Skip to content

Commit 4283bb7

Browse files
committed
clean up unused vars,fix tests
1 parent 9d86e79 commit 4283bb7

File tree

6 files changed

+201
-473
lines changed

6 files changed

+201
-473
lines changed

python/ql/src/experimental/Security/CWE-409/DecompressionBombs.ql

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,7 @@ predicate isAdditionalTaintStepTextIOWrapper(DataFlow::Node nodeFrom, DataFlow::
3636
|
3737
nodeFrom = textIOWrapper.getParameter(0, "input").asSink() and
3838
nodeTo = textIOWrapper
39-
) and
40-
exists(nodeTo.getLocation().getFile().getRelativePath())
39+
)
4140
}
4241

4342
module FileAndFormRemoteFlowSource {
@@ -62,7 +61,7 @@ module FileAndFormRemoteFlowSource {
6261
fastApiUploadFile =
6362
fastApiParam.asSource().asExpr().(Parameter).getAnnotation().getASubExpression*() and
6463
// Multiple Uploaded files as list of fastapi.UploadFile
65-
exists(For f, Attribute attr, DataFlow::Node a, DataFlow::Node b |
64+
exists(For f, Attribute attr |
6665
fastApiParam.getAValueReachableFromSource().asExpr() = f.getIter().getASubExpression*()
6766
|
6867
TaintTracking::localExprTaint(f.getIter(), attr.getObject()) and
@@ -80,11 +79,10 @@ module FileAndFormRemoteFlowSource {
8079
.getReturn()
8180
.asSource(), fastApiParam.getMember("read").getReturn().asSource()
8281
]
83-
) and
84-
exists(this.getLocation().getFile().getRelativePath())
82+
)
8583
}
8684

87-
override string getSourceType() { result = "HTTP FORM" }
85+
override string getSourceType() { result = "fastapi HTTP FORM files" }
8886
}
8987
}
9088

0 commit comments

Comments
 (0)