You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/customizing-library-models-for-python.rst
+12-12Lines changed: 12 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,7 +60,7 @@ Note that this sink is already recognized by the CodeQL Python analysis, but for
60
60
- **Member[sudo]** selects accesses to the **sudo** function in the **operations** module.
61
61
- **Argument[0]** selects the first argument to calls to that function.
62
62
63
-
- **command-injection** indicates that this is considered a sink for the command injection query.
63
+
- **"command-injection"** indicates that this is considered a sink for the command injection query.
64
64
65
65
Example: Taint sink in the 'invoke' package
66
66
-------------------------------------------
@@ -92,7 +92,7 @@ Note that this sink is already recognized by the CodeQL Python analysis, but for
92
92
- **Member[run]** selects accesses to the **run** method in the **Context** class.
93
93
- **Argument[0]** selects the first argument to calls to that method.
94
94
95
-
- **command-injection** indicates that this is considered a sink for the command injection query.
95
+
- **"command-injection"** indicates that this is considered a sink for the command injection query.
96
96
97
97
Note that the **Instance** component is used to select instances of a class, including instances of its subclasses.
98
98
Since methods on instances are common targets, we have a more compact syntax for selecting them. The first column, the type, is allowed to contain a dotted path ending in a class name.
@@ -182,7 +182,7 @@ Note that this source is already known by the CodeQL Python analysis, but for th
182
182
- **Argument[0,upload_to:]** selects the first positional argument, or the named argument named **upload_to**. Note that the colon at the end of the argument name indicates that we are looking for a named argument.
183
183
- **Parameter[1]** selects the second parameter of the callback function, which is the parameter receiving the filename.
184
184
185
-
- Finally, the kind **remote** indicates that this is considered a source of remote flow.
185
+
- Finally, the kind **"remote"** indicates that this is considered a source of remote flow.
186
186
187
187
Example: Adding flow through 're.compile'
188
188
----------------------------------------------
@@ -215,12 +215,12 @@ Note that this flow is already recognized by the CodeQL Python analysis, but for
215
215
216
216
217
217
- Since we're adding flow through a function call, we add a tuple to the **summaryModel** extensible predicate.
218
-
- The first column, **re**, begins the search for relevant calls at places where the **re** package is imported.
219
-
- The second column, **Member[compile]**, is a path leading to the function calls we wish to model.
218
+
- The first column, **"re"**, begins the search for relevant calls at places where the **re** package is imported.
219
+
- The second column, **"Member[compile]"**, is a path leading to the function calls we wish to model.
220
220
In this case, we select references to the **compile** function from the ``re`` package.
221
-
- The third column, **Argument[0,pattern:]**, indicates the input of the flow. In this case, either the first argument to the function call or the argument named **pattern**.
222
-
- The fourth column, **ReturnValue.Attribute[pattern]**, indicates the output of the flow. In this case, the ``pattern`` attribute of the return value of the function call.
223
-
- The last column, **value**, indicates the kind of flow to add. The value **value** means the input value is unchanged as
221
+
- The third column, **"Argument[0,pattern:]"**, indicates the input of the flow. In this case, either the first argument to the function call or the argument named **pattern**.
222
+
- The fourth column, **"ReturnValue.Attribute[pattern]"**, indicates the output of the flow. In this case, the ``pattern`` attribute of the return value of the function call.
223
+
- The last column, **"value"**, indicates the kind of flow to add. The value **value** means the input value is unchanged as
224
224
it flows to the output.
225
225
226
226
Example: Adding flow through 'sorted'
@@ -253,10 +253,10 @@ Note that this flow is already recognized by the CodeQL Python analysis, but for
253
253
- Since we're adding flow through a function call, we add a tuple to the **summaryModel** extensible predicate.
254
254
- The first column, **"builtins"**, begins the search for relevant calls among references to the built-in names.
255
255
In Python, many built-in functions are available. Technically, most of these are part of the **builtins** package, but they can be accessed without an explicit import. When we write **builtins** in the first column, we will find both the implicit and explicit references to the built-in functions.
256
-
- The second column, **Member[sorted]**, selects references to the **sorted** function from the **builtins** package; that is, the built-in function **sorted**.
257
-
- The third column, **Argument[0]**, indicates the input of the flow. In this case, the first argument to the function call.
258
-
- The fourth column, **ReturnValue**, indicates the output of the flow. In this case, the return value of the function call.
259
-
- The last column, **taint**, indicates the kind of flow to add. The value **taint** means the output is not necessarily equal
256
+
- The second column, **"Member[sorted]"**, selects references to the **sorted** function from the **builtins** package; that is, the built-in function **sorted**.
257
+
- The third column, **"Argument[0]"**, indicates the input of the flow. In this case, the first argument to the function call.
258
+
- The fourth column, **"ReturnValue"**, indicates the output of the flow. In this case, the return value of the function call.
259
+
- The last column, **"taint"**, indicates the kind of flow to add. The value **taint** means the output is not necessarily equal
260
260
to the input, but was derived from the input in a taint-preserving way.
261
261
262
262
We might also provide a summary stating that the elements of the input list are preserved in the output list:
0 commit comments