Skip to content

Commit 4861a98

Browse files
committed
Python: Fix cryptography modeling
The old code was my own suggestion, that I thought would just work, but was also slightly skeptical about. I tested out whether it works with the code below ```codeql predicate foo(int input, string res) { input = 1 and res = "that was one" } from int input, string res where input in [1, 2] and if foo(input, res) then any() else res = "not one" select input, res ``` which gave the 3 results ``` 1 | that was one 1 | not one 2 | not one ``` only by rewriting the code to be the one below, did I get down to the 2 results I actually wanted. So I've done the same kind of rewrite in the commit. ```codeql predicate foo(int input, string res) { input = 1 and res = "that was one" } from int input, string res where input in [1, 2] and if foo(input, _) then foo(input, res) else res = "not one" select input, res ```
1 parent 85fa6fb commit 4861a98

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

python/ql/lib/semmle/python/frameworks/Cryptography.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -195,8 +195,8 @@ private module CryptographyModel {
195195
call.getArg(0), call.getArgByName("algorithm")
196196
] and
197197
exists(DataFlow::Node modeArg | modeArg in [call.getArg(1), call.getArgByName("mode")] |
198-
if modeArg = modeClassRef(modeName).getReturn().getAUse()
199-
then any()
198+
if modeArg = modeClassRef(_).getReturn().getAUse()
199+
then modeArg = modeClassRef(modeName).getReturn().getAUse()
200200
else modeName = "<None or unknown>"
201201
)
202202
)

0 commit comments

Comments
 (0)