:30:58 | ControlFlowNode for BinaryExpr | a user-provided value |
25+
| sqli.py:18:16:18:20 | ControlFlowNode for query | sqli.py:17:9:17:60 | ControlFlowNode for Fstring | sqli.py:18:16:18:20 | ControlFlowNode for query | This SQL query depends on a $@. | sqli.py:17:9:17:60 | ControlFlowNode for Fstring | user-provided value |
26+
| sqli.py:22:16:22:20 | ControlFlowNode for query | sqli.py:21:9:21:68 | ControlFlowNode for Attribute() | sqli.py:22:16:22:20 | ControlFlowNode for query | This SQL query depends on a $@. | sqli.py:21:9:21:68 | ControlFlowNode for Attribute() | user-provided value |
27+
| sqli.py:26:16:26:20 | ControlFlowNode for query | sqli.py:25:9:25:60 | ControlFlowNode for BinaryExpr | sqli.py:26:16:26:20 | ControlFlowNode for query | This SQL query depends on a $@. | sqli.py:25:9:25:60 | ControlFlowNode for BinaryExpr | user-provided value |
28+
| sqli.py:31:16:31:20 | ControlFlowNode for query | sqli.py:30:9:30:58 | ControlFlowNode for BinaryExpr | sqli.py:31:16:31:20 | ControlFlowNode for query | This SQL query depends on a $@. | sqli.py:30:9:30:58 | ControlFlowNode for BinaryExpr | user-provided value |

‎python/test/codeql-pack.lock.yml

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,25 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.0.3
5+
version: 0.1.5
66
codeql/mad:
7-
version: 0.1.4
7+
version: 0.2.5
88
codeql/python-all:
9-
version: 0.10.4
9+
version: 0.11.5
1010
codeql/python-queries:
11-
version: 0.8.4
11+
version: 0.9.5
1212
codeql/regex:
13-
version: 0.1.4
13+
version: 0.2.5
1414
codeql/ssa:
15-
version: 0.1.4
15+
version: 0.2.5
1616
codeql/suite-helpers:
17-
version: 0.6.4
17+
version: 0.7.5
1818
codeql/tutorial:
19-
version: 0.1.4
19+
version: 0.2.5
20+
codeql/typetracking:
21+
version: 0.2.5
2022
codeql/util:
21-
version: 0.1.4
23+
version: 0.2.5
2224
codeql/yaml:
23-
version: 0.1.4
25+
version: 0.2.5
2426
compiled: false

‎python/test/security/CWE-078/CommandInjectionLocal.expected

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,20 @@
11
edges
2-
| cmdi.py:4:5:4:28 | ControlFlowNode for input() | cmdi.py:7:17:7:17 | ControlFlowNode for i |
3-
| cmdi.py:4:5:4:28 | ControlFlowNode for input() | cmdi.py:9:17:9:30 | ControlFlowNode for Fstring |
4-
| cmdi.py:14:6:14:29 | ControlFlowNode for Subscript | cmdi.py:15:17:15:43 | ControlFlowNode for BinaryExpr |
5-
| cmdi.py:17:6:17:33 | ControlFlowNode for Attribute() | cmdi.py:18:17:18:43 | ControlFlowNode for BinaryExpr |
2+
| cmdi.py:4:1:4:1 | GSSA Variable i | cmdi.py:7:17:7:17 | ControlFlowNode for i |
3+
| cmdi.py:4:1:4:1 | GSSA Variable i | cmdi.py:9:17:9:30 | ControlFlowNode for Fstring |
4+
| cmdi.py:4:5:4:28 | ControlFlowNode for input() | cmdi.py:4:1:4:1 | GSSA Variable i |
5+
| cmdi.py:14:1:14:2 | GSSA Variable e1 | cmdi.py:15:17:15:43 | ControlFlowNode for BinaryExpr |
6+
| cmdi.py:14:6:14:29 | ControlFlowNode for Subscript | cmdi.py:14:1:14:2 | GSSA Variable e1 |
7+
| cmdi.py:17:1:17:2 | GSSA Variable e2 | cmdi.py:18:17:18:43 | ControlFlowNode for BinaryExpr |
8+
| cmdi.py:17:6:17:33 | ControlFlowNode for Attribute() | cmdi.py:17:1:17:2 | GSSA Variable e2 |
69
nodes
10+
| cmdi.py:4:1:4:1 | GSSA Variable i | semmle.label | GSSA Variable i |
711
| cmdi.py:4:5:4:28 | ControlFlowNode for input() | semmle.label | ControlFlowNode for input() |
812
| cmdi.py:7:17:7:17 | ControlFlowNode for i | semmle.label | ControlFlowNode for i |
913
| cmdi.py:9:17:9:30 | ControlFlowNode for Fstring | semmle.label | ControlFlowNode for Fstring |
14+
| cmdi.py:14:1:14:2 | GSSA Variable e1 | semmle.label | GSSA Variable e1 |
1015
| cmdi.py:14:6:14:29 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
1116
| cmdi.py:15:17:15:43 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
17+
| cmdi.py:17:1:17:2 | GSSA Variable e2 | semmle.label | GSSA Variable e2 |
1218
| cmdi.py:17:6:17:33 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
1319
| cmdi.py:18:17:18:43 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
1420
subpaths

‎python/test/security/CWE-094/CodeInjectionLocal.expected

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
11
edges
2-
| codei.py:3:5:3:28 | ControlFlowNode for input() | codei.py:6:6:6:6 | ControlFlowNode for i |
3-
| codei.py:9:6:9:29 | ControlFlowNode for Subscript | codei.py:10:6:10:7 | ControlFlowNode for e1 |
4-
| codei.py:12:6:12:33 | ControlFlowNode for Attribute() | codei.py:13:6:13:7 | ControlFlowNode for e2 |
2+
| codei.py:3:1:3:1 | GSSA Variable i | codei.py:6:6:6:6 | ControlFlowNode for i |
3+
| codei.py:3:5:3:28 | ControlFlowNode for input() | codei.py:3:1:3:1 | GSSA Variable i |
4+
| codei.py:9:1:9:2 | GSSA Variable e1 | codei.py:10:6:10:7 | ControlFlowNode for e1 |
5+
| codei.py:9:6:9:29 | ControlFlowNode for Subscript | codei.py:9:1:9:2 | GSSA Variable e1 |
6+
| codei.py:12:1:12:2 | GSSA Variable e2 | codei.py:13:6:13:7 | ControlFlowNode for e2 |
7+
| codei.py:12:6:12:33 | ControlFlowNode for Attribute() | codei.py:12:1:12:2 | GSSA Variable e2 |
58
nodes
9+
| codei.py:3:1:3:1 | GSSA Variable i | semmle.label | GSSA Variable i |
610
| codei.py:3:5:3:28 | ControlFlowNode for input() | semmle.label | ControlFlowNode for input() |
711
| codei.py:6:6:6:6 | ControlFlowNode for i | semmle.label | ControlFlowNode for i |
12+
| codei.py:9:1:9:2 | GSSA Variable e1 | semmle.label | GSSA Variable e1 |
813
| codei.py:9:6:9:29 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
914
| codei.py:10:6:10:7 | ControlFlowNode for e1 | semmle.label | ControlFlowNode for e1 |
15+
| codei.py:12:1:12:2 | GSSA Variable e2 | semmle.label | GSSA Variable e2 |
1016
| codei.py:12:6:12:33 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
1117
| codei.py:13:6:13:7 | ControlFlowNode for e2 | semmle.label | ControlFlowNode for e2 |
1218
subpaths

‎python/test/security/CWE-502/UnsafeDeserializationLocal.expected

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
edges
2-
| unsafe.py:5:5:5:11 | ControlFlowNode for input() | unsafe.py:7:14:7:14 | ControlFlowNode for i |
3-
| unsafe.py:10:5:10:32 | ControlFlowNode for Attribute() | unsafe.py:12:14:12:14 | ControlFlowNode for e |
2+
| unsafe.py:5:1:5:1 | GSSA Variable i | unsafe.py:7:14:7:14 | ControlFlowNode for i |
3+
| unsafe.py:5:5:5:11 | ControlFlowNode for input() | unsafe.py:5:1:5:1 | GSSA Variable i |
4+
| unsafe.py:10:1:10:1 | GSSA Variable e | unsafe.py:12:14:12:14 | ControlFlowNode for e |
5+
| unsafe.py:10:5:10:32 | ControlFlowNode for Attribute() | unsafe.py:10:1:10:1 | GSSA Variable e |
46
nodes
7+
| unsafe.py:5:1:5:1 | GSSA Variable i | semmle.label | GSSA Variable i |
58
| unsafe.py:5:5:5:11 | ControlFlowNode for input() | semmle.label | ControlFlowNode for input() |
69
| unsafe.py:7:14:7:14 | ControlFlowNode for i | semmle.label | ControlFlowNode for i |
10+
| unsafe.py:10:1:10:1 | GSSA Variable e | semmle.label | GSSA Variable e |
711
| unsafe.py:10:5:10:32 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
812
| unsafe.py:12:14:12:14 | ControlFlowNode for e | semmle.label | ControlFlowNode for e |
913
| unsafe.py:17:22:17:29 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |

0 commit comments

Comments
 (0)