Skip to content

Commit 2b2bbdf

Browse files
sylwia-budzynskasylwia-budzynska
authored
Merge pull request #14 from GitHubSecurityLab/part5
Part5
2 parents b4015e4 + 4692be8 commit 2b2bbdf

File tree

18 files changed

+492
-7
lines changed

18 files changed

+492
-7
lines changed

‎2/codeql-pack.lock.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies:
4+
codeql/concepts:
5+
version: 0.0.4
6+
codeql/controlflow:
7+
version: 2.0.14
8+
codeql/dataflow:
9+
version: 2.0.14
10+
codeql/mad:
11+
version: 1.0.30
12+
codeql/python-all:
13+
version: 4.0.14
14+
codeql/regex:
15+
version: 1.0.30
16+
codeql/ssa:
17+
version: 2.0.6
18+
codeql/threat-models:
19+
version: 1.0.30
20+
codeql/tutorial:
21+
version: 1.0.30
22+
codeql/typetracking:
23+
version: 2.0.14
24+
codeql/util:
25+
version: 2.0.17
26+
codeql/xml:
27+
version: 1.0.30
28+
codeql/yaml:
29+
version: 1.0.30
30+
compiled: false

‎2/codeql-pack.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
library: false
3+
warnOnImplicitThis: false
4+
compileForOverlayEval: false
5+
name: getting-started/codeql-extra-queries-2-python
6+
version: 1.0.0
7+
dependencies:
8+
codeql/python-all: ^4.0.14

‎3/codeql-pack.lock.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies:
4+
codeql/concepts:
5+
version: 0.0.4
6+
codeql/controlflow:
7+
version: 2.0.14
8+
codeql/dataflow:
9+
version: 2.0.14
10+
codeql/mad:
11+
version: 1.0.30
12+
codeql/python-all:
13+
version: 4.0.14
14+
codeql/regex:
15+
version: 1.0.30
16+
codeql/ssa:
17+
version: 2.0.6
18+
codeql/threat-models:
19+
version: 1.0.30
20+
codeql/tutorial:
21+
version: 1.0.30
22+
codeql/typetracking:
23+
version: 2.0.14
24+
codeql/util:
25+
version: 2.0.17
26+
codeql/xml:
27+
version: 1.0.30
28+
codeql/yaml:
29+
version: 1.0.30
30+
compiled: false

‎3/codeql-pack.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
library: false
3+
warnOnImplicitThis: false
4+
compileForOverlayEval: false
5+
name: getting-started/codeql-extra-queries-3-python
6+
version: 1.0.0
7+
dependencies:
8+
codeql/python-all: ^4.0.14

‎4/codeql-pack.lock.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies:
4+
codeql/concepts:
5+
version: 0.0.4
6+
codeql/controlflow:
7+
version: 2.0.14
8+
codeql/dataflow:
9+
version: 2.0.14
10+
codeql/mad:
11+
version: 1.0.30
12+
codeql/python-all:
13+
version: 4.0.14
14+
codeql/regex:
15+
version: 1.0.30
16+
codeql/ssa:
17+
version: 2.0.6
18+
codeql/threat-models:
19+
version: 1.0.30
20+
codeql/tutorial:
21+
version: 1.0.30
22+
codeql/typetracking:
23+
version: 2.0.14
24+
codeql/util:
25+
version: 2.0.17
26+
codeql/xml:
27+
version: 1.0.30
28+
codeql/yaml:
29+
version: 1.0.30
30+
compiled: false

‎4/codeql-pack.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
library: false
3+
warnOnImplicitThis: false
4+
compileForOverlayEval: false
5+
name: getting-started/queries-python
6+
version: 1.0.0
7+
dependencies:
8+
codeql/python-all: ^4.0.14

‎5/1.ql‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* @name Gradio unsafe deserialization
3+
* @description This query tracks data flow from inputs passed to a Gradio's Button component to any sink.
4+
* @kind path-problem
5+
* @problem.severity warning
6+
* @id 5/1
7+
*/
8+
import python
9+
import semmle.python.ApiGraphs
10+
import semmle.python.Concepts
11+
import semmle.python.dataflow.new.RemoteFlowSources
12+
import semmle.python.dataflow.new.TaintTracking
13+
14+
import MyFlow::PathGraph
15+
16+
class GradioButton extends RemoteFlowSource::Range {
17+
GradioButton() {
18+
exists(API::CallNode n |
19+
n = API::moduleImport("gradio").getMember("Button").getReturn()
20+
.getMember("click").getACall() |
21+
this = n.getParameter(0, "fn").getParameter(_).asSource())
22+
}
23+
24+
override string getSourceType() { result = "Gradio untrusted input" }
25+
}
26+
27+
private module MyConfig implements DataFlow::ConfigSig {
28+
predicate isSource(DataFlow::Node source) { source instanceof GradioButton }
29+
30+
predicate isSink(DataFlow::Node sink) { exists(Decoding d | sink = d) }
31+
}
32+
module MyFlow = TaintTracking::Global<MyConfig>;
33+
34+
from MyFlow::PathNode source, MyFlow::PathNode sink
35+
where MyFlow::flowPath(source, sink)
36+
select sink.getNode(), source, sink, "Data Flow from a Gradio source to decoding"

‎5/2.ql‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/**
2+
* @name getAQlClass on Gradio Button input source
3+
* @description This query reports on a code element's types.
4+
* @id 5/2
5+
* @severity error
6+
* @kind problem
7+
*/
8+
import python
9+
import semmle.python.ApiGraphs
10+
import semmle.python.Concepts
11+
import semmle.python.dataflow.new.RemoteFlowSources
12+
13+
14+
15+
from DataFlow::Node node
16+
where node = API::moduleImport("gradio").getMember("Button").getReturn()
17+
.getMember("click").getACall().getParameter(0, "fn").getParameter(_).asSource()
18+
select node, node.getAQlClass()

‎5/3.ql‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/**
2+
* @name Gradio Button partial path graph
3+
* @description This query tracks data flow from inputs passed to a Gradio's Button component to any sink.
4+
* @kind path-problem
5+
* @problem.severity warning
6+
* @id 5/3
7+
*/
8+
9+
import python
10+
import semmle.python.ApiGraphs
11+
import semmle.python.Concepts
12+
import semmle.python.dataflow.new.RemoteFlowSources
13+
import semmle.python.dataflow.new.TaintTracking
14+
15+
// import MyFlow::PathGraph
16+
import PartialFlow::PartialPathGraph
17+
18+
class GradioButton extends RemoteFlowSource::Range {
19+
GradioButton() {
20+
exists(API::CallNode n |
21+
n = API::moduleImport("gradio").getMember("Button").getReturn()
22+
.getMember("click").getACall() |
23+
this = n.getParameter(0, "fn").getParameter(_).asSource())
24+
}
25+
26+
override string getSourceType() { result = "Gradio untrusted input" }
27+
}
28+
29+
private module MyConfig implements DataFlow::ConfigSig {
30+
predicate isSource(DataFlow::Node source) { source instanceof GradioButton }
31+
32+
predicate isSink(DataFlow::Node sink) { exists(Decoding d | d.mayExecuteInput() | sink = d.getAnInput()) }
33+
34+
}
35+
36+
37+
module MyFlow = TaintTracking::Global<MyConfig>;
38+
int explorationLimit() { result = 10 }
39+
module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;
40+
41+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
42+
where PartialFlow::partialFlow(source, sink, _)
43+
select sink.getNode(), source, sink, "Partial Graph $@.", source.getNode(), "user-provided value."

‎5/4.ql‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/**
2+
* @name Gradio Button partial path graph
3+
* @description This query tracks data flow from Gradio's Button component to any sink.
4+
* @kind path-problem
5+
* @problem.severity warning
6+
* @id 5/4
7+
*/
8+
9+
import python
10+
import semmle.python.ApiGraphs
11+
import semmle.python.Concepts
12+
import semmle.python.dataflow.new.RemoteFlowSources
13+
import semmle.python.dataflow.new.TaintTracking
14+
15+
// import MyFlow::PathGraph
16+
import PartialFlow::PartialPathGraph
17+
18+
class GradioButton extends RemoteFlowSource::Range {
19+
GradioButton() {
20+
exists(API::CallNode n |
21+
n = API::moduleImport("gradio").getMember("Button").getReturn()
22+
.getMember("click").getACall() |
23+
this = n.getParameter(0, "fn").getParameter(_).asSource())
24+
}
25+
26+
override string getSourceType() { result = "Gradio untrusted input" }
27+
}
28+
29+
predicate nameAttrRead(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
30+
// Connects an attribute read of an object's `name` attribute to the object itself
31+
exists(DataFlow::AttrRead attr |
32+
attr.accesses(nodeFrom, "name")
33+
and nodeTo = attr
34+
)
35+
}
36+
37+
private module MyConfig implements DataFlow::ConfigSig {
38+
predicate isSource(DataFlow::Node source) { source instanceof GradioButton }
39+
40+
predicate isSink(DataFlow::Node sink) { exists(Decoding d | d.mayExecuteInput() | sink = d.getAnInput()) }
41+
42+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
43+
nameAttrRead(nodeFrom, nodeTo)
44+
}
45+
}
46+
47+
48+
module MyFlow = TaintTracking::Global<MyConfig>;
49+
int explorationLimit() { result = 10 }
50+
module PartialFlow = MyFlow::FlowExplorationFwd<explorationLimit/0>;
51+
52+
from PartialFlow::PartialPathNode source, PartialFlow::PartialPathNode sink
53+
where PartialFlow::partialFlow(source, sink, _)
54+
select sink.getNode(), source, sink, "Partial Graph $@.", source.getNode(), "user-provided value."

0 commit comments

Comments
 (0)