Skip to content

Commit 2d845e3

Browse files
yoffyoff
committed
Python: nicer paths
turn "the long jump" that would end up straight at the argument into a short jump that ends up at the dictionary being written to. Dataflow takes care of the rest of the path.
1 parent 74d6f37 commit 2d845e3

File tree

2 files changed

+17
-14
lines changed

2 files changed

+17
-14
lines changed

‎python/ql/lib/semmle/python/frameworks/PyMongo.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ private module PyMongo {
160160
dictionary =
161161
mongoCollection().getMember(mongoCollectionMethodName()).getACall().getParameter(0) and
162162
query = dictionary.getSubscript("$where").asSink() and
163-
this = dictionary.asSink()
163+
this = dictionary.getAValueReachingSink()
164164
}
165165

166166
override DataFlow::Node getAnInput() { result = query }
@@ -190,7 +190,7 @@ private module PyMongo {
190190
.getASubscript*()
191191
.getSubscript("$function") and
192192
query = dictionary.getSubscript("body").asSink() and
193-
this = dictionary.asSink()
193+
this = dictionary.getAValueReachingSink()
194194
)
195195
}
196196

@@ -221,7 +221,7 @@ private module PyMongo {
221221
.getASubscript*()
222222
.getSubscript("$accumulator") and
223223
query = dictionary.getSubscript(["init", "accumulate", "merge", "finalize"]).asSink() and
224-
this = dictionary.asSink()
224+
this = dictionary.getAValueReachingSink()
225225
)
226226
}
227227

‎python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/NoSqlInjection.expected

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,15 @@ edges
1515
| PoC/server.py:46:38:46:67 | ControlFlowNode for BinaryExpr | PoC/server.py:46:27:46:68 | ControlFlowNode for Dict |
1616
| PoC/server.py:51:5:51:10 | SSA variable author | PoC/server.py:53:17:53:70 | ControlFlowNode for BinaryExpr |
1717
| PoC/server.py:51:14:51:20 | ControlFlowNode for request | PoC/server.py:51:5:51:10 | SSA variable author |
18-
| PoC/server.py:53:17:53:70 | ControlFlowNode for BinaryExpr | PoC/server.py:60:51:60:56 | ControlFlowNode for search |
19-
| PoC/server.py:60:51:60:56 | ControlFlowNode for search | PoC/server.py:60:27:60:58 | ControlFlowNode for Dict |
18+
| PoC/server.py:52:5:52:10 | SSA variable search | PoC/server.py:60:27:60:58 | ControlFlowNode for Dict |
19+
| PoC/server.py:52:14:56:5 | ControlFlowNode for Dict | PoC/server.py:52:5:52:10 | SSA variable search |
20+
| PoC/server.py:53:17:53:70 | ControlFlowNode for BinaryExpr | PoC/server.py:52:14:56:5 | ControlFlowNode for Dict |
2021
| PoC/server.py:76:5:76:10 | SSA variable author | PoC/server.py:79:23:79:101 | ControlFlowNode for BinaryExpr |
2122
| PoC/server.py:76:14:76:20 | ControlFlowNode for request | PoC/server.py:76:5:76:10 | SSA variable author |
22-
| PoC/server.py:79:23:79:101 | ControlFlowNode for BinaryExpr | PoC/server.py:85:37:85:47 | ControlFlowNode for accumulator |
23+
| PoC/server.py:77:5:77:15 | SSA variable accumulator | PoC/server.py:83:5:83:9 | SSA variable group |
24+
| PoC/server.py:77:19:82:5 | ControlFlowNode for Dict | PoC/server.py:77:5:77:15 | SSA variable accumulator |
25+
| PoC/server.py:79:23:79:101 | ControlFlowNode for BinaryExpr | PoC/server.py:77:19:82:5 | ControlFlowNode for Dict |
2326
| PoC/server.py:83:5:83:9 | SSA variable group | PoC/server.py:90:29:90:47 | ControlFlowNode for Dict |
24-
| PoC/server.py:85:37:85:47 | ControlFlowNode for accumulator | PoC/server.py:83:5:83:9 | SSA variable group |
2527
| PoC/server.py:96:5:96:10 | SSA variable author | PoC/server.py:97:5:97:10 | SSA variable mapper |
2628
| PoC/server.py:96:14:96:20 | ControlFlowNode for request | PoC/server.py:96:5:96:10 | SSA variable author |
2729
| PoC/server.py:97:5:97:10 | SSA variable mapper | PoC/server.py:100:9:100:14 | ControlFlowNode for mapper |
@@ -106,13 +108,12 @@ edges
106108
| pymongo_test.py:52:15:52:50 | ControlFlowNode for Attribute() | pymongo_test.py:52:5:52:11 | SSA variable decoded |
107109
| pymongo_test.py:52:26:52:32 | ControlFlowNode for request | pymongo_test.py:52:26:52:49 | ControlFlowNode for Subscript |
108110
| pymongo_test.py:52:26:52:49 | ControlFlowNode for Subscript | pymongo_test.py:52:15:52:50 | ControlFlowNode for Attribute() |
109-
| pymongo_test.py:54:5:54:10 | SSA variable search | pymongo_test.py:59:49:59:54 | ControlFlowNode for search |
110-
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:54:5:54:10 | SSA variable search |
111-
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:59:49:59:54 | ControlFlowNode for search |
111+
| pymongo_test.py:54:5:54:10 | SSA variable search | pymongo_test.py:59:25:59:56 | ControlFlowNode for Dict |
112+
| pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict | pymongo_test.py:54:5:54:10 | SSA variable search |
113+
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict |
112114
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:61:25:61:57 | ControlFlowNode for Dict |
113115
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:62:25:62:42 | ControlFlowNode for Dict |
114116
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | pymongo_test.py:63:25:63:31 | ControlFlowNode for decoded |
115-
| pymongo_test.py:59:49:59:54 | ControlFlowNode for search | pymongo_test.py:59:25:59:56 | ControlFlowNode for Dict |
116117
nodes
117118
| PoC/server.py:1:26:1:32 | ControlFlowNode for ImportMember | semmle.label | ControlFlowNode for ImportMember |
118119
| PoC/server.py:1:26:1:32 | GSSA Variable request | semmle.label | GSSA Variable request |
@@ -128,14 +129,16 @@ nodes
128129
| PoC/server.py:46:38:46:67 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
129130
| PoC/server.py:51:5:51:10 | SSA variable author | semmle.label | SSA variable author |
130131
| PoC/server.py:51:14:51:20 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
132+
| PoC/server.py:52:5:52:10 | SSA variable search | semmle.label | SSA variable search |
133+
| PoC/server.py:52:14:56:5 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
131134
| PoC/server.py:53:17:53:70 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
132135
| PoC/server.py:60:27:60:58 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
133-
| PoC/server.py:60:51:60:56 | ControlFlowNode for search | semmle.label | ControlFlowNode for search |
134136
| PoC/server.py:76:5:76:10 | SSA variable author | semmle.label | SSA variable author |
135137
| PoC/server.py:76:14:76:20 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
138+
| PoC/server.py:77:5:77:15 | SSA variable accumulator | semmle.label | SSA variable accumulator |
139+
| PoC/server.py:77:19:82:5 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
136140
| PoC/server.py:79:23:79:101 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
137141
| PoC/server.py:83:5:83:9 | SSA variable group | semmle.label | SSA variable group |
138-
| PoC/server.py:85:37:85:47 | ControlFlowNode for accumulator | semmle.label | ControlFlowNode for accumulator |
139142
| PoC/server.py:90:29:90:47 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
140143
| PoC/server.py:96:5:96:10 | SSA variable author | semmle.label | SSA variable author |
141144
| PoC/server.py:96:14:96:20 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
@@ -226,9 +229,9 @@ nodes
226229
| pymongo_test.py:52:26:52:32 | ControlFlowNode for request | semmle.label | ControlFlowNode for request |
227230
| pymongo_test.py:52:26:52:49 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
228231
| pymongo_test.py:54:5:54:10 | SSA variable search | semmle.label | SSA variable search |
232+
| pymongo_test.py:54:14:58:5 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
229233
| pymongo_test.py:55:17:55:23 | ControlFlowNode for decoded | semmle.label | ControlFlowNode for decoded |
230234
| pymongo_test.py:59:25:59:56 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
231-
| pymongo_test.py:59:49:59:54 | ControlFlowNode for search | semmle.label | ControlFlowNode for search |
232235
| pymongo_test.py:61:25:61:57 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
233236
| pymongo_test.py:62:25:62:42 | ControlFlowNode for Dict | semmle.label | ControlFlowNode for Dict |
234237
| pymongo_test.py:63:25:63:31 | ControlFlowNode for decoded | semmle.label | ControlFlowNode for decoded |

0 commit comments

Comments
 (0)